Privacy Policy

1. What is collected

·On creating an account: email address, display name, and a password, which is stored as a one-way hash that cannot be reversed and never in the clear.

·Optional: passkeys (a public key and device details) and a two-factor authentication secret.

·Collected automatically on authentication events such as signing in, signing out or changing a password: IP address, browser user agent, the time, and whether it succeeded.

·For keeping a session open: token records with the IP address, the browser user agent, and issue and expiry times.

None of the account or authentication data above is collected from a visitor who only reads the catalogue.

·Web server access log (every visitor): when you open a page, the web server records the IP address, the browser user agent, the address requested, the page you came from (Referer), the time, and the result. This includes visitors without an account.

2. Why

·To identify and authenticate an account, and to verify its email address.

·To provide account security features such as password reset and two-factor authentication.

·To detect and respond to unauthorised access, and to keep a record that answers what happened and when.

·To send account-related email.

·Web server access log: to keep the service running and secure — finding the cause of faults, and detecting and blocking abusive access.

·Visit counts: from a copy of the access log with IP addresses and cookies removed, only the number of visits by day, language, kind of page and where they came from (a search engine, an AI service and so on). The counts identify no one, and no record of what any one person read is made.

3. The legal basis for processing

For users reading from the European Economic Area or the United Kingdom, where the GDPR applies, the basis for each purpose is:

·Creating and maintaining an account, and signing in — performance of a contract (GDPR Art. 6(1)(b)).

·Keeping authentication records and responding to unauthorised access — the legitimate interest of keeping the service and its accounts secure (Art. 6(1)(f)). Only what that purpose needs is recorded, and it is deleted automatically once the period below passes.

·The web server access log and visit counts — the legitimate interest of running the service securely and knowing how its pages are used (Art. 6(1)(f)). The counts are made only after the IP address is removed.

·Where the law requires something of us — compliance with a legal obligation (Art. 6(1)(c)).

4. How long it is kept

Authentication records, including the IP address and user agent, are deleted automatically after 365 days by default. The operator may change that period but cannot set it below 30 days. The deletion job runs daily.

Session tokens expire 30 days after they are issued, and are void at once on signing out or revoking the session.

Account data is kept while the account exists and is removed on request. Deleting an account is not yet possible from the account screens, so please write to the address below.

The web server access log is started afresh every day and each day's file is deleted automatically after 30 days. Visit counts (the number of visits per day) identify no one and are kept without a set period.

5. Cookies and browser storage

·yc_access_token and yc_refresh_token — to keep you signed in, for 15 minutes and 30 days. HttpOnly, Secure, SameSite=Lax.

·NEXT_LOCALE — remembers the chosen language, for a year.

·Browser local storage — remembers the models in your compare tray, the models you mark, and whether you read in metres or feet. All three stay in your browser: they are not sent to the server and not kept against an account.

There are no advertising or behavioural tracking cookies.

Everything above is either strictly necessary for something you asked for or a setting you chose yourself. Because nothing here is a non-essential cookie requiring consent, the site has no cookie banner.

6. Analytics and advertising

The service runs no web analytics — no Google Analytics or anything like it — and no advertising trackers, and puts no analytics script or cookie in your browser.

Visit counts are made from the web server access log described in sections 1 and 2, as numbers only, after the IP address is removed. No record of what any one person read is made, and nothing is shared with anyone.

7. Processors

These are the companies that process personal data on our behalf, and what each one does.

8. International transfers

Personal data is stored in the Republic of Korea. If you use the service from elsewhere, your data is transferred to and processed in Korea.

For transfers out of the European Economic Area: the Republic of Korea is the subject of an adequacy decision of the European Commission (2021), so a transfer from the EEA to Korea needs no separate standard contractual clauses.

9. Your rights

You may ask to see, correct or delete your personal data, or to stop its processing. Where the GDPR applies, that also includes objecting to processing and data portability — receiving your data in a machine-readable form.

·Your display name and password can be changed on the account screens, which also list the devices signed in and let you revoke a session.

·For anything else, write to the address below and we will act on it.

·If you are unhappy with how your data is handled, you may complain to a supervisory authority: in Korea, the Personal Information Protection Commission and its report centre (privacy.kisa.or.kr, 118); in the EEA and the UK, the authority of the country you live in.

10. How it is protected

·Passwords are stored as one-way hashes that cannot be reversed, as are two-factor recovery codes; the originals are never kept.

·Authentication cookies are HttpOnly, Secure and SameSite=Lax, so no script can read them.

·Passkeys and two-factor authentication are available, and you can revoke your own sessions.

·Authentication events are recorded and deleted automatically once the retention period passes.

·The operator console has its own authentication, separate from the one visitors use: its own cookies, its own tokens, and passkeys and two-factor authentication available on it.

11. Who to write to about personal data

The duties of a data protection officer are carried out by the data protection desk at Rorolab Studio.

Requests to see, correct or delete your data, to stop its processing, or any other question, go to info@yachtcodex.com.

12. Changes

This notice is in effect from 2026-10-05.

What changed from the previous notice (2026-09-24): the web server access log, which was already kept, and the visit counts made from it with IP addresses removed are now described in what is collected, why, on what basis and for how long. The access log is now kept for 30 days.

A change is published on this page with its new effective date.