Privacy Policy

Last updated: 25 October 2026

This Privacy Policy explains how GEOSTRAT (“GEOSTRAT”, “we”, “us”) collects, uses and protects information when you use our website, blog and the GEOSTRAT monitoring console (together, the “Service”), available at geostrat.cc. We are based in Italy and aim to handle personal data in line with the EU General Data Protection Regulation (GDPR).

1. Information we collect

Account information — when you create an operator account you provide a username (callsign), an email address, and a passphrase. At sign-up you can also tell us what you mainly use GEOSTRAT for; this is optional, and we use the answer only to understand who our members are. Passphrases are never stored in plain text; they are salted and hashed.
Authentication & usage data — a secure session cookie keeps you signed in. We keep limited technical logs (such as IP address, timestamps and request paths) to operate the Service, prevent abuse and apply rate limits.
Followed places, stories, price alerts and phone alerts — if you follow countries, straits or searches in the console, we store that list with your account. If you set price alerts, we store each one with your account: the instrument, the level or daily move you chose, and when it last fired. If you switch on phone alerts, we also store what is needed to reach you: for alerts from the installed app, the address and keys your browser issues for that device; for Telegram, the ID of your chat with our bot. We keep a record of the alerts sent to you, and a count of the situation reports you create each month.
Visit and referral data — if you accept them, first-party analytics cookies record how you found GEOSTRAT and count unique visitors, without storing your IP address for that purpose (see section 3).
Console usage statistics — if you accept analytics, we record how long you are active in the console and which of its panels, layers and tools you open, by name only: not what you search for, read or look at (see section 3). Separately, we keep a record of the days on which each account signed in or used the console; we need it to run the Service and it does not depend on that choice.
Communications — if you contact us or subscribe to updates, we process the information you send (for example your email address and message).

2. How we use your information

We use personal data to: provide and secure the Service; authenticate you and maintain your session; send transactional emails such as email-verification and password-reset codes; respond to enquiries; detect, prevent and investigate abuse or security incidents; and understand how visitors find the Service and how members use the console, so we can improve it (see section 3). Our legal bases are performance of a contract (providing the Service you request), our legitimate interests (security and improvement), and your consent where required. In particular, analytics cookies and console usage statistics are used only with your consent, which you can withdraw at any time (see section 3).

3. Cookies

We use a small number of first-party cookies. Essential cookies are always on because the Service cannot work without them; analytics cookies are set only if you accept them in our cookie banner. We do not use third-party advertising, social-media or cross-site tracking cookies, and we do not share cookie data with anyone. Content that other companies serve inside the console, such as the live ship map, is described in section 4.

Session cookie (essential) — keeps you signed in to the console. It is set when you sign in or create an account, and it ends when you sign out or your session expires.
gs_consent — your cookie choice (essential) — remembers whether you accepted or rejected analytics cookies, so we do not ask on every page. It is kept for 6 months, after which we ask again.
gs_attr — how you found us (analytics, only with your consent) — records the first way you arrived at GEOSTRAT: the campaign tag in the link, if any (for example utm_source), the domain of the website that referred you, and the page you landed on. It is kept for 180 days. If you create an account, this source is saved with your account so we can see which channels bring new members.
gs_vid — visitor count (analytics, only with your consent) — a random identifier that contains no personal information and lets us count unique visitors to our pages. It is kept for up to 13 months.

With these analytics cookies we record, at most once per page per browser session, the random identifier, the page visited, the traffic source and the referring domain, with a timestamp. We do not store your IP address for this purpose, we do not track you across other websites, and site editors and administrators are not counted.

Your choice: on your first visit a banner asks whether you accept the analytics cookies. They are set only if you choose Accept. If you choose Reject or close the banner, only essential cookies are used and the website works exactly the same. You can change your mind at any time with Cookie settings, which is also at the bottom of every page and in your console account panel. If you withdraw consent, the analytics cookies are deleted from your browser. If your browser sends a Do Not Track or Global Privacy Control signal, we treat it as a refusal and do not show the banner. You can also block or delete cookies for geostrat.cc in your browser settings; the session cookie is needed to stay signed in to the console.

