How we handle your data

SeaShopping is built and hosted on the Lovable platform. That means Lovable's servers run the website and its backend (accounts and database), and the app uses a few outside services for specific features. Those are listed below, each with exactly what it receives.

Without an account — everything you enter (crew, trip plan, recipes, shopping list, staples, spices and saved shops) is stored only in your own browser's local storage and never leaves your device. You can use the whole app this way.

With an optional account — your galley planning data (crew, trips, menus, lists, staples, spices and saved shops) syncs to your account on the backend, so the same setup follows you across phone, laptop and tablet. A copy stays in your browser's local storage so the app keeps working offline at sea and syncs back when you reconnect. Signing in also unlocks the shared recipe library, dish ratings, and the market search and AI features. Accounts are invite-only to keep numbers and running costs under control, and signing in is always optional.

To create an account you provide an email and password, or sign in with Google, Apple or Microsoft. Passwords are hashed by the authentication provider — SeaShopping never sees or stores your raw password.

The backend stores a small profile row (your email), your role (admin or regular user), your saved galley setup (crew, trips, menus, lists, staples, spices and saved shops) so it syncs across your devices, shared dishes you choose to submit, and your star ratings on shared dishes. Sign-up is invite-only: each invite code works once, is checked server-side, and can only be created or redeemed by trusted server code.

Each user's own data is isolated by row-level security (RLS). In practice that means you can only read and write your own profile, galley setup, submissions and ratings — no other crew or skipper can see your private rows. Shared dishes and their ratings are the exception: those are deliberately visible to other signed-in crews, as described below.

Signed-in crews can share a dish they have built with other crews. Submitting a recipe stores its contents on the backend together with your account id and a review status. An admin checks each submission and can approve it, decline it, or later unpublish it — optionally adding a short review note, which also records the reviewer's account. Only approved dishes become visible to other signed-in crews; your own drafts and submitted recipes stay private to you while they wait.

Any signed-in crew can give an approved shared dish a rating of 1 to 5 stars. You get one rating per dish, and you can change or remove it at any time. Ratings are visible to other signed-in crews, along with the average. SeaShopping collects stars only — no written comments, names or photos are stored with a rating.

You can withdraw a recipe you have submitted as long as it is still waiting for review, and an admin can permanently remove a shared recipe for everyone. Because these dishes and ratings are shared, the data in this section is the one part of your account that other signed-in users can see.

When you search for shops nearby, the app sends either your current location (from your browser's GPS, which it asks your permission for) or the town or port name you typed, to Google's Places service (via Lovable's connector). Google returns nearby grocers and markets, their opening hours, ratings and rough price bands.

Google receives that search location or query and handles it under Google's own privacy policy. This feature requires a signed-in account, because it is a paid service.

SeaShopping uses an AI model (openai/gpt-6-astra) through the Lovable AI Gateway for a few things. All require a signed-in account, because each call has a cost.

Estimate budget — we send your shopping list (item names, quantities, units, crew size and days) to the model, which returns a euro cost estimate. This is clearly labelled an estimate of typical Mediterranean supermarket prices, not today's shelf prices or a checkout total.

Import a dish from a description — we send your short text description plus your crew size, galley gear and diet settings, and the model drafts a recipe for you to review before saving.

Translation — if you pick an interface language other than English, the app's menu and label texts are sent to the model once per language and the result is cached for everyone. When you ask to translate a dish, that recipe's text (name, description, steps, notes, ingredient names) is sent the same way. Quantities and units are never altered by translation. No personal data is included in either case.

Import a dish from a web link — our server fetches the recipe page you paste, reads its text, then sends that text with your crew, gear and diet context to the model. The server checks the address on every hop (including redirects) and refuses anything pointing at internal or private network addresses, so a link can't be used to reach hidden services.

These AI calls are made with store: false, which means the inputs are not retained by the model provider beyond the request. We don't crawl the web on our own — only the exact page you paste is ever fetched.

SeaShopping uses a signed session so you stay logged in, and remembers your light/dark theme choice. Your full galley data is kept in your browser's local storage. No advertising or third-party tracking cookies are used.

In the Lovable editor preview only, unexpected errors (the error message, a stack trace and the current page path) are sent to Lovable's telemetry to help fix bugs. No recipe or personal content is deliberately included beyond what happens to be in the error itself.

• All inputs are validated on the server, not just in the browser.
• Invite codes can only be created or redeemed through trusted server code, never directly from a browser.
• Paid and AI features, plus market search, require a signed-in session — they can't be run up anonymously.
• Admin actions are checked server-side through a role check, not in the browser.
• Private API keys live only on the server and are never shipped to the browser.
• Recipe-link import checks every address it follows and refuses internal or private targets.

Without an account: your data lives in your browser until you clear it or use the in-app "Reset everything" option.

With an account: you can sign out at any time, and you can request deletion of your account and stored galley data by contacting the email below.

You can export your browser data at any time using the print and share features on the shopping list and calendar pages.

SeaShopping is intended for adults provisioning a boat. It is not directed at children, and we don't knowingly collect data from them.

SeaShopping does not yet handle any payments. When paid plans or subscriptions are introduced, a PCI-compliant payment processor (such as Stripe) will handle card details directly — SeaShopping will never see or store full card numbers. Only your plan and billing status will be kept. This section will be updated and re-dated before any payment feature goes live.

For access to, correction of, or deletion of your data, email patrik.maltusch@gmail.com.