Privacy

We hold your sailings, what you paid, what you wrote, and who you travel with. We do not run advertising, and there are no analytics or third-party trackers in this app.

We do not track where you are. There is one place the app can ask your phone for its position — when you mark the gangway in a port, so you can find your way back — and that answer is written to your phone and nowhere else. We never receive it.

Photographs have their location data stripped before they are stored. Share links show a ship, never a person's whereabouts.

We publish and may sell statistics about cruises — what they cost and what they are like. Never about you. That is how this app stays free, and it is set out in full below.

Your account. An email address and password, held by our authentication provider and never by us directly. A username, display name, picture and bio, which you choose.

Your travel. Which sailings you are on, your cabin number if you enter it, who is in your party, and any children you list: a first name, birth year and cabin, nothing more.

Money. What you paid for a sailing, prices you record, shared expenses, slot pull stakes. Your own fare is private to you. The one shared figure is a median across at least three people, and never attributed.

What you write. Roll call posts, questions and answers, port tips, reports you file.

On your device. When you record something with no signal it is held on your phone until there is a connection. Signing out deletes anything still waiting.

Photographs of the daily planner. If you photograph the ship's daily, that picture is kept on your phone and nowhere else. It is never uploaded, never shared with your party, and it goes when you sign out. The times and event names you import from it are shared with the sailing; the sheet is not.

Some of what we hold is about people who never agreed to anything, and that deserves saying plainly.

Children on a party manifest have a first name, a birth year and a cabin. They have no login, no profile, no photograph, and they never appear on a roll call, a share link or anywhere else. That was a deliberate decision, not an oversight.

People who follow a share link give an email address to be told when the ship reaches a port. Nothing is sent until they confirm, every message has a one-click unsubscribe, and the traveler who made the link sees a count, never an address.

Guests in a group may be listed by name so an expense or a slot pull can be split. A name and an amount, held by that group.

People in photographs. A photo may show other passengers, staff or children. If you are in one and want it removed, ask us here no account needed.

People who try the chart on the front page paste a booking confirmation and see it drawn as a route. The text they paste is read and not stored: not the name on it, not the booking reference, not the cabin or the fare. What we keep is the sailing it described: the ship, the dates, and the ports as the cruise line wrote them, including the ones we could not place on our chart, so the next person's chart is a little better. That record has no name, no address, no account and no time finer than the day, so it cannot be traced to whoever pasted it. It describes a cruise, not a person.

People asking for an invite give an email address and, if they want to, one line about the cruising they do. That is all the form accepts and all we keep. It is used to send one invite and nothing else. No newsletter, no reminders, no passing it on. Ask us to delete it and it goes; you do not need an account to ask.

This app is free, and this is how. We publish statistics about cruises, and we sell them to people who want to understand the cruise market — lines, agencies, researchers, investors. It is worth saying that plainly rather than burying it, because it is the business, not a footnote to it.

There are three kinds, and they are kept apart from one another.

What cruises cost. What a cabin type typically goes for on a route, by ship and party size. Drawn from fares people recorded after booking.

What cruises are quoted at. Prices people saw while considering a sailing, whether or not they ever booked it. That is what shows how a fare moves as a sailing fills. Held separately from fares actually paid, because a figure mixing the two would describe neither.

What cruises are like. How long ships stay in a port, which routes are busy in which month, when a ship's activities typically run. Counts and medians about voyages.

Today we produce price statistics only. If we produce the others, every rule on this page applies to them unchanged — including the switch in account settings, which leaves you out of all of it, not just the prices.

These describe cruises, not cruisers. A published figure never contains your name, email, username, photos, messages, party, cabin number, who you sailed with, where you went ashore, or your own recorded fare. It is a median or a count across a group.

We do not sell a record of what any one person did. Not aggregated, not pseudonymised, not bundled with others. There is no version of this where a buyer receives rows about individuals, and the fare table has no column that could say whose a figure was.

No figure is published unless at least ten different people are behind it, and it is withheld if any single one of them makes up most of the group. Anything narrower is discarded rather than published, because a small enough group can describe one person even without naming them.

You benefit from this too. It is the same pooling that tells you when your own fare has dropped.

If you would rather not be included at all, there is a switch in account settings. It takes effect immediately and removes you from every future figure.

