Privacy
Last updated: 2026-09-15
In one sentence: we never see your Garmin password, your SSI password can be left unsaved, and your dive log is given to no third party. Below is what is actually stored, item by item — these are not promises, they are what the code does today.
What we store
| Data | Why | How |
|---|---|---|
| Your email | The account you sign in with | Plain text (it is the account itself) |
| Your sign-in password | To verify who you are | Hashed, not reversible |
| Display name | What we call you on screen | Plain text; change or clear it any time |
| Garmin authorisation token | To read your dives | Stored encrypted |
| SSI password | To write to the MySSI logbook | Can be left unsaved; encrypted if saved |
| Dive log snapshot | The pre-write backup that makes a restore possible | Deleted automatically after a retention period |
| Sync history | So you can see what each run wrote | Kept with your account |
What we do not store
- Your Garmin password. Garmin sign-in happens on Garmin's own page; the password never passes through us and we receive only an authorisation token.
- The SSI password is optional. Leave "save password" unchecked and it lives only in memory for that session — the cost is retyping it on every sync.
- No ad pixels, and nothing that follows you across other sites. The one third-party analytics tool is Google Analytics, for overall traffic only (see "Who can see your data" below); it cannot see your dive log.
Who can see your data
Only you. We do not sell, share or hand your dive log to any third party. Data leaves the server in exactly three situations, all of them requested by you:
- You press sync, and we write the dives you confirmed into your own SSI account.
- You press export, and the file downloads to your device.
- Your browser fetches your own data in order to display it.
Web fonts are served by Google Fonts, so your browser contacts Google's servers when loading them.
Map tiles come from our own server (map.ssi-sync.app), rendered from OpenStreetMap data. This matters: with Google Maps or Mapbox, browsing the map would hand that company the coordinates of everywhere you have dived. Running our own server avoids that entirely. If the tile server is unreachable the map falls back to a built-in coastline outline, which needs no connection at all.
We use Google Analytics to see traffic: which pages get read, where visitors arrive from, what devices they use. It records browsing behaviour and not your dive logs — your sites, dates, depths and coordinates are never sent to it, because that data is fetched from our own API after you sign in and never passes through the analytics tool. Google Analytics sets a cookie to recognise returning visitors. You can block it with your browser's private mode, a tracker-blocking extension, or Google's own opt-out add-on; blocking it breaks nothing on this site.
Apart from the web fonts, our own map tiles and that analytics tool, this site loads no third-party resources.
When writing to your SSI logbook
- A full backup is always taken first; if the backup does not succeed, the write never starts.
- Every dive is laid out field by field for you to confirm before it is written.
- You choose the dive site; we do not guess for you.
- Dives verified by a dive centre or instructor are never overwritten and never deleted.
- Each write is read back and verified immediately; a mismatch stops the remaining writes.
Taking your data out, or deleting it
- Take it out: export CSV or UDDF from settings at any time. UDDF is the interchange format used across diving software and imports into Subsurface and others.
- Unlink one service: "Unlink" on the overview page deletes the stored credentials for it.
- Delete the whole account: at the bottom of settings. This removes stored credentials, backups and sync history together. Your SSI logbook is unaffected — that is your SSI account, not our data. The action cannot be undone.
Security measures
- Third-party credentials are stored with envelope encryption; the master key is not in the source code.
- Sessions use a signed cookie (HttpOnly, SameSite); changing your password invalidates sign-ins on other devices.
- Error messages never surface internal detail on screen, and server logs redact credentials.
To be honest about it: no service can guarantee absolute security. If you are uneasy about storing your SSI password, leave it unsaved — that is exactly why the option exists.
About Garmin and SSI
SSI Sync is an independent personal tool. It is not an official Garmin or SSI product and there is no partnership with either. Garmin and SSI are trademarks of their respective owners and are used here only to describe what this service connects to.
Changes
If this page changes in substance, the date at the top is updated.
Contact
Questions about this page, or need help with your data: [email protected]