Privacy Policy
What data Seabottles keeps, what for, for how long, and how to ask for a copy or have it deleted.
Who is responsible for your data
Fernando Carlos Debernardi, an individual based in Argentina, who operates Seabottles. He is also Seabottles' privacy officer. Contact: hola@seabottles.org (see the Legal Notice).
What we collect
To start, nothing that identifies you. You don't need to give your name, email address, or phone number. • Your account: an internal identifier, and the date you confirmed you are 18 or older. We don't store your year of birth. • Your language: the one you chose to read and write in. It sets the language of the bottles you receive and of the ones you send. • Your city and country: when you first open the app, it suggests them based on your device's time zone and language; you can change or clear them right then, and later in My Sea. • What you write: your bottles (with their decoration and the sea you chose), your replies, your chat messages, letters to your future self, and reviews you write in Reviews of the World. • What you do in the app: which bottles you received, opened, replied to, kept, resonated with, or passed on; reports and appeals you send; whether you paused your account; your switches in My Sea; and a few dates and details the app needs in order to work — for example, when you created the account, when you last looked at what's new, how you answered the offer to turn on notifications, and whether you installed the app. • Games: if you play Low Tide, what your boat carries, the last day you dove, and whether that seabed was cleared — no scores, streaks, or time played. If you light The Lighthouse, the day you lit it; if you're the first person in your country to light it that day, also your city and country, which others in your country can see. If you play in The Sand, which game, which bottle, and when (and in one game, the four countries you were shown). The Water's Edge stores nothing on our servers: its progress stays only on your device, and it's gone if you clear your browser data or close your account. • Notifications: if you turn them on, the address your browser gives us to send them (a "push subscription"), plus when your browser's push service last accepted a notification for it, when it last rejected one, and the reason it gave for that rejection. We never keep what any notification was about. • Messages to us: if you write to us through the Mailbox in the app: your message, its topic, and an email address, but only if you choose to add one. • If you add a passkey to your account: the public part of the key, so you can sign in with it; the private part never leaves your device. • If you link your Google account: Google gives Supabase, our account provider, your name, email address, and a link to your profile picture. They are kept there only to recognize you when you come back; they are never shown in the app, and they are deleted when you close your account. • Moderation records: when a bottle is flagged by our filters, which words matched, the category, and, if the AI reviewed it, its category and confidence; and the notes made about replies and chat messages (see "Automated decisions"). • Reports from public pages: when someone reports a bottle from its public page without an account, we keep the reason and the optional comment as a report. To stop repeated reports from the same person, we also store a one-way hash of their IP address, cut short; once it's more than a day old, it's deleted within the hour. Our own app tables don't store your IP address or your device model. Supabase, our account provider, keeps its own sign-in records, which include them; how long it keeps them is set by Supabase.
What other people can see
Your name is never shown. What others can see:
• Your bottles: every bottle you send, except a letter to your future self, floats in the Open Sea, where anyone with an account can read it, and has a public web page that anyone can open, including bottles in the Sea of Secrets. There is no setting to turn this off (see the Terms, sections 1 and 8). • Your city and country: with your bottles if you show your postmark, to the people you chat with, in The Sand and Crossed Paths, in the in-app strip of recent bottles, and on The Lighthouse if you were the first in your country. • Your reviews: what you write in Reviews of the World is shown to others with your city and flag for that day; after that it's hidden, but kept until you close your account.
Why we use it
• To run the service: deliver your bottles, show you the bottles that reach you, and keep your chats. • To keep people safe: moderate content, act on reports, and prevent abuse and automated accounts. Messages, reports, appeals, and Mailbox messages have hourly and daily limits. • To meet legal obligations, including preserving and reporting child sexual abuse material when it is reported to us. • To notify you, if you turned notifications on: when your bottle is opened for the first time, when it resonates with someone, when it gets a reply, when you get a chat message, and when it appears in Crossed Paths. We also compute a weekly summary of usage counts (for example, how many bottles were sent). It contains no text and no identifiers.
Automated decisions
Some decisions are made automatically:
• contact details (links, email addresses, phone numbers, usernames on other apps) are blocked before a bottle, reply, message, or review is sent; • the same bottle can't be cast twice from the same account within 30 days; • bottles are checked against our word lists without being stopped: today no bottle is returned or delayed because of them; when words match, a note is made (which words, their category and, in unclear cases, the category and confidence an AI system gives the text) so that a person on our team can review it; • replies and chat messages are checked against our moderation word lists without being stopped: when words that can signal something serious appear — that someone wants to hurt themselves, or that someone is trying to approach a minor — a note is made (which words matched, and when) so that a person on our team can see that message and its chat. No AI reads chats, and the note is deleted with your account; • a bottle is hidden while it is reviewed when someone with an account reports serious sexual or violent content, or when three different people report it within ten minutes; • reporting a chat closes it for both people; • an account is limited right away when someone with an account flags that it may belong to someone under 18, until a person reviews it. Any of these can lead to content being removed or an account being limited. You can have a person review the decision, get an explanation, and challenge it, using the "Appeal" button on the bottle or on your account.
