Last updated: September 2026 · WoodenShoeBoater.com
1. Who We Are
WoodenShoeBoater.com is a public information site for Dutch and French inland waterway closures and navigation alerts. Privacy contact:privacy@woodenshoeboater.com
The site is operated by Wicked Code, Inc., 1037 NE 65th Street #81960, Seattle, WA 98115, United States, which is the data controller. A Dutch company, Wicked Code B.V., is being set up (expected January 2027) and will take over as operator and data controller; this policy will be updated when that happens.
2. Data We Collect and Why
Email address — only if you subscribe to change alerts. Used solely to send those alerts. Legal basis: explicit consent (GDPR Art. 6(1)(a)).
Server logs / IP address — retained 14 days for security. Legal basis: legitimate interests (GDPR Art. 6(1)(f)).
Analytics — only if you accept cookies. Google Analytics 4 tracks aggregate page usage. Legal basis: consent (GDPR Art. 6(1)(a)).
Digest position — only if you save one in the app (with “Use my location” or by tapping the map), so the morning email can start with the changes near you. We store the spot rounded to about 1 km, the distance you chose and whether you want nearby changes first or only nearby changes. Remove it any time with Clear on the map; it is also deleted with your account. Legal basis: consent (GDPR Art. 6(1)(a)).
reCAPTCHA data — Google reCAPTCHA v3 is loaded when you start using a form (signup, login, password reset, contact, account changes) and analyses browser behaviour to protect those forms against spam and abuse. Legal basis: legitimate interests (GDPR Art. 6(1)(f)).Google Privacy Policy
3. Email Subscriptions
Double opt-in: you must click a confirmation link before any emails are sent.
Your email is stored on our EU server (Amsterdam, Netherlands — Vultr).
Delivered via smtp2go (EU-compliant). No marketing, no third-party sharing, ever.
Unsubscribe anytime via the one-click link in every email we send.
We use a cookie banner that requires your explicit opt-in before any non-essential cookies are placed. Accept and Reject are equally prominent. You can withdraw consent at any time by clearing your browser local storage. ()
wsb_cookie_consent — stores your Accept/Reject choice in localStorage. No expiry; cleared when you clear browser data. Strictly necessary for our consent system.
_ga, _ga_* — Google Analytics 4 session identifiers. Set only after you accept cookies. 2-year expiry.
wsb_lang — stores your preferred display language. Strictly functional; no expiry; never shared.
wsb_notif_chip, wsb_notif_view, wsb_fav_view, wsb_wl_river, wsb_country — store your filter, view and country preferences in your browser (localStorage / sessionStorage). Strictly functional; no expiry; never sent to us.
wsb_user_session — HttpOnly cookie that keeps account holders logged in. Expires after 30 days or when you log out.
5. Third-Party Processors
Google Analytics 4 — aggregate analytics — Privacy Policy
Stripe — payment processing. Card and billing data handled entirely by Stripe; we never store full card numbers.Privacy Policy
OpenStreetMap — map tiles. In digest emails tiles are fetched by our server; on the map pages (home, notifications, favorites) your browser loads tiles from tile.openstreetmap.org directly, so OSM sees your IP address.Privacy Policy
cdnjs (Cloudflare), jsDelivr, unpkg — deliver the Leaflet map library on the map pages. Your browser requests it directly, so the CDN sees your IP address.Cloudflare · jsDelivr
Rijkswaterstaat / vaarweginformatie.nl — waterway data (public open data; no personal data shared)
Voies navigables de France / avisbat.vnf.fr — waterway notices (public open data; no personal data involved).
EuRIS (eurisportal.eu) — European notices-to-skippers data (public open data; no personal data involved).
Vigicrues / SCHAPI — French water levels (public open data; no personal data involved).
MET Norway — weather forecasts for France (open data, CC BY 4.0; no personal data involved).
DeepL SE — machine translation. Only public notice text is sent; no personal data transmitted. DeepL operates under GDPR.Privacy Policy
As an EU/EEA resident you have the right to access, rectify, erase, restrict, port, and object to your data, and to withdraw consent at any time. We respond within 30 days. You may also complain to the Autoriteit Persoonsgegevens or your local supervisory authority. — privacy@woodenshoeboater.com · Autoriteit Persoonsgegevens
7. Retention, Security & Children
Email subscribers: until you unsubscribe or request deletion.
Server logs: 14 days. Analytics: 14-month retention.
All data over HTTPS. Server in Amsterdam, Netherlands (EU).
Not directed at children under 16. We do not knowingly collect data from minors.
8. Data Processors & DPAs
We have Data Processing Agreements in place with each of the processors listed in section 5. All processors are required to handle personal data only on our documented instructions.
9. EU Right of Withdrawal
Under EU consumer law (Directive 2011/83/EU) you ordinarily have 14 days to withdraw from a digital subscription. During checkout you confirm that you want access to begin immediately, waiving your right of withdrawal.
10. UK Customers
If you are in the United Kingdom, your data is processed under UK GDPR and the Data Protection Act 2018. The same rights apply; contact us at the privacy address above.
11. Changes
We may update this policy occasionally. The date above reflects the latest revision.