Skip to content

Privacy Policy

Effective 2026-04-20

This Privacy Policy explains how Chasing Pelagics LLC ("Catalysst", "we", "us") collects, uses, and protects information when you use Catalysst (catalysst.net, app.catalysst.net, socal.catalysst.net, and related products — the "Service").

1. Information We Collect

Account information

  • Email address (required for account creation, billing, and support)
  • Name (optional, as provided by you)
  • Password, stored only as a one-way bcrypt hash — never in plaintext
  • Subscription tier and status

Payment information

  • We do not store full credit card numbers. Payments are processed by Stripe, Inc., a PCI-DSS Level 1 certified processor. We receive and store a Stripe customer ID, subscription ID, last-four digits of the card, and billing history metadata.

Usage & technical data

  • IP address, user agent, and timestamp of requests (for security, rate limiting, and audit logs)
  • Authentication events (login, logout, password reset, account deletion) recorded in an audit_events table for one (1) year
  • Feature usage events via PostHog (e.g., layer toggles, playback, filter selection) — no content of messages or private data is captured
  • Client-side error reports via Sentry, with cookies and tokens scrubbed before transmission
  • Cloudflare edge logs (for security / DDoS protection)

Data from public or licensed sources

  • Vessel AIS positions ingested from public and licensed third-party broadcasts. This is not personal data about you; it is broadcast information about vessels.
  • Aircraft ADS-B positions ingested from public and licensed third-party broadcasts.
  • Oceanographic and weather products from public and licensed third-party providers.

2. How We Use Information

  • Operate, maintain, secure, and improve the Service
  • Authenticate users and authorise access to subscription content
  • Process payments and manage billing through Stripe
  • Detect and prevent fraud, abuse, scraping, and security incidents
  • Send transactional email (sign-up, password reset, billing notices, service announcements, support replies) via Resend
  • Respond to your support inquiries
  • Comply with legal obligations (subpoenas, tax records, financial reporting)

We do not sell personal information. We do not use your information to serve advertising on other websites. We do not share your email address with third parties for marketing.

3. Third-Party Processors

We use carefully selected third parties to operate the Service. Each processor receives only the information necessary for their function and is bound by a Data Processing Agreement where required.

  • Stripe — payment processing, billing portal, fraud detection
  • Supabase — authentication backend and database for the marketing site and related apps
  • Cloudflare — DNS, CDN, DDoS protection, WAF, bot mitigation
  • DigitalOcean — hosting infrastructure
  • Resend — transactional email delivery
  • PostHog — product analytics (event-level, with "identified_only" profiles limited to logged-in users)
  • Sentry — client-side error monitoring (cookies / auth tokens scrubbed before transmission)

4. Data Retention

  • Active accounts: retained while your subscription is active and for billing and tax-compliance purposes after cancellation
  • Deleted accounts: personal data is deleted within 30 days of account deletion, except where required to be retained for legal, tax, fraud-prevention, or accounting purposes
  • Audit logs: 1 year
  • Product analytics (PostHog): per PostHog retention defaults (currently up to 7 years for event data), using identified profiles only for logged-in users
  • Error reports (Sentry): per Sentry retention defaults, scrubbed of credentials
  • Backups: encrypted snapshots of the Service retained for up to 30 days for disaster recovery

5. Your Rights

Depending on your location, you may have the following rights under applicable law (GDPR, CCPA, and similar regimes):

  • Access — request a copy of your personal information
  • Correction — update or correct inaccurate data
  • Deletion — erase your account and personal data (you can do this yourself via Account → Delete my account, or by request)
  • Portability — receive your data in a machine-readable format
  • Restriction / Objection — limit or object to certain processing
  • Withdraw consent — where processing is based on consent
  • Opt out of analytics — respect your browser's Do-Not-Track signal; additionally you may opt out of PostHog capture by toggling the equivalent browser setting or contacting us

Submit requests through our contact form. We will respond within 30 days.

6. Cookies & Local Storage

We use a small number of first-party cookies and browser local-storage entries:

  • Authentication cookies (pi_token, sb-*) — strictly necessary, set when you sign in, Secure + SameSite=Lax
  • Analytics — anonymous first-party identifiers for PostHog; never cross-site
  • Functional — map preferences, last-viewed layers, region state

We do not use third-party advertising trackers or cross-site fingerprinting. You can block or delete cookies in your browser settings; doing so may prevent you from using the Service.

7. Security

We apply industry-standard technical and organisational safeguards including: HTTPS/TLS for all traffic; Cloudflare edge protections (WAF, rate limits, bot mitigation); origin-bypass protection so only Cloudflare can reach our origin servers; bcrypt password hashing (12 rounds); per-user and per-IP API rate limits; encrypted at-rest storage of subscription and audit data; restricted SSH access to production infrastructure; signed JWT session tokens with short expiry. No system is perfectly secure; you use the Service at your own risk. If you discover a vulnerability, please report it through our contact form (mark the subject "Security disclosure") before disclosing it publicly.

8. Children

The Service is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If we learn we have collected such information, we will delete it promptly.

9. International Transfers

We and our processors are located primarily in the United States. If you access the Service from outside the United States, your data may be transferred to, stored in, and processed in the United States and other countries. By using the Service, you consent to that transfer.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be notified by email or by in-app notice. The "Effective" date at the top reflects the current version.

Contact

Chasing Pelagics LLC · Orange County, California, USA
All inquiries — privacy, support, security, legal — go through our contact form.