No location tracking. A ship's position on the map is worked out from its published itinerary. No phone is tracked, and nothing about where you are is ever sent to us.

One exception, and it stays on your phone. If you tap “I'm at the gangway” in a port, the app asks your phone where it is so it can tell you how far away your ship is later. That position is written to this device's own storage. It is not sent to us, not stored on our servers, not visible to anybody else, not part of any export, and not part of the de-identified statistics described below. It is deleted when you sign out, and you can clear it at any time from the same screen. Your phone will ask your permission the first time, and the feature simply does not work if you say no.

No location in photographs. Every uploaded image has its embedded data, including GPS coordinates, removed before it is stored.

No advertising, analytics or trackers. There is no tag manager, no pixel and no session recorder in this app.

No booking references. When you paste a confirmation email we read the fare and the itinerary. Booking references and loyalty numbers are discarded.

Your roll call is limited to people on that sailing. Your party is limited to its members. Your own fare is yours alone.

Messages are between the two of you. Nobody else reads them in the ordinary course of anything. They are not end-to-end encrypted, though, so honesty requires saying that wecould — and describing what actually stops it, which is built rather than promised.

Nothing is looked at without a report. If one of you reports a message, the person reviewing it sees counts first and no words at all: how many messages, how often, whether you replied, whether anything arrived after you blocked them, and whether other people have reported that account before. Most reports can be settled there, and reading that is not recorded because there is nothing in it to record.

Reading the words is a second step. It shows five messages either side of the one reported — not the conversation — and it is written into a log that cannot be edited or deleted by anyone, including us. Opening the whole conversation is a third step, needs a reason written out in a sentence, and is recorded with that reason attached. Both stop working the moment the report is resolved.

Nothing you write in a message is ever part of the data we sell, and reporting somebody does not tell them you did.

One exception, and it is a narrow one. If somebody reports a message, that message is kept with the report including if the person who sent it later deletes their account. Otherwise somebody could erase what they said by leaving. It is removed when the report is, under the retention periods below. Nothing else you have written is kept that way.

Photographs are unlisted rather than private. Reading a roll call requires being on that voyage, but the image file itself can be opened by anyone who is sent its address. Treat a photo here as you would one you sent in a group chat.

Share links. Anyone holding the link can see the ship, its itinerary, and anything you have chosen to share to it. They expire, you can revoke them, and search engines are asked not to index them. They show the vessel. Never where you personally are.

Supabase stores the database and the files. Vercel hosts the site and logs requests, including IP addresses. Resend sends email, and Resend sends it through Amazon Web Services.

Each of those companies uses its own providers. We do not control those choices, and every one of them publishes its current list. We name the ones whose systems your data actually passes through, and we would rather name one too many than describe a shorter path than the real one.

The map is served from here. Map tiles come from our own domain rather than a mapping company, so nobody else learns your address or which part of the world you are looking at. That matters most on share links, which family members open without ever making an account.

Get a copy. Account settings has a download button. It contains everything about you and nothing about anyone else.

Correct it. Your profile, fares, posts and tips are all editable.

Delete your account. Your name, picture, email and login are removed. Posts other people replied to stay with your name taken off, so their conversations still read, and money already recorded in a shared ledger stays. Removing it would change what other people are owed.

Stop the emails. There are two kinds and both have a one-click unsubscribe. Arrival notices go to people following a share link. Final payment reminders go to you, before a date you entered on your own booking. You can also turn those off, and back on, from your profile.

While your account exists: your sailings, posts, ledgers and everything else you have added.

90 days after you remove something deleted posts, tips and expenses are held briefly so a mistake can be undone or a report finished, then permanently deleted.

24 months: reports, removal requests and bug reports, once they have been resolved. Anything still open is kept until it is dealt with.

30 days after you unsubscribe — the email address of anyone following a share link.

Indefinitely, with nobody attached itineraries, ports, ships and fare observations that carry no identifier. Once a record cannot be traced to a person it is no longer about anybody, and we keep it to make the app work for everyone else.

Deleting your account removes you completely. It leaves an anonymous record with no name, picture or email, so conversations other people took part in still read.

Sea Manifest LLC, Texas, United States. For anything about your data, email privacy@seamanifest.com.

If you appear in a photograph here and want it removed, the removal request form reaches a person and does not require an account.