Privacy Policy

Last updated: November 3, 2026

1. Introduction

This Privacy Policy explains how JEMS Marine, LLC (“JEMS Marine,” “we,” “us,” or “our”), a Maryland limited liability company, handles information in connection with theONE Vessel Command Center (“theONE” or the “app”), an iOS application that will be distributed through Apple’s App Store (test builds go through Apple’s TestFlight today), and this website at theonevcc.com. It describes what the current build and this site actually do. Where a feature is not in the current build, we say so rather than reserving the right.

2. Accounts and Sign-In

theONE works with no account at all, and that is the ordinary way to use it: open the app, accept the Terms and this policy, enter your name and your boat, and use it. Everything in this policy about where your vessel data lives applies whether or not you ever sign in.

There is also an optional sign-in. In the app you sign in with Apple, or with your email address: tap Continue and we email you a six-digit code to type into theONE on the phone or iPad that asked for it. Either one makes your account the first time; there is no separate account to create. The app and this website ask for codes, not links: a sign-in link in an older email has expired and signs nobody in. A password is optional — you can add one later in the app’s Account screen. On this website you sign in with your email address and your password, or with a six-digit code we email you to type into the page that asked for it; the website does not make new accounts. On a phone, iPad or browser your account has not used before, a correct password also needs a six-digit code we email to you; Sign in with Apple or an emailed code needs nothing more. If you set a password, we never store the password itself — only a one-way hash of it (salted Argon2id), which can check a password but cannot be turned back into one. When you choose a password we check it against passwords known from public breaches using the Have I Been Pwned service: only the first five characters of the password’s SHA-1 hash are sent to it, never the password or its full hash, and it cannot tell which password you chose. Signing in is what lets a second device of yours, and your crew, reach the same boat, and lets you open the boat on the web; it is not required to use theONE. Anyone signed in can put a boat on our server; to join a boat someone else put there, you need an invite code from its owner, manager or captain. The sign-in code, the code that makes a new account, the password-reset code, the backup recovery code and the notices described in section 3a are emailed to you through Resend (resend.com), the service that delivers our mail; it receives your address and that message.

Sign in with Apple. If you use it, Apple gives us an identifier for you that is unique to theONE and does not change, and an email address: your own, or, if you chose Hide My Email, a private relay address ending in privaterelay.appleid.com, which Apple forwards to you. The first time only, Apple also gives us your name, if you choose to share it. We keep the identifier and that address with your account, with whether Apple confirmed the address and whether it is a relay address. If you shared your name and your account has no name yet, it becomes the name you give yourself in the app (section 3a), which you can change. If the address is your own and Apple has confirmed it, it signs you in to the account for that address, or makes one. A relay address is kept only with the Apple link: it never joins you to another account, and we send it nothing. We also keep, encrypted, a token Apple gives us for one purpose: when you delete your account, we use it to revoke theONE’s Sign in with Apple link at Apple. If you stop using Sign in with Apple with theONE in your Apple ID settings, Apple tells us, and the sessions it signed in end.

During setup you can enter your name, email, and phone number as the owner record. That information is written to the vessel file on your iPhone, as your own crew card. If you never sign in, it is not transmitted to us and we have no copy of it. If you do sign in, it travels with the boat’s record like every crew card — to the boat’s owner, captain and manager only (section 3a). The email address you sign in with is a separate thing, also in section 3a. If you asked for a Founding Captain spot through the form on this website, we do hold that email address — see section 8. That is the website, not the app.

If you never sign in, there is no profile of you on our side at all, and no vessel data of yours anywhere but your own device. Deleting the app from your device removes its data with it. If you do sign in, see section 3a for exactly what then leaves the phone and what does not.

3. What theONE Stores, and Where

Everything you put into theONE is stored on your device:

• Vessel data you enter. Vessel specifications, crew and contacts, maintenance records, documents, notes, trips, and playbooks.
• Telemetry and NMEA data. Values read on-device from your vessel's NMEA 2000 network — engine hours, fuel burn, depth, temperatures, voltages, and tank levels.
• Tracks. A leg records its own track while it runs. With no leg running, a cruising track starts by itself when the boat is underway; section 4 says when, and how to turn that off. Tracks are saved on the device. If you are signed in, a finished track is sent once, when its recording ends — see section 3a.

These live in the app's own storage on your iPhone as ordinary files. They are included in your iPhone's backup — iCloud Backup or an encrypted local backup, whichever you use. That backup is Apple's, under your control and Apple's privacy policy, and we cannot read it.

Backup files you make. Backup & Restore (Menu (☰) → Settings → Backup & Data → Backup & Restore) writes the whole boat to one file and hands it to you to keep where you choose; theONE keeps no copy of its own. Every backup is locked with a passphrase you set. theONE never keeps or sends the passphrase, and Boat IT passwords are never written into the file. The file never comes to us. If you let JEMS Marine help with a forgotten passphrase, see section 3a.

