Privacy policy

Message in a Bottle (bakbukim) · Last updated 8 September 2026 · Contact: sklarski@me.com

This policy describes what the app and its server actually collect and do today. It covers only features that exist and are switched on. When a feature ships that changes any of this, this page changes with it, and where a change would ask more of you — such as sharing your location while the app is closed — you will be asked to opt in first.

What the app is

You write a short message and launch it from a point at sea. It drifts on real ocean-current data and may reach another coast days or weeks later, where someone else can find it, keep it, discard it, or add to it and send it on. There is no chat, no reply, and no way to contact another user. Every message is reviewed by a person before anyone can find it.

Who runs it

The app and its server are operated by Tsafrir Sklarski. For anything in this policy, write to sklarski@me.com. The server is hosted by Hetzner Online GmbH in Germany.

What we collect, and why

Data	Why
Sign in with Apple: Apple's stable identifier for your account with this app, and your email address if Apple shares it (which may be a private relay address). Apple also gives the app a token that we keep only so that we can revoke it when you delete your account.	To know it is you across reinstalls, so quotas and blocks cannot be evaded by reinstalling. We never see your Apple ID password.
Session: a hashed session token, its expiry, when it was last used, and a short device label.	To keep you signed in.
Age confirmation: that you confirmed you are 18 or older, and when.	The app is for adults.
Device check (Apple App Attest): a key identifier, its public key, Apple's attestation receipt, and a counter.	To verify that a launch, an open or a keep comes from a genuine copy of the app on a real device, at the location it claims. This is not an advertising identifier and is not used to track you across apps.
Launch position: the sea coordinates you launch a bottle from, and the time.	It is where the bottle starts. It is never shown to anyone who finds the bottle; finders see the bottle's current position and how far it has drifted, and its route only from a point well away from the start.
Your first look, and the days after it: the first time you search, we place one of our own bottles at the stretch of coast nearest to where you searched. On about one day in ten after that, we place another at the same coast, dated to the day it arrived. We keep a record of each placement.	So there is something to find on your first day, and sometimes afterwards. Each record links your account to that coast, at the same coarseness as a search, and to a date; it is kept so you are not seeded twice for the same day, and the link is removed if you delete your account (the bottles themselves stay at sea).
If you wrote a message for our own bottles: your name and how to reach you, kept with the message you wrote, in a record only the operator can see. Each bottle we place with your words records which message it carries.	Our own bottles carry real messages written by real people to a stranger. You have no account with us, so this record is how we honour a request to take your words back: we stop placing them, delete any bottle nobody has found, and erase the words from any bottle someone has found, kept or added to — keeping the bottle's place and dates, as for any sender. Then the record itself goes: your words, your name and how to reach you are deleted, and we keep only the date your request was honoured. Until then it is never shown to anyone and is used for nothing else.
Finding position: the coordinates you search from, and the coordinates at which you open, keep or discard a bottle, with the time.	Discovery only shows bottles within 5 km of where you are, and opening a bottle records where it was found.
A bottle in your hand: while a bottle you have opened waits for what you do with it — until the next daily tick — we record that you are the one holding it.	So it stays on your water wherever you are until the tide takes it back, and only you can read it meanwhile. The record is cleared when you keep, discard or send the bottle on, or when the tick returns it to the sea, and removed if you delete your account.
Your messages and additions: the text you write (messages are text only at present), and the decisions a reviewer makes about it: approved or not, an age rating, a reason — and, if it is reported after approval, whether it was withdrawn from circulation or withdrawn and erased.	That is the product. Every message is reviewed by a person before it can be found, and can be withdrawn afterwards in response to a report. You see the reviewer's reason in the app.
Your actions on bottles: which bottles you opened, kept, discarded or sent on; which senders you blocked; and which bottles you reported, with the reason you gave.	To run the bottle's lifecycle; so that a blocked sender's bottles are never shown to you again; and so that a person can review what you reported. A report is not a block: neither implies the other.
Web server logs: the IP address and request line of connections to the server.	Operating the service. These logs rotate automatically and are kept only briefly.

What we do not collect

We do not currently collect your location in the background. The app reads your location only when you are on a screen that needs it, and sends it only with a launch, a search, or an action on a bottle. If that changes — for example to tell you a bottle is drifting near you — you will be asked to opt in first, and this policy will be updated to say exactly what is stored.
No advertising identifiers, no analytics or tracking services, no third-party SDKs that receive your data.
No contacts, photos, microphone or camera. Messages are text only at present.
Nothing about you is sold, and nothing is shared for marketing. There is nothing to buy in the app at present.

Who else sees what

A finder sees your message, the date it was launched, the bottle's current position, and how far and how long it drifted. Never your name, email, identifier, or where you launched it from.
You, as the sender, see whether your bottle is still drifting or has been found, and roughly where it is (a coarse region of a few hundred kilometres). Never who found it.
The public map on this site shows only broad areas — cells about 300 km across — where bottles are at sea, each with a coarse weight. No positions, no counts per area, no text, no people.
The reviewer (the operator) reads every message in order to approve it.
Service providers: Apple (sign-in and device attestation), Hetzner (hosting, Germany), Let's Encrypt (the site certificate). The ocean-current data comes from the E.U. Copernicus Marine Service, which receives nothing about you.

Notifications

The server records that your bottle was opened, or that someone added to it. These are records you find when you open the app. Nothing is pushed to your device, and no push token or device identifier for notifications is held.

How long we keep things

Your account, messages and actions: until you delete your account.
Sessions: until you sign out, they expire, or you delete your account.
A bottle's drift record: as long as anyone still has a stake in that bottle (see deletion below).
Web server logs: rotated automatically, kept briefly.
Backups: the database is backed up nightly and each backup is kept for 14 days. Deleted data can therefore remain in a backup for up to 14 days before it is gone everywhere.
A record that an account was deleted, and whether Apple confirmed the revocation, is kept without any link to who you were.

Deleting your account

You can delete your account in the app, under About → Delete my account, or by writing to sklarski@me.com. Deleting removes your sign-in, your device enrolment, and your identity from everything you did. The rule for what happens to a bottle is whether another person has a stake in it:

A bottle nobody else has found or added to is deleted entirely, including its drift record.
A bottle someone has found, kept, or added to stays for them: your message text is erased and your identity is detached from it. What they see afterwards is a bottle whose original message is gone and whose later additions remain.
The same rule applies the other way. If you added to someone's bottle and then delete your account, your words are erased but the entry keeps its place and date. If you found a bottle, the fact that it was found remains, without you.

Deletion also asks Apple to revoke the sign-in token it issued for this app.

Your rights

You can ask what we hold about you, ask for it to be corrected or deleted, or object to how it is used, by writing to sklarski@me.com. If you are in the EU or UK you also have the right to complain to your data-protection authority. The server is in Germany.

Children

The app currently requires you to confirm that you are 18 or older. It is not directed at children, and we do not knowingly collect data from anyone under 18.

Changes

This page is updated when the app changes. The date at the top is the date of the current version.