Privacy Policy

Effective: October 26, 2026 · Last updated: October 19, 2026

Yathop is a yacht discovery and boat-show companion app operated by YATCO, LLC ("YATCO", "we", "us"), 700 W Hillsboro Blvd, Suite #4-201, Deerfield Beach, FL 33441, USA. This policy explains what we collect through the Yathop mobile app and the yathop.com website, why we collect it, who we share it with, and the choices and rights you have.

YATCO's other websites, yatco.com and yatcoboss.com, are covered by the YATCO Privacy Policy. Each policy applies to the service it names.

Questions or requests: support@yathop.com.

What we collect

Account details you give us. Email address and password (stored as a secure hash), display name, and optionally a phone number, date of birth, your role in the yachting world, your crew position, a LinkedIn URL, and a profile photo. If you sign in with Apple, Google, or LinkedIn, that provider shares your name and email with us to create your account.

How you use Yathop. Your interests, saved vessels ("Dream Fleet"), swipes and likes, vessels you viewed, searches, boats you tell us you own (Qualify Me), show attendance, event registrations and tickets, QR codes you scan, and event check-ins. We use this to personalise your feed and power the features you see.

Messages. Direct messages you send, including photos, PDF files, and locations you choose to share, are stored encrypted on our servers. Before a photo is stored we save a new copy of it, which removes hidden details such as the place the photo was taken (GPS) and the camera model. Only the people in the conversation can open a photo or file, and the link the app uses to open it stops working after 24 hours. A location you share is the exact place you pick, and it stays in that conversation like any other message.

Community. If you use Community, we store the posts (text and photos) and comments you write and the posts you like. Posts and comments are visible to all signed-in Yathop members, together with your name, profile photo, and role. Because every member can see them, Community photos are not encrypted at rest the way message photos are; before a photo is stored we save a new copy of it, which removes hidden details such as the place the photo was taken (GPS), and the app opens photos through links that stop working after 24 hours. When someone comments on your post we can send you a notification, which you can turn off in the app's notification settings. You can delete your own posts and comments at any time; a deleted post is removed from Community at once and its photos are erased shortly after.

Automatic photo check. Photos you send in a message, post in Community, or upload as your profile photo may be checked automatically by Google Cloud Vision SafeSearch before they are saved. Google rates whether the photo is likely to show nudity or violence and returns that rating to us; it processes the photo only to provide that check to us. No name, email, or other account details are sent with the photo. A photo rated likely to show nudity or violence is refused and is not sent or saved.

Things you tell our AI features. The first time you use Ask AI search or describe a boat you own in Qualify Me, the app asks whether the text you type may be sent to our AI service provider, Anthropic, to interpret it. It is sent only if you choose Allow. If you choose Not now, search and Qualify Me still work: we read your text with our own rules and nothing is sent to Anthropic. You can change your choice at any time in Account → Privacy & Security (AI search switch). When it is sent, we do not send your name, email, or other account details with it. We keep the query and the result so the feature can improve over time.

Reports, blocks, and moderation. If you report a member, a Community post, or a comment, or block a member, we store the report (who reported whom, the reason, anything you wrote, and the conversation, message, post, or comment it is about) and email it to our support team. Our moderators review every report. They may remove a Community post or comment, or stop a member from using Community, if it breaks our Terms of Use; a removed post or comment is hidden from members and kept with the reason, so the decision can be reviewed. When a member reports a conversation, our moderators can read the reported messages, meaning the message reported and a few before and after it, including any photos or files in them, to review it. We may suspend accounts that break our Terms of Use. Messages, Community posts and comments, and display names are also checked automatically on our servers against a fixed list of objectionable words; text that matches is refused and is not sent or saved. That check does not involve any other company.

Device data. If you enable notifications, a push token and platform (iOS/Android) so we can deliver them. If the app crashes, a crash report (error message, technical stack trace, app version) so we can fix it. Crash reports contain no account data and go only to our own servers.

Location. Optional, with your permission. Your device uses your location to centre the map. When you ask for events near you, the app sends your location to our servers to find them; we use it only to answer that request and do not keep it — it is never saved to your account or our database. Sharing a location in a conversation is different: only when you choose to share one, the exact place you pick is sent as a message and kept in that conversation (see Messages).

Payments. Paid event tickets are processed by Stripe. We keep the ticket and amount; your card details go directly to Stripe and never touch our servers.

