Privacy Policy

This is a machine translation provided for your convenience; in case of any discrepancy, the Italian version prevails.

This policy explains what data MareCalmo processes, why and with which tools. If you use the app to check the forecasts, no account is needed. You can create an optional account to sync your data across devices; further processing concerns the businesses that sign up for the Business area and marketing and affiliate tools. Want to delete your data? Go straight to Data deletion.

Last updated: June 2026

1. Data controller

The data controller is:

Conte Tullio
VAT IT16329381004
Via Leonardo Mellano, 90 - 00125 Roma (RM)
Email: info@marecalmo.app

For any request relating to your data or to the exercise of your rights, you can write to the email address indicated above.

2. What data we process

Data that stays on your device

MareCalmo saves some preferences in your browser's localStorage, to remember your choices between one visit and the next. This data does not leave your device and is not sent to our servers:

mc.modality - the selected activity (swimming, relaxing, snorkeling, …);
mc.maxKm - the distance radius chosen in the filters;
mc.sortBy - the sorting criterion;
mc.mare - the sea selected in the filters;
mc.regione - the region selected in the filters;
mc.favs - the beaches you saved as favourites;
mc.fb - your reports on the accuracy of the forecast;
mc_last_pos - your last position (only if you enable geolocation), used to calculate the distance to the beaches.

User account (optional)

You can create a free, optional account to sync your favourites and preferences across multiple devices. The app stays fully usable even without an account.

For the account we process:

your email address, used to authenticate you through a secure link sent by email (passwordless login). We do not use your email for marketing purposes;
alternatively, sign-in with Google: in this case we receive from Google your identifier, your email and (where available) your name, for the sole purpose of creating and recognising your account. We do not post anything to your Google profile;
the data you choose to sync: favourite beaches and filter and language preferences, linked to your account.
if you turn on evening notifications (optional, for signed-in users only), we store the technical notification address generated by your browser (the push service endpoint) and its encryption keys, solely to send you the alert about your favourite beaches. It does not identify you and is not shared with third parties. You can turn it off at any time (the address is deleted) and it is removed when you delete your account.
if you choose to set a public name (optional, an invented one is fine), we show it together with your level next to the photos you publish. We never derive it from your real name, your email or your Google account: it exists only if you type it yourself. You can change or remove it at any time from the Account section, with immediate effect on all photos; if you delete your account, already published photos remain but without name or level;
for the participation features we keep a score (points and level) computed from your activity in the app: reports, approved photos, forecast feedback and sign-ins. It is only used to unlock additional features and to show your level next to your contributions; it is included in your data export and deleted with your account.

To keep you logged in we use a technical session cookie mc_user (httpOnly, strictly necessary, not used for profiling, no consent required), removed at logout or upon expiry. From the Account section of the app you can, at any time, export your data, delete the whole account, or clear only the synced data while keeping the account (see "Data deletion").

Technical session cookie (business area only)

When a business logs in to its panel, we use a technical cookie (mc_biz) to keep the session active. It is an httpOnly cookie, strictly necessary, not used for profiling and not requiring consent. It is removed at logout or upon expiry.

Geolocation

If you use the "Where should I go today?" feature, the browser may ask you for permission to access your position. The position is used only locally to sort the beaches by distance and remains stored in your browser for a limited time. You can deny or revoke this permission at any time from your browser settings.

Legal basis for processing

We process your personal data on the following legal bases (Art. 6 GDPR):

Performance of the service (Art. 6.1.b): to create and manage the optional user account and to sync your favourites and preferences across your devices; to manage the Business Space listings and sponsorships;
Consent (Art. 6.1.a): cookies and marketing and affiliate tools (Google Ads, GetYourGuide), which can be withdrawn at any time from "Cookie preferences";
Legitimate interest (Art. 6.1.f): security of the service, prevention of abuse, and usage statistics in anonymous and aggregated form;
Legal obligation (Art. 6.1.c): retention of billing and payment data required by tax law.

Minimum age

The service is not aimed at minors and does not knowingly collect their data. To create an account you must be at least 14 years old (the age of digital consent in Italy, Art. 8 GDPR and Legislative Decree 101/2018); in other countries the minimum age set locally applies. If you believe that a minor has provided us with data without the consent of the person holding parental responsibility, write to us at info@marecalmo.app and we will remove it.