Who we share it with
We don't sell your data, and we don't use it for advertising. There is no advertising in Seabottles, and no third-party analytics or tracking. These providers process data so the app can work:
• Supabase (database, accounts, and server functions). Our data there is stored in São Paulo, Brazil. • Cloudflare (serves the website, protects it from attacks, and runs an invisible check that tells people apart from bots; see "The invisible check"). • Anthropic (provides the AI system we use). We send it only the text of a bottle — never your account details, name, or city — and only in four cases: when our word filter can't decide on its own; when we look at Open Sea bottles for our social media posts, to leave out the saddest ones and to choose which to propose; when we choose bottles for our social media stories; and when we choose bottles for Crossed Paths, in which case the country, the month, and an anonymous code that changes every day are sent along with the text. According to its terms, Anthropic does not use this text to train its models and deletes it within 30 days. • Your browser's push service (for example Google, Apple, or Mozilla) if you turn on notifications. Notifications contain only generic text, never the content of a bottle or a message. • Google, only if you choose to link your account. Fonts are served by Seabottles itself, so no font service receives your IP address. Contributions ("Keep the Sea Afloat") happen outside Seabottles, on the payment provider's site and under its policies. We don't receive any payment data, and a contribution is not linked to your account.
The invisible check
When you reach the entry screen, Cloudflare Turnstile briefly looks at technical signals from your browser to tell a person apart from an automated program. It runs for everyone who reaches that screen, and it can also run when someone reports a bottle from its public page. We use it to keep the sea free of bots.
Where your data is stored
Your data is stored outside the United States and Canada: our database is in Brazil, and Cloudflare and Anthropic process data in other countries, including the United States. When data is transferred abroad, we rely on the protections in each provider's contract.
How long we keep it
• Your account and everything in it: until you close your account. When you close it, all of this is deleted immediately: your profile, bottles, replies, messages, reviews, appeals, notification address, game data, and Mailbox messages. • Bottles you delete without closing your account: they disappear from the app, except that people who already started a chat with you about that bottle can still read it there; we keep them in our database until you close your account or permanently delete them from the Deleted tab. At that point they are erased for good; chats other people started about them remain, but without the bottle's text. If the bottle was reported for something serious, we first preserve the evidence, as we do when an account is closed. • Bottles that sink (their time at sea is over): kept in your archive until you close your account. • Letters to your future self: kept until they arrive, a year later, and then like any other bottle. • Unused accounts: accounts not linked to Google that haven't been opened in 30 days and never sent, opened, kept, or reported anything are deleted automatically. What remains after you close your account:
• In chats with other people, their messages stay; yours are deleted. • Reports you made are kept, no longer linked to your account, so our moderation history stays complete. Reports about your bottles are kept too. • If you made a report of serious sexual or violent content, or of a possible minor, or someone made one about your bottles or about a chat you wrote in, we keep a copy of the report and of the bottle (and, for a chat, its messages) as evidence for the authorities, for as long as the law requires. • A minimal record that the account was closed, and our moderation log, which includes account identifiers. • If we posted one of your Open Sea bottles on social media, a record with its first words and the link to the post, so we can take it down. • For Crossed Paths, the reason the AI gave for a pair and its heading. • If you ever moved your account to another device, a copy of what moved, so the move can be undone.
Your rights
You can ask to access, correct, delete, or receive a copy of your data, or to object to how we use it, by writing to hola@seabottles.org. You can also request a copy of your data in the app ("Get a copy of my data"). We answer within 30 days. • Canada: you can complain to the Office of the Privacy Commissioner of Canada, and in Quebec to the Commission d'accès à l'information. • United Kingdom: you can complain to the Information Commissioner's Office (ICO). • Ireland and the European Union: you can complain to Ireland's Data Protection Commission, or to the data protection authority where you live. • United States: state privacy laws that grant specific rights usually apply only to businesses above certain size thresholds, which Seabottles doesn't meet today; we offer the same rights to everyone anyway. If there is a security breach that puts your data at real risk, we will notify you and the authorities as the law requires.
Minors
Seabottles is only for people 18 and older. We don't knowingly collect data from minors. If we find an account that belongs to a minor, we close it and delete its data. See “Minors and age verification.”
Changes
If we make a meaningful change to this policy, we'll tell you in the app before it takes effect. Last updated: October 11, 2026.