Until you sign in, nothing on that list leaves the device. The app’s Storage row says so too, naming the device you are holding, and it keeps saying it until you sign in.

3a. If You Sign In

Signing in is optional and it changes what we hold, so it is set out separately here rather than folded into the section above.

We do run a server for this. It is ours, at api.theonevcc.com, and the app names it on its own settings screens. It runs on Cloudflare, which stores the account records, each boat’s change log and the files described below on our behalf. When you sign in we hold: the email address you signed in with, or what Sign in with Apple gives us (section 2); if you set a password, its one-way hash (never the password); a record of each device session; which boats your account is a member of, and in what role; and each boat’s change log — the record of changes that sync carries between devices, described next; the name you give yourself in the app, which the boat’s owner, captain and manager see on the list of members; and, to stop password guessing and abuse, a record of each sign-in attempt, sign-in code request, password-reset request and reset-code guess — the address tried and the network (IP) address it came from — kept for seven days and then deleted.

The devices you sign in on. To ask for the second step only on a device your account has not used before (section 2), we also hold a record of each device on which your account has proved its email address or signed in with Apple: a one-way hash of a random key that device keeps, the device’s name (for example “Sam’s iPhone” or “theonevcc.com portal”) and when it was first and last seen. It is deleted with your account. We email your account’s address when it is signed in on a new device, naming the device, and when your password is reset. An account with no email address of its own — one made with Sign in with Apple and Hide My Email — is sent none of these emails.

What your boat then sends up. Changes you make to the vessel record travel to that server so your other devices and your crew can receive them — the boat’s specifications and systems, maintenance, trips and passages, notes and jots, vendors and their work sessions (including where a session was clocked in, if location was on), and the like. That is what sync is for and there is no way to have sync without it. Some things reach only certain people:

• Who receives what is decided on our server, not on the phone. Bills, documents and what fuel costs — price, total and receipts — are sent only to the boat’s owner, captain and manager; crew receive the fuel log without the money. A crew or guest card — health notes included — is sent to those three and to the person the card is about, and to nobody else. Our server withholds all of these from everyone else — they never reach anyone else’s phone at all. A vendor’s phone receives the boat’s name, the systems the owner, captain or manager chooses to share with them, each with its service history (never a cost or a bill), and what the vendor records themselves; sharing ends when the vendor’s access does. A guest’s phone receives only the trip they were invited to, their own card and that trip’s messages to the crew, and a guest cannot use the web version. Nobody but the owner, captain and manager can add, change or delete those records, except that crew can log fuel fills and change or delete the fills they logged, and you can change your own card. Access given for set dates stops at the end date.
• In-house work orders. A crew member’s phone receives only the in-house jobs they are put on — without what they cost or their photos — and no other work order, unless they have been given every work order. When they are taken off a job, or it is handed to a vendor, archived or deleted, their phone is told to drop its copy.
• When your access ends. If your access to a boat runs out, or you are taken off it, the app removes that boat’s records from your device the next time it reaches our server. The boat’s record stays with the boat. What is yours stays on your device: your own details, your position and the dates you were aboard, kept as a service record that is never sent anywhere unless you share it. If your access ran out, you can ask the boat’s owner, captain or manager for more time from the app; the date you ask for and any note you add are sent to them.
• Files. Once you sign in, the files attached to your records — document scans, fuel and bill receipts, and photos on issues, observations and work orders — are copied to our cloud storage so your other devices, your crew (by the rule above) and the web version can open them. A device downloads documents and manuals added elsewhere on its own while “Download files from other devices” is on in the Account screen (it is on unless you turn it off); with it off, they download when you open them. A jot or note sends a small preview of its photo; the full photograph stays on the device.
• Crew and guest cards — including medical and health notes and the card photo — reach the owner, captain and manager, and the person the card is about; never any other crew member, guest or vendor.
• The web version. Signed in on theonevcc.com, a boat’s owner or manager — or a captain the owner has also made manager — can read her record — including documents, bills and the fuel log, and open their files — and add a document. It reads and writes the same record the phones do, under the same rules. A captain who is not also manager can open her positions there (below), and nothing else of hers.
• Tracks. A recorded track is sent once, when its recording ends. Recording a track does not stream your position to us; your live position reaches us only if you have said yes to sharing it (below). A crew member’s phone does not receive tracks that ended before they joined the boat, unless they have been given the boat’s earlier history.

Her positions on the web. Signed in on theonevcc.com, a boat’s owner, captain and manager can see her positions: her home port, the positions in her logbook, her recorded tracks, and where she is now (next paragraph). Nobody else on the boat can — not crew, guests or vendors. They are shown only on the web version’s positions pages, on a plain grid of latitude and longitude that our own server draws: no map service receives them, and no position is put in a web address. Only the owner can download a track, as a GPX file. Every visit to those pages and every GPX download is written in the owner’s access log (below) before anything is shown or sent, and so is every change of where her live position comes from; repeat visits to the same page from the same device within ten minutes are one entry.