3. Marketing and affiliates (Google and GetYourGuide)

To support the service - which remains free, with an optional account - we use some third-party marketing and affiliate tools. The GetYourGuide widget and the Google Ads tag are activated only after you consent (the "Marketing" category): until you consent they are not loaded and do not write any cookies. Google AdSense display ads work differently, as explained in the last item below.

GetYourGuide - a widget that shows bookable experiences/tours nearby; if you book through our links we receive a commission (affiliate). When you activate it, it may set a visitor_id cookie on its own domain; the plain text links do not load anything until you tap them. Provider: GetYourGuide Deutschland GmbH (GetYourGuide privacy policy).
Google Ads - a tag to measure the conversions of our campaigns; it may set cookies (e.g. _gcl_au); provider Google Ireland Ltd. / Google LLC.
Google AdSense - the system Google uses to select and show display ads. The library is present on the site's pages and starts with advertising signals set to denied (Google Consent Mode v2): before your choice no personalisation cookies are set. Once ad serving is active, Google and its partners may set first- and third-party cookies (for example __gads and __gpi on our domain, IDE on the doubleclick.net domain) to select ads, cap their frequency, measure performance and prevent fraud. In the European Economic Area, advertising consent is collected by Google's own panel, certified and integrated with the TCF, alongside ours for the other tools. You can opt out of personalised advertising at any time in Google's Ads Settings and, for other vendors, at aboutads.info/choices. Provider: Google Ireland Ltd. / Google LLC (how Google uses data from partner sites).

The consent panel is managed by MareCalmo: the "Marketing" tools are activated only if you consent, and "Reject" is just as easy as "Accept". Technically, Consent Mode starts in "denied" and the Google Ads library is not loaded before your consent, while the GetYourGuide widget is not displayed until you activate it. You can withdraw your consent at any time from the "Cookie preferences" link in the footer. See also our Cookie Policy.

4. Sea and weather data and external sources

The forecasts are processed from data provided by Open-Meteo (CC BY 4.0 licence) and from the cartography of OpenStreetMap. The interactive maps are served through OpenStreetMap tiles: by loading them, your IP address is technically visible to the relevant servers, as happens for any web resource.

5. Business area (business owners)

Coastal businesses (lidos, car parks, rentals, schools, restaurants…) can publish their listing free of charge and purchase, if they wish, paid sponsorships. This concerns only the business owners who choose to sign up: ordinary app users are not affected and do not create any account.

Data processed: email (for passwordless access via link and for service communications), name and category of the business, listing contents (contact details such as phone and WhatsApp, opening hours, description, photos, any offers) and, if you purchase a sponsorship, the campaign data (format, area, duration, status) and the transaction identifier provided by PayPal. We do not process or store your card or account details: the payment is handled entirely on PayPal's systems.

Tax data and ownership verification: the VAT number (and any other required tax details) is collected only if you purchase a sponsorship, to issue the invoice. To publish a listing linked to a point on the map we ask you for a document proving ownership or authorisation to manage it (e.g. company registration, VAT attribution, owner's mandate). These documents are kept in a private store, used only to assess the request and deleted within 30 days: only the record that verification took place remains.

Purposes and legal bases:

publish the free listing and manage the purchased sponsorships - performance of a contract (Art. 6.1.b GDPR);
send service emails (access, review outcomes, campaign status) - performance of the contract;
send you, if your registration remains incomplete, a reminder to complete your listing and, once the listing is online, occasional suggestions about sponsorships (for example at the start of the season) - legitimate interest (Art. 6.1.f) and, for those who have already purchased a sponsorship, Art. 130(4) of the Italian Privacy Code ("soft opt-in"). You can object at any time: every such email contains an unsubscribe link with immediate effect, which does not affect service emails;
comply with tax and accounting obligations on payments - legal obligation (Art. 6.1.c);
prevent abuse and ensure the security of the service - legitimate interest (Art. 6.1.f).

