Where your data lives — and the one thing that does leave
Until you sign in, everything you enter stays on this device. Your position goes out to fetch weather, tides and charts, and to Apple to name the place you are. Here is exactly what leaves, and when.
Everything you enter — trips, observations, maintenance, crew, photos, documents, the Boat IT vault — is stored on this device first. On a device you have not signed in on, it is not uploaded anywhere and we cannot see it.
Three things can leave, and all are below: your position, to fetch weather and charts; your boat's changes, once you sign in and attach her, so your other devices and your crew see the same boat; and — only if you said yes when we asked — anonymous event names for usage and crash reports, which carry none of your records.
Your position leaves the device whether or not you sign in, and you should know where it goes. To show you weather, tides, radar and charted depth, the app has to ask somebody where those things are — so it sends your position to the services that provide them:
- NOAA — forecast, wave forecast, marine alerts, tides, chart depth (buoy readings come from NOAA too, but for those only a buoy's number is sent, not your position)
- Iowa State University — the weather radar overlay
- Apple — iOS's place-name lookup, which turns your position into the name of the town or harbor shown with your weather, tides and nearest harbors; and the Apple map under the chart, which loads the map for the area on screen
What theONE sends is a position and nothing else. No name, no account, no vessel details, nothing that says who you are. It is the same request any weather app makes, and it happens automatically when Mission Control loads, because a forecast for somewhere else is no use to you.
If that is not what you want: turn off Location for theONE in iOS Settings. Weather and tides then fall back to your homeport, or say "unavailable" — the rest of the app is unaffected.
Passage recording starts by itself when the boat is underway. With theONE open, three minutes above 2 knots with no leg running starts a cruising track; it keeps recording with the screen off, iOS shows its location indicator while it does, and it is saved after thirty minutes stopped, with theONE open or in the background. The track stays on this device; a finished track is part of the boat's record, so once you sign in and attach her it syncs with the rest of it. Your position as you go is not streamed anywhere. Settings → Display → Record tracks by itself is on unless you turn it off.
In airplane mode nothing goes out at all, and everything you have already entered still works.
Steps
-
What stays
All of it, and on a device you have not signed in on, nowhere else at all. Signing in and attaching a vessel is what starts anything leaving: after that your records go to theONE's own cloud so your other devices and your crew can see them, and they still live here first — nothing waits on a connection to be recorded. Settings → Preferences → Storage says which of the two this device is doing. The files attached to your records travel too — scans, receipts, photos on issues and work orders, and manuals up to 25 MB — so your other devices, your crew and the web version can open them (a jot or note sends only a small preview of each photo, once, on that same files lane — never the photo itself). Who receives what is decided on theONE's server, not on the phone. Bills and documents reach the owner's, captain's and manager's phones and nobody else's. The fuel log reaches those three and the crew: a crew member's phone receives each fill's gallons, tank, date and time, engine hours and marina, never its price, total, currency, payment or receipt; no vendor or guest receives the fuel log. Crew and guest cards (allergies, dietary and medical notes included) reach those three and the person the card is about, and no other crew. A vendor's phone receives the observations and work sessions that vendor wrote, and, for the systems an owner, captain or manager chooses to share with them (none until they do), each system's record and its service history without the money; nothing else. The Boat IT vault never travels.
-
What goes out
Your position, to NOAA and Iowa State, to fetch weather / tides / radar / charted depth, and to Apple, for place names and the map under the chart. Nothing identifying travels with it. Only the National Weather Service receives it rounded (four decimal places, about 11 metres); the others get it as the phone reports it.
-
If you opt in to analytics or crash reports
Both are off until you switch them on under Settings → Privacy & Lock (Crash Reporting and Analytics). When on, they go to theONE's own server first (api.theonevcc.com), which forwards them to PostHog and Sentry. The app carries no key for either service, and the server can stop forwarding without an app update. Emails, phone numbers and file paths are scrubbed before anything is sent.
-
Offline first
The app works fully without internet — Mission Control, telemetry, trips, observations, playbooks. Pull into a marina with no signal and it behaves the same.
-
Backup
Because data lives on-device, an iCloud backup of your iPhone captures it. That is your safety net today. iOS Settings → your name → iCloud → iCloud Backup.
-
Photos and documents
Attachments are stored as their own files on the phone rather than inside the app's main record. That keeps the app quick as your library grows — adding a hundred photos does not slow down ticking a checklist item. If a document's file is not on the phone — added on another device, or lost from this one — its tile reads "Tap to download" rather than showing a blank thumbnail, and a tap fetches it from the boat's copy in the cloud. If that fails (no signal, signed out, or the cloud does not have it) the tile reads "Couldn't download · Tap to try again", and a tap does.
-
Cloud sync, and how to turn it on
It is off until you ask for it. Sign in under Settings → Account and attach the device to your vessel; the captain's iPhone and the owner's iPad then show the same boat, and the outbox that has been filling since first launch drains in order, oldest first. Until you do that, this device is local and says so.
-
Why we waited
Sync done wrong corrupts data, so the offline-first foundation came first and sync sits on top of it: everything is recorded here before anything is sent, and nothing waits on a connection.