What other users can see. Your display name, profile photo, and role may be shown to other Yathop users where you take part in something shared, such as an event attendee list or a direct message. Photos, files, and locations you send in a conversation are seen by the people in that conversation. Community posts and comments are seen by all signed-in members, and tapping your name there shows a member card with your profile photo, name, role, crew position, and LinkedIn link if you added one. Your email, phone number, and date of birth are never shown to other users.

How we use it

• To run Yathop: your account, Dream Fleet, feed, search, tickets, and messages.
• To personalise what you see, based on your interests and activity in the app.
• To send you the notifications you turned on, and account emails such as verification and password reset.
• To keep Yathop secure, prevent abuse, review member reports, and fix problems.
• To answer your support requests.
• To comply with the law and enforce our Terms of Use.

What we don't do

Who we share data with

Service providers that process data on our behalf, under contract, only to provide their service to us:

• Stripe — payment processing for event tickets.
• Apple, Google, and LinkedIn — sign-in, where you choose that option.
• Apple, Google, and Expo — push-notification delivery, where you turn notifications on.
• Resend — delivery of account emails.
• Anthropic — interprets Ask AI search queries and Qualify Me descriptions, only if you allow it in the app.
• DigitalOcean — hosting of our servers and database, including the encrypted photos and files sent in messages and the photos posted in Community.
• Google Cloud Vision — the automatic check of photos sent in messages, posted in Community, and uploaded as profile photos, for nudity and violence.
• Google — Google Tag Manager and Google Analytics, which measure visits to yathop.com. Analytics cookies are set only if you accept them.
• Mapbox in the iOS and Android app (or Apple Maps / Google Maps if we switch the app back to them), and CARTO on the web — map tiles fetched by your device. They receive your IP address and the map area being loaded; we turn off Mapbox's optional usage telemetry in the app. Their platform policies apply to that map request.

Within YATCO. Yathop is run by YATCO, LLC. Yacht listing and boat-show content shown in the app comes to us from YATCO's listing platform (YATCO BOSS) and from industry sources; your personal data is not sent back to them, except a broker enquiry you choose to send (see "When you ask us to").

When you ask us to. If you choose to contact a listing broker through Yathop, the name, email address, phone number and message you confirm in that form go to the listing's broker through YATCO BOSS, the brokerage CRM, and to nobody else. Nothing is sent until you tap Send, and we keep a record of what you sent and when. This happens only when you initiate the contact and choose to share.

For legal reasons. We may disclose data to comply with law or valid legal process, to protect the rights, property, or safety of YATCO, our users, or the public, or to enforce our Terms of Use.

Business transfers. If YATCO or Yathop is involved in a merger, acquisition, or sale of assets, your data may transfer as part of that transaction. We will tell you before your data becomes subject to a different privacy policy.

The yathop.com website and cookies

yathop.com is a small set of static pages. We use Google Analytics, loaded through Google Tag Manager, to understand how visitors find and use the site: pages viewed, the page that referred you, device and browser type, and approximate location derived from your IP address. We use it only to measure and improve yathop.com, never for advertising.

Analytics cookies (_ga and _ga_…, which last up to two years) are set only if you click Accept on the cookie banner. If you click Decline or ignore the banner, no analytics cookies are set, and Google receives only cookieless signals (such as the page viewed and browser type) that are not tied to an identifier stored on your device. Your choice is remembered in your browser's local storage, and you can change it at any time with Cookie settings, also at the bottom of every page.

Our web server keeps standard access logs (IP address, browser type, page requested, time) for a short period for security and troubleshooting. Yacht pages at yathop.com/v/…, reached from printed QR codes, fetch the listing details from our own servers and need no account.

The Yathop app does not use cookies or third-party advertising or analytics software.

Where your data is stored

Our servers and database are hosted in the United States. If you use Yathop from outside the US, your data is transferred to and processed in the US, where privacy laws may differ from those of your country. See the notice for EU and UK residents below for how we handle that transfer.

Security

Data travels between the app and our servers over encrypted (TLS) connections. Passwords are stored only as salted hashes, direct messages (including photos and files) are encrypted at rest, and access to production systems is limited to the people who need it. No method of transmission or storage is completely secure, so we cannot promise absolute security. If you suspect your account has been misused, email support@yathop.com straight away.

