PortStory

📅 Last updated

This Privacy Policy was last updated on 17 September 2026. It explains what personal data PortStory processes, on what legal basis, and the rights you have under the GDPR.

🧭 Controller

The controller responsible for data processing is:

Kai Below (KDB.one)
Nettelbeckstraße 13, 46149 Oberhausen, Germany
Phone: 0203 / 55588855 · Email: support@portstory.app
Full provider details: Imprint

📦 Data we process, purposes & legal bases

• Your journey data (ports, ships, voyages, dates, notes) — to provide the app's core function. Stored on your device and, when you sign in, synced via Firebase. Legal basis: Art. 6(1)(b) GDPR (performance of a contract) or Art. 6(1)(f) for local-only use.
• Account data (email, display name, username, password) — to create and secure your account via Firebase Authentication. Legal basis: Art. 6(1)(b).
• Payments — for the optional Premium purchase, payment is processed by Stripe. We receive confirmation of your subscription status; card data is entered directly with Stripe and is not stored by us. Legal basis: Art. 6(1)(b).
• Push notifications — if you enable them, a device token is stored to deliver port/voyage alerts via Firebase Cloud Messaging. Legal basis: Art. 6(1)(a) (consent); withdrawable in your device/app settings.
• Emails — account emails (verification, password reset) are sent via Resend; legal basis Art. 6(1)(b)/(f). Promotional emails are sent only with your separate opt-in; legal basis Art. 6(1)(a), withdrawable any time via the unsubscribe link or your profile.
• Support and press enquiries — when you email support@portstory.app or media@portstory.app, or use the contact form in the app or on portstory.app or the beta sign-up at portstory.app/beta, we store your email address, name (if given), subject, message, attachments (images and PDFs) and, if you are signed in or use the same address as your account, a link to your PortStory account — to answer and handle your request. Mail is received and sent via Resend. Legal basis: Art. 6(1)(b) for questions about your account or purchase, otherwise Art. 6(1)(f) (answering enquiries). Press releases sent to us may be used as a source for our magazine.
• Usage analytics — only if you consent, Firebase Analytics helps us understand and improve app usage. It is off by default. Legal basis: Art. 6(1)(a) and § 25(1) TDDDG; withdrawable any time in your profile.
• Community itineraries — when you create a voyage, its anonymised route (ship, date, ports, times — no personal data, not linked to you) is automatically added to a shared itinerary database to improve trip data for everyone. Legal basis: Art. 6(1)(f) (legitimate interest). You can turn this off any time in your profile.
• Server logs — hosting and cloud functions temporarily process technical data (e.g. IP address) to deliver and secure the service. Legal basis: Art. 6(1)(f).

🔗 Recipients & processors

We use the following providers under data-processing agreements:

• Google Ireland/LLC – Firebase (Firestore, Authentication, Cloud Messaging, Analytics, Hosting, Functions). Privacy →
• Stripe Payments Europe (payment processing). Privacy →
• Resend (sending and receiving email, including support and press mail). Privacy →

The app also loads technical resources (map tiles/library, a currency and a weather service, ship-position data). This transmits your IP address to the respective provider as a technical necessity to display the content (Art. 6(1)(f)). The payment page loads Stripe's script directly from Stripe.

🌍 International transfers

Some providers (e.g. Google, Stripe, Resend) may process data in the United States. Such transfers are safeguarded by the EU–US Data Privacy Framework and/or the EU Standard Contractual Clauses under Art. 46 GDPR.

⏳ Retention

Account and journey data are stored until you delete them or your account (in-app “Delete account”). Server logs are kept only briefly for security and then deleted. Support requests are deleted 12 months after they were answered or closed, and at the latest 24 months after the last message; press mail 12 months after receipt — press photos used in a magazine article stay with the article. If you delete your account, your support requests lose the link to your account, your name and email address. Consent records are kept as evidence for as long as required.

🛡️ Your rights

You have the right to access (Art. 15), rectification (16), erasure (17), restriction (18), data portability (20) and to object to processing based on legitimate interests (21). Where processing is based on consent, you may withdraw it at any time with future effect. To exercise your rights, contact support@portstory.app.

🍪 Cookies & on-device storage

PortStory stores data on your device to work (your journey, login and settings) — this is strictly necessary and requires no consent. Usage analytics is not strictly necessary and is only activated after you agree in the consent banner. You can change or withdraw this choice any time under Profile → Usage analytics.

👶 Children

PortStory is not directed at children. If you are under 16, please use it only with the consent of a parent or guardian (Art. 8 GDPR).

✏️ Changes

We may update this policy to reflect changes to the app or the law. The current version always applies and is available in the app.