The contents you publish are publicly visible in the app. Sponsored content is always labelled as "Promoted" and does not influence the "Where should I go today?" suggestion, which is based exclusively on sea conditions.

Processors and external providers

To deliver the service we rely on providers that process data on our behalf or as independent controllers:

PayPal (PayPal (Europe) S.à r.l. et Cie, S.C.A.) - sponsorship payments. (PayPal privacy)
Resend (Resend, Inc., USA) - sending of transactional emails. (Resend privacy)
Google (Google Ireland Ltd. / Google LLC) - "Sign in with Google" authentication, only if you choose to sign in with your Google account. (Google privacy)
Openapi (openapi.com) - retrieval and verification of company data from the VAT number via the public business registers, for invoicing and ownership verification.
Hosting/infrastructure at our provider, for the technical storage of the service data.

Transfers outside the European Union

Some providers (e.g. Resend, and part of Google's/PayPal's infrastructure) may process data also in the United States. In these cases the transfer takes place on the basis of the safeguards provided for by the GDPR - Standard Contractual Clauses of the European Commission and/or membership of the EU-US Data Privacy Framework - which ensure an adequate level of protection.

6. How long we keep the data

On-device preferences (localStorage): they remain until you clear the site's data from your browser.
User account (email, favourites, preferences): for as long as you keep the account active. When you delete it, the linked data is removed. Expired sessions and login links are deleted automatically.
Business account and contents: for as long as the account stays active. The listing has no expiry; if you delete the account, the contents (text, photos, offers) are removed. If the account remains unused for a long time (no panel access for 24 months) we notify you by email and, if there is no response, we may remove the listing. The data of sponsored campaigns stays linked to the account for their management.
Billing and payment data: kept for 10 years as required by Italian tax and accounting regulations.
Ownership verification documents: kept for at most 30 days, then automatically deleted; we retain only the outcome of the verification.
Technical and security logs: for the time necessary to ensure the security of the service, then deleted or anonymised.

7. Data deletion and your rights

MareCalmo (operated by Conte Tullio, see "Data controller") lets you delete your data at any time, in full or in part, directly from the app and without having to delete your account if you don't want to.

How to delete your data

If you use the app without an account (browsing only): you have no data attributable to you on our servers. To remove the preferences saved on your device, clear the site's data from your browser or uninstall the app.

Full account deletion (right to be forgotten): open MareCalmo, tap Account, then "Delete account" and confirm. The account, the email address and all linked data are removed immediately and permanently, on all devices.

Partial deletion (keep the account): open MareCalmo, tap Account, then "Clear my data" and confirm. This removes favourite beaches and preferences; your account and email stay active, so you can keep using the app with a clean slate.

Alternatively, by email: you can ask us to delete your data, in full or in part, by writing to info@marecalmo.app; state whether you want to delete the whole account or only specific data (for example your favourites). We act on it without undue delay.

What we delete and what we keep

Deleted immediately when you delete the account: email address, any name and the Sign-in-with-Google identifier, favourite beaches, filter and language preferences and all login sessions. With partial deletion we remove the same data except for account/email and the active session, which remain to keep you logged in.

Kept due to a legal obligation even after your request (this concerns only the Business area businesses, not app users):

billing and payment data: 10 years, as required by Italian tax and accounting law;
ownership verification documents: at most 30 days, then automatically deleted (only the outcome of the verification remains).

Anonymous, aggregated usage statistics are not attributable to you and are kept as non-personal data. For the data processed by Google for advertising purposes, see Google's Privacy Policy.

You can also export all your data in JSON format from the Account section of the app. In any case, if you are a registered person (user account or business), under Articles 15-22 of the GDPR you have the right to:

access your data and obtain a copy of it;
rectification of inaccurate or incomplete data;
erasure ("right to be forgotten"), within the limits of legal obligations;
restriction of and objection to the processing;
portability of the data provided, in a structured format.

To exercise them, write to info@marecalmo.app: we will reply without undue delay. You also have the right to lodge a complaint with the Italian Data Protection Authority (garanteprivacy.it) if you believe that the processing infringes the regulations.

8. Changes to this policy

We may update this page to reflect changes in the service or in third-party tools. The date at the top indicates the last revision.