Privacy policy

Updated November 8, 2026.

In short: a solo voyage stays on your device. An online voyage sends the ship’s server what other guests need to see (your chosen name, look, movement and chat) and needs an account, which keeps your sign-in methods and, for some, your email address. The server keeps reports and moderation records to keep the ship safe. Crash reports and nine fixed usage events go to Google’s Firebase, never with your name, chat or account. There are no ads and no tracking.

Solo voyages, on your device

Merrimar stores what it needs on your device: your voyage in progress (name, role, ship, time aboard, where you are, your progress and stamps, your cabin), the look you made, what the ship’s characters remember of your conversations, and your settings. A solo voyage never contacts our servers and needs no account. The app also keeps a random installation identifier and, if you sign in, your sign-in session in your device’s keychain.

People who talk back

Where your device supports Apple Intelligence and it’s turned on, the ship’s characters answer you using Apple’s on-device Foundation Models. What you say to them, typed or chosen, is processed on the device and is not sent to any AI server or to us. Otherwise they use the game’s written lines.

Face from a photo

If you choose Face from a photo, Merrimar asks for the camera, or lets you pick one photo. The picture is read once on your device to set your character’s face shape and skin tone, then let go: it is never saved, sent anywhere or shown in the game. The resulting face is part of your look, which goes online like the rest of it (below). Merrimar does not use the microphone or your photo library beyond the one photo you pick.

Online voyages

Online play is optional: you turn on Join an online shard in the main menu. On an online voyage the app sends the ship’s server, and through it the other guests aboard:

• the name you choose for your character, your role, and your look (body, face, skin tone, hair and clothes);
• where you are and where you walk aboard, and what you do there: seats, doors, knocks, invitations, orders, jobs and events;
• what you write in Ship Chat. Chat is checked by a word filter on your device and again on the server; lines it won’t pass are not delivered;
• who you block or mute, and any report you file;
• a sign-in token for your account and the app’s random installation identifier. The server uses the account; it ignores the installation identifier unless it runs in a development mode without accounts.

Other guests aboard see your name, look, movement and chat. Your progress on a shared voyage is kept by the ship. If the server restarts during a voyage, it keeps your place aboard (name, role, look, position, cabin and progress) so you can rejoin; that copy lasts until that voyage ends. Your solo voyages are never uploaded.

This describes the servers we run for Merrimar. The app can also be pointed at a server address you type in; a server someone else runs handles what you send it under its operator’s terms, not this policy.

Your account

Online voyages need a Merrimar account. Sign in with Apple, Google, a passkey or a six-digit code sent to your email. Your account keeps:

• a random account number;
• each sign-in method you link: the identifier Apple or Google gives for you, a passkey’s public key and identifier, or your email address;
• the email address Apple or Google verified, if they gave one (Merrimar asks Apple and Google for your email only, never your name; with Sign in with Apple it may be a private relay address);
• your sign-in sessions, kept only as scrambled (hashed) tokens. A session ends when you sign out, or 60 days after it was last used.

Signing in with Apple or Google happens on Apple’s or Google’s own sign-in page, under their privacy policies; we receive only the signed confirmation of who you are. Passkeys are kept by your device’s password manager; we keep only the public half. Email codes are sent through our email provider, which receives your address and the code to deliver them. A code is kept only as a hash, in the server’s memory, for ten minutes.

To slow down abuse, the sign-in service counts requests per network (IP) address. Those counters live only in the server’s memory; addresses are not written to disk or to logs.

Keeping the ship safe

The ship keeps a short record so that reports can be checked: recent chat, with who said it, when and where aboard, and the last ten minutes of where each guest walked. These live in the server’s memory and roll over as new ones arrive.

When someone files a report, it carries the ship’s own record: the last half hour of chat from the two guests, the recent movements of everyone nearby, and knocks, invitations and blocks between them, along with both guests’ names and account numbers, the kind of report and any note the reporter wrote. Moderators can read the ship’s live chat and see who is aboard and where.

A report’s chat and movements are deleted 30 days after it was filed. The report itself (the case, the names and account numbers, the kind of report, the reporter’s note and the knocks, invitations and blocks) is kept, as is the moderators’ log of every action they take, as the record of what was done and why. A ban stops applying when it ends; its record stays with the moderators’ records.

Deleting your account

Delete your account in the app: Settings, Boarding documents, Delete account…. The page says what goes and what stays before anything happens.

• Deleted at once: your account, every sign-in method linked to it (including your email address and passkeys’ public keys) and every session. Every device signed in to it is signed out and taken off any online voyage. If you signed in with Apple and our server is set up for it, we also ask Apple to revoke Merrimar’s access.
• Kept: if a ban is in force when you delete your account, the ban is kept against a scrambled (hashed) form of each sign-in method and your old account number, so the same Apple account, Google account, email address or passkey can’t open a new account until the ban ends. After it ends the record stays with the moderators’ records but no longer stops anyone. We keep it because we have a legitimate interest in enforcing the ship’s rules. A hash can be matched by someone who already has the address, but it can’t be turned back into one.
• Kept: reports about conduct aboard and the moderators’ log stay with the crew, naming your old account number and in-game name, as described above; their chat lapses after 30 days. The log also notes that the account was deleted by its owner, with no email address.
• Until the voyage ends: if the server restarted during an online voyage and you didn’t rejoin it, the copy of your place aboard it saved (name, role, look, position, cabin and progress, not linked to your account) lasts until that voyage ends.

