What we know about you.

A small site run by one person, published for readers who are trusting us with their stories. This is the whole picture: what gets collected, why, who sees it, and how to make us delete it.

Last updated July 26, 2026Plain English

The short version

We collect what an account and a published story need, plus basic server logs and Google Analytics.
We have never sold or shared personal data and we never will. There are no ad networks and no data brokers here.
Two things store a cookie: the login that keeps you signed in, and Google Analytics.
Email hello@mysailingstories.com to see, correct, export, or delete what we hold. Unsubscribes are honored within two days.
You must be 13 or older to hold an account.

This policy is part of the Terms of Service and covers mysailingstories.com and the email digest.

1. What we collect, and why

Your account

Your name, your email address, and a password. The password is stored only as a salted cryptographic hash and is never held in readable form, so nobody here can see it or tell you what it is. We keep the date the account was created. This is what makes an account an account: it is how you log in and how your byline attaches to your work.

Your profile, all of it optional

A handle, a short biography, your home port, boat name, boat type, the year you started sailing, and a profile photograph. None of it is required. All of it is public if you fill it in, because its only purpose is to sit alongside your stories.

What you publish

Stories, photographs, video, comments, and the ship's log details attached to a story. Published content is public by design, visible to anyone on the internet and to search engines. Drafts are not public.

Photographs and the data inside them

Photographs often carry embedded camera data (EXIF), which can include the make of the camera, the date, and in many cases the GPS coordinates of where the shot was taken. When you upload a still photo (JPG, PNG, WebP, or an iPhone HEIC), the copy we publish is re-encoded and that embedded data, including any location, is removed before anyone else sees it.

Animated GIFs and videos are the exception: we publish those as you uploaded them, without re-encoding, so any location data they carry stays in the file. If you would rather not share where a clip was taken, strip that data before you upload it.

We also keep the file you uploaded, privately and unpublished, because the original is the evidence of where a photograph came from if anyone ever questions it. If you delete your content, the retained original goes with it.

Your agreement to the Terms

When you tick the box agreeing to the Terms of Service and Community Guidelines, we record the date and time, your IP address, which form you were on, and which version of the Terms was on screen. That record is the proof that an agreement happened, and it is the main reason an IP address is ever stored against your account.

Server logs

Like every web server, ours records IP addresses, browser and device strings, the pages requested, where the request came from, and timestamps. We use this for security, for rate limiting and abuse prevention, and for finding out what is broken. Logs rotate automatically and are kept for a short period, weeks rather than years. We do not build profiles from them.

Google Analytics 4

We use Google Analytics 4 to see which stories people read and roughly where readers come from. Google receives the page you viewed, the referring page, your device and browser type, and your IP address, which it uses to derive an approximate (city level) location. In Analytics 4, Google does not store the IP address itself. We see aggregate reports, never a named individual.

Google processes that data under its own terms. See the Google Privacy Policy. You can refuse it entirely with the Google Analytics opt-out browser add-on, or by blocking analytics cookies in your browser. Nothing on this site stops working if you do.

The Manifest and the digest

If you sign the Manifest or subscribe to the digest, we keep your email address and the date you signed up, so that we can send you the thing you asked for. Nothing else.

2. What we do not collect

Payment details. The site is free and takes no payments.
Precise location from your device. We never ask your browser for it.
Biometric data, health data, or anything else in a sensitive category.
Your activity on other websites. There are no tracking pixels, no advertising networks, and no cross-site profiles here.
Anything bought from a data broker. We have never purchased data about anybody and we will not.

3. Cookies

We use three, and two of them are strictly necessary.

mss_session: keeps you logged in. Set when you sign in, holds a random token and nothing about you, expires after 30 days or when you log out. Strictly necessary.
mss_desk: crew access to the Writer's Desk during the transition to member accounts. Strictly necessary for the people who use it, and never set for ordinary readers.
Google Analytics cookies (_ga and _ga_ with a property suffix): measurement, set by Google, lasting up to two years. Not necessary. Block them in your browser or use the opt-out add-on above and the site works exactly the same.

There are no advertising cookies and no third-party trackers beyond Google Analytics.

4. How we use what we collect

To run your account and publish your work under your byline.
To moderate: to review submissions, to act on reports, and to keep a record of what was removed and why.
To keep the site secure: rate limiting, abuse prevention, and investigating attacks.
To send you what you asked for, meaning the digest and account notices.
To measure, in aggregate, which stories are being read.
To comply with the law and to respond to valid legal process.

We do not use your personal information to train AI models, we do not use it for advertising, and we do not make automated decisions about you that have legal effects.

6. How long we keep it

Account information: while your account is open, and a short period after it closes.
Published content: until you delete it or close your account. Backups are overwritten or purged in the ordinary course, currently within 90 days.
Agreement records: for as long as we might need to show that you agreed, generally the life of the account plus four years, which matches the Pennsylvania limitations period for contract claims.
Moderation records: kept for as long as they are useful for enforcing the repeat infringer policy and spotting patterns of abuse.
Server logs: weeks, then rotated away.
Newsletter subscriptions: until you unsubscribe, plus a suppression record so we do not accidentally add you back.

7. Your choices

Email hello@mysailingstories.comwith the subject line "Privacy request" and we will:

Tell you what we hold about you.
Correct anything that is wrong.
Send you a copy of your stories and photographs in a usable form.
Delete your account and your content, subject to the narrow exceptions in section 4.5 of the Terms.

We answer these within 30 days, usually much sooner, and we do not charge for them. We may keep what the law requires us to keep, and what an unresolved copyright or abuse matter requires, and we will tell you if that applies.

Unsubscribing: every email carries an unsubscribe link, and we honor unsubscribes within two days. You can also just reply and say stop.

Several state privacy laws (California, Virginia, Colorado, and others) apply only to operators far larger than this one, and MySailingStories is well below every threshold. We honor these requests regardless of whether a statute makes us.

8. Security

Passwords are hashed with scrypt and a per-account salt. The site is served over HTTPS. Login and submission endpoints are rate limited. Administrative access is limited to the people who run the site.

No system is perfectly secure, and anybody who tells you otherwise is selling something. If you find a vulnerability, email hello@mysailingstories.com and tell us privately first. You will get a thank you and, if you want one, a credit.

9. Children

The Service is for people aged 13 and over, and we do not knowingly collect personal information from anybody under 13. If we learn that an account holder is under 13, we close the account and delete the information.

If you are a parent or guardian and believe a child under 13 has given us information, email hello@mysailingstories.comand we will delete it. A parent or guardian may hold an account and publish a young sailor's story under that young sailor's byline.

10. Where the data lives

The site runs on servers in the United States, and information you give us is processed and stored there. MySailingStories is a United States site aimed at sailors in the United States and Canada. If you use it from elsewhere, you are sending your information to the United States.

11. Do Not Track

Browsers send a Do Not Track signal that never acquired an agreed meaning, so like most sites we do not respond to it specifically. It makes little difference here: we do not track you across other websites in the first place, and the analytics opt-out above turns off the only third-party measurement on the site.

12. Changes to this policy

This policy is dated. If we change it materially, we will say so by email to registered members or by a prominent notice on the site before the change takes effect, on the same terms as section 16 of the Terms. Corrections and clarifications take effect when posted.

13. Contact

Privacy questions and requests go to hello@mysailingstories.com, or through the Contact page. A person reads it.

Fair winds and following seas.