Your choices and rights

• Export your data — in the app: Account → Privacy & Security → Request Data Export.
• Correct your data — in the app: Account → Edit Profile.
• Delete your account — in the app: Account → Privacy & Security → Delete Account, or follow yathop.com/delete-account. This immediately and permanently erases your account and everything it owns, and where you signed in with Apple we also revoke that sign-in with Apple. Stripe retains payment records as required for financial compliance.
• Notifications and location — both are optional and controlled in the app and your device settings.
• AI search — sending your search text to Anthropic is your choice: allow or decline when the app asks, and change it any time in Account → Privacy & Security.
• Website analytics cookies — accept or decline on the yathop.com cookie banner, and change your choice any time with Cookie settings at the bottom of every page.
• Report or block a member — from the conversation in the app. You can also email support@yathop.com.
• You can also email support@yathop.com for any privacy request. We may ask you to confirm the request from the email address on your account.

Retention

We keep your data while your account exists. Deleting your account erases it immediately from our production systems; routine encrypted backups expire on a rolling schedule shortly after. Web-server access logs are kept for a short period and then deleted. Google Analytics keeps website analytics data for at most 14 months. Payment records held by Stripe are retained for as long as financial regulations require.

Children

Yathop is not directed at children under 13, and we don't knowingly collect their data. If you believe a child under 13 has created an account, email us and we will delete it.

Notice to EU and UK residents (GDPR)

For the purposes of the General Data Protection Regulation (GDPR) and the UK GDPR, the controller of your personal data is YATCO, LLC at the address above. You can reach our data protection contact at DPO@yatco.com.

Legal bases

• Performance of a contract — creating and running your account, delivering tickets, messages, and the features you use.
• Consent — location access, push notifications, sending your search text to our AI provider, optional profile details, and analytics cookies on yathop.com. You can withdraw consent at any time in the app, your device settings, or Cookie settings on yathop.com.
• Legitimate interests — keeping Yathop secure, preventing abuse (including the automatic photo check), fixing crashes, and personalising your feed based on your activity in the app, balanced against your rights.
• Legal obligation — keeping payment records and responding to lawful requests.

Your rights

You have the right to access, rectify, or erase your personal data; to restrict or object to our processing; to receive your data in a portable format; to withdraw consent; and to lodge a complaint with your local supervisory authority. Export and deletion are available directly in the app; for anything else, email DPO@yatco.com or support@yathop.com. We respond within one month.

Transfers to the United States

We process your data in the United States, which the European Commission and the UK have not found to provide an adequate level of data protection by law. We rely on the derogations in Article 49 GDPR: the transfer is necessary to perform the contract you have with us (your Yathop account) and, for optional features such as notifications and location, on your explicit consent to that feature. Our service providers are bound by contract to protect your data.

Notice to California residents (CCPA/CPRA)

This section applies to California residents and supplements the rest of this policy. In the last 12 months we have collected the following categories of personal information, as defined in the California Consumer Privacy Act:

Sources: you, your device, the sign-in provider you choose, and Stripe (payment confirmation). Purposes: the business purposes listed under "How we use it". Disclosures for a business purpose: to the service providers listed under "Who we share data with".

No sale or sharing. We do not sell personal information and do not share it for cross-context behavioural advertising, and have not done so in the last 12 months. We do not knowingly sell or share the personal information of anyone under 16. Because we do not sell or share, there is no opt-out to offer; we treat Global Privacy Control signals as a request not to sell or share, which we already honour.

Your rights. You have the right to know what personal information we collect, use, and disclose; to access it; to correct it; to delete it; to receive it in a portable format; to limit the use of sensitive personal information (we use it only to run the service); and not to be discriminated against for exercising these rights.

How to exercise them. Use the export, edit, and delete tools in the app, or email support@yathop.com or info@yatco.com. We will verify the request by matching it to the email address on your account and may ask for more detail. An authorised agent may submit a request with your written permission; we may still ask you to confirm it. We respond within 45 days and will tell you if we need up to 45 more. We do not charge for requests unless they are excessive or repetitive.

Changes

If this policy changes materially we will update this page and the date above, and tell you in the app or by email where the change affects you. Continued use of Yathop after the change takes effect means the updated policy applies.

Previous versions: October 13, 2026 · October 6, 2026

Contact