Two plain facts first
This is social privacy sized for keeping acquaintances out of each other's plans — it is not a security model.
The operator can read the database.
What is stored
- Your name as it appears on the manifest — the name on the seat you redeemed. No email address, phone number, or password is stored for signing in; your device holds a key instead.
- What you put on the program — items, proposals and your answers to them, program items you join, and “Out” claims. An Out claim stores only its time span: there is no reason field in the database at all.
- “Interested” bookmarks — stored, shown only to you, and never sent to anyone else in any form, including counts.
- Memberships — which cabins, cruises, and parties you belong to, and any blocks you set (the blocked person is never told).
- Housekeeping — hashed sign-in keys, invitation slots, an append-only log of Director actions, and rate-limit counters that store a scrambled form of IP addresses for a day.
Where it lives
- A Cloudflare D1 database operated for this one line.
- Nightly append-only snapshots kept for 30 days, then deleted automatically. (Until snapshot storage is enabled for the account, no backups exist at all — the live database is the only copy.)
- On your device: your program cache and anything you wrote while offline, until it posts.
Who sees what
- Visibility follows membership: cabin-mates see your untagged committed days; a cruise roster sees cruise-tagged items; a party sees party items and the cruise never sees into the party. Leave a scope and the visibility ends with it.
- A blank day of someone else's shows as “no info,” never as free.
- Nothing here is public. There is no browse, search, or directory; the only door is an invitation link plus its passphrase.
What leaves via calendar feeds
Feeds exist only if you create them, and each feed URL is a key — anyone holding it can read that calendar. Your personal feed carries committed items only. A cruise feed carries fixtures and program items only — never anyone's personal items.
Deleting your data
“Delete my data” in Settings removes every item, answer, claim, and key you own, immediately, and marks your seat as departed. Cruise programs and fixtures you authored remain, credited to “a former member.” Backup snapshots age out within 30 days, so deletion is complete within 30 days. Being removed by a Director only ends your access; it deletes nothing of yours — nobody can delete another person's data.
Terms
- You must be 13 or older to use this service.
- It is provided as-is, with no warranty of any kind. It is a family tool, not a commercial service.
Accessibility & reporting a barrier
This app aims for WCAG 2.2 AA, checked automatically on every change. If something here shuts you out — a control you can't reach, text you can't read, a state you can't tell apart — that is a defect on the same footing as a crash. Report it through the fleet accessibility statement's contact path, or tell any Director and they will pass it on with the diagnostic report from the ⓘ panel.