Console usage statistics. The same choice covers usage statistics in the console. If you accept, the console reports about once a minute, while its tab is visible and you are active, how many seconds you were active and the names of the panels, layers and tools that were open. This sets no extra cookie and stores nothing in your browser. Only GEOSTRAT administrators can see these figures; we use them to improve the console and to understand how each plan is used. If you reject, or later withdraw your consent, nothing more is recorded, and you can ask us to delete what was recorded before.

Preferences such as your light/dark theme and console view are stored locally in your browser and are not sent to us.

4. Third-party data and services

The console aggregates and displays information from independent public and third-party sources (for example news wires, open-source intelligence, government and scientific feeds, and mapping data). Those sources are operated by third parties and are subject to their own terms and privacy practices. We also rely on service providers to run GEOSTRAT, including a cloud host and a transactional email provider; they process data only to provide their services to us.

Phone alerts. An alert from the installed app is delivered through the push service of your browser’s maker (Google, Mozilla, Apple or Microsoft). We encrypt it so that only your device can read it; the push service sees that a message was sent, not what it says. If you link Telegram instead, the alert is sent as a Telegram message and Telegram can see its text. Both are off until you switch them on, and you can switch them off in the console at any time.

Embedded third-party content. A few console features show content that another company serves directly to your browser:

Live ship traffic — the ship map in the Live Ship Traffic window and in the Strait Monitor is VesselFinder’s embedded map (vesselfinder.com). GEOSTRAT does not track ships itself.
Source posts, videos and live TV — when you choose to play an event’s original post or video, or open a live TV channel, it is played from X, Telegram or YouTube.
Preview images — the preview image of a news story or source post is loaded from the publisher’s website, without telling it which page you are on.

The map and the players load only when you open the window or press play; they are never loaded in the background. When one loads, your browser connects to that company directly. It receives your IP address and browser details, and it may set its own cookies or run its own analytics (VesselFinder’s map uses Google Analytics). We tell VesselFinder that the map is shown on geostrat.cc and which area to show. We do not send any of these companies your account details, and we do not receive the data they collect. Their own privacy policies apply. If you prefer not to connect to them, leave those features closed: the rest of the console works without them.

5. Sharing of information

We do not sell your personal data. We share personal data only with the service providers described above, or where we are required to do so by law, or to protect the rights, safety and security of GEOSTRAT, our users or the public.

6. Data retention

We keep account data for as long as your account is active. If you delete your account, or ask us to delete your data, we remove your personal data except where we must retain limited records to comply with legal obligations or resolve disputes.

Followed places, stories and price alerts are kept until you remove them or delete your account. A device’s push details are deleted when you turn alerts off on it or when the browser withdraws them; a Telegram link is deleted when you unlink it or send /stop to the bot. The record of alerts sent to you is deleted after 30 days.

Anonymous visit records (the random visitor identifier, page, traffic source and referring domain) are deleted automatically after 400 days.

Console usage statistics are kept with your account for 13 months; after that only monthly totals remain, and they no longer relate to you. The record of the days your account was active is deleted after 400 days. Both are deleted when you delete your account.

7. Your rights

Subject to applicable law, you may request access to, correction of, or deletion of your personal data, object to or restrict certain processing, and request a copy of the data you provided. You can exercise these rights, or ask any privacy question, via our Contact page. You also have the right to lodge a complaint with your local data-protection authority.

8. Security

We protect the Service with HTTPS encryption in transit, salted-and-hashed passphrases, session-based authentication and rate limiting. No method of transmission or storage is completely secure, but we work to protect your information using reasonable technical and organisational measures.

9. Children

The Service is not directed to children and is intended for users aged 16 and over. We do not knowingly collect personal data from children.

10. Changes to this policy

We may update this Privacy Policy from time to time. The “Last updated” date above reflects the latest revision. Material changes will be posted on this page.

11. Contact

For any privacy request or question, please reach us through our Contact page.