Your solo voyages and this device’s settings aren’t touched. Signing in again later makes a new, empty account.

Server logs

The ship’s server writes an operational log of events such as a guest joining, leaving or being disconnected, with a per-voyage player number, role and the spot aboard where they joined. When someone is turned away at check-in, the log has the start of their account number and the case number. The log does not record guests’ names, email addresses, chat or network addresses.

Game Center

If you’re already signed in to Game Center, Merrimar reports the passport stamps you earn as Game Center achievements, under your Game Center account and Apple’s privacy policy. Merrimar never shows a Game Center sign-in, and we receive no Game Center information.

Content updates

Merrimar may download new content, such as shows and itineraries, from Apple or from a server that hosts Merrimar’s content. These downloads send nothing about you beyond what any web request carries (your network address and the app’s and system’s versions); nothing is uploaded. Every update is checked against our signature before it’s used.

Crash reports

Merrimar uses Firebase Crashlytics to receive crash reports and limited diagnostic information needed to find and fix app failures. Reports can include a random installation identifier, app and operating system versions, device model, crash time and stack traces. Two kinds of failure are also reported by a fixed number with no message: a voyage that couldn’t connect, and a content update that failed its checks. Reports never include your name, chat, account or what you typed, and they are not used for advertising or cross-app tracking. Google states that Crashlytics retains crash traces and associated identifiers for 90 days before beginning deletion from live and backup systems. Firebase privacy information.

Advertising and analytics

On iPhone, iPad and Mac, Merrimar uses Firebase Analytics to understand how voyages are played, through nine fixed events whose only details are the game’s own categories:

• Voyage started (solo or online, and guest or crew department)
• Boarded the ship
• Attended a show, movie or fireworks
• Dined (a dining-room seating or a meal)
• Attended another event (party, excursion, muster or activity)
• Passport stamp earned (which stamp, and its tier)
• Crew job completed (the department)
• Conversation started
• Photo mode used

Firebase also measures app sessions and first opens, and derives an approximate region from a masked IP address. This does not use Location Services or show a location permission prompt. Analytics advertising storage, advertising personalization, user IDs, IDFA, IDFV, automatic screen reporting and cross-app tracking are disabled. We never send your character’s name, chat or anything you typed, what anyone said, your account or installation identifier, a server address, your cabin or your position. On Apple Vision Pro, Merrimar sends crash reports only, no analytics. The app contains no advertising and does not sell your data.

App Store privacy details

On the App Store, Merrimar lists coarse location, device ID and product interaction as collected for analytics and associated with a random app-installation identifier; email address, user ID (your account and sign-in identifiers and the in-game name you choose), device ID (the installation identifier), gameplay content (your look, movement, progress and chat online) and other user content (a report’s note) as collected for app functionality and linked to your account; and crash data and other diagnostic data as collected and not linked to you. None of it is used for tracking.

Children

Merrimar is not directed at children under 13. Online voyages include chat with other players.

Storage and your choices

Your solo voyage, look and settings stay on your device until you delete them; deleting the app removes them. Device backups may include app data until those backups are replaced. Online play, Game Center, Face from a photo and Apple Intelligence are each your choice. You can sign out, remove a linked sign-in method while another remains, or delete your account in the app. The app currently has no in-app switch for crash reports or analytics. Reports and events already sent to Firebase are kept under Google’s policies.

Support website

These public pages are served by Cloudflare. Cloudflare processes standard request information, such as IP addresses and user agents, to deliver and protect the website. See Cloudflare’s privacy policy. Our first-party website tracker counts page views and clicks on App Store or download links to improve the website. Our first-party tracker uses no cookies, browser storage, advertising identifiers or persistent visitor IDs. The collector derives a site-specific daily visitor estimate from connection information without storing raw IP addresses or user agents in analytics records. Counts are not linked across days, websites or app installations. Our first-party tracker sends only page categories and fixed click types, never query strings, link destinations, app content or free-form text. Our first-party tracker respects Global Privacy Control and Do Not Track. Website analytics details.

These pages also use Cloudflare Web Analytics. Its browser beacon measures page views, referring sites, country, browser and device categories, and page-load performance. Cloudflare receives these website measurements under its privacy policy; see Cloudflare Web Analytics. Website analytics are separate from the app analytics described above.

Policy updates

This policy describes the current app. The policy and its updated date will change if the app’s data practices change.

Support and privacy questions

For support or privacy questions, contact us at support@nshortn.com. If you email us, we receive your email address and the information you choose to include so we can respond.