Your live position — only if you say yes. A boat’s owner, captain or manager can take her live position on the web from one phone that is sharing its position, or from none. Her owner, captain, manager and crew are each asked once in theONE, after joining her, whether to share their position with her owner, captain and manager. Nothing is sent before they say yes, and we keep their answer with their place on that boat. Guests and vendors are never asked and never share. Once a member says yes, their phone sends where it is — about every 30 seconds, from its own GPS, under the location permission already given to theONE — only while theONE is open on the screen on that boat: never in the background, even while a track is recording, and never while theONE is closed. Our server keeps the positions of the picked phone only — with its speed, course and accuracy when the phone gives them — encrypted with the boat’s own key, for one hour, and then deletes them. From any other phone that is sharing, the position is thrown away as it arrives; we keep only that it is sharing — who, their role, the device’s name and identifier, when it was last heard and how accurate its fix was — for an hour at most. The picked phone shows “Your position is being shared with the boat’s officers”, with a Stop button. Stopping, or turning sharing off in Menu (☰) → Settings → This iPhone → Privacy & Lock → Your position, deletes at once everything kept from that person’s phones on that boat. So does being taken off the boat, or deleting your account; when access ends on its set date, it goes within minutes. Picking another phone, or none, deletes what was kept from the one before. Live positions are never added to a recorded track.

A backup’s recovery key — only if you leave it on. When you make a backup, the switch “Let JEMS Marine help if I forget it” is on unless you turn it off. With it on, and the phone signed in to the boat’s account, theONE sends our server a recovery key for that one backup. We keep it in your account, locked with the boat’s own key, with the backup’s number and the boat it belongs to. The file never comes to us, and the key alone opens nothing. If the passphrase is forgotten, the boat’s owner who made the backup, while they still own her, can ask in theONE for an eight-digit code, which we email to the account’s confirmed address; it works once, for ten minutes, and five wrong tries end it. They either type the code into theONE, or give it, with the backup’s number, to JEMS Marine support, who enter it for them. Either way the key comes only to their own signed-in theONE: JEMS Marine support never see the boat, the backup or its key, and never ask for a passphrase or password. When JEMS Marine unlocks a backup, we email the account to say so. Every code sent and every unlock is written in the boat’s access log (below). With the switch off, no key is sent, and a forgotten passphrase cannot be recovered by anyone.

The weekly email of due work — only if you turn it on. If you turn on the weekly email of due work in Your account on the web version, we email your confirmed sign-in address on Monday mornings with how many items are due on each boat you see on the web version — counts only, no record’s details — through Resend, the service that delivers our mail. Every email has a one-click link to stop it, and you can turn it off in Your account. We keep only that you turned it on and when it last went; deleting your account removes both.

The owner’s access log. For each boat, our server keeps an access log that only her owner can read: whose device received a crew or guest card’s health notes (other than the person the card is about), and who downloaded a document, a receipt, a card photo or a résumé — the member’s name, the device’s name and the time. It also records who looked at her positions on the web, who downloaded a track as GPX, and each change of which phone her live position comes from — an owner’s, captain’s or manager’s pick, turning it off, or the picked phone’s member stopping — naming whose phone was picked. It never holds a position. It also records each backup recovery code sent and each backup unlocked — by the owner, or by JEMS Marine support with the owner’s code, naming the staff member — and each link made or ended between a vendor card and a vendor’s account. It holds no network (IP) addresses, and each entry is kept for a year. If you delete your account, entries about what you opened stay with the boat but no longer carry your name or your device’s name. An entry naming you as the person whose phone was picked loses your name the same way.

What never travels, whether you sign in or not. The Boat IT vault and its passwords — except the boat passwords you choose, one by one, when you hand a boat to a buyer: those go only inside the transfer file you give them, locked with a passphrase you set, and never through our server. Your own password, in readable form. Your position, second by second, while a track is recording. A backup file you make, and its passphrase. And, if you never sign in, nothing on this list or any other leaves the device. Your live position travels only if you say yes to sharing it, as set out above.

Deleting your account. Deleting an account removes the identity — the account itself, its sign-in method, its sessions, the devices it had signed in on and its memberships, and its Sign in with Apple link, which we also revoke at Apple. Records of work done on a vessel remain part of that vessel’s record, because a boat’s maintenance history must not develop holes when a person leaves it. If you owned a boat when you delete your account, we keep one record so she can be given back to you: a keyed fingerprint of your email address — not the address itself — beside each boat you owned. It is kept for good, and it matches only if that same address signs in again. For 30 days after you delete, signing in again with that address offers her back to you in the app; after that, write to ops@jems-marine.com and we check that it is you before returning her. You can delete your account yourself in the app (Menu (☰) → Settings → Account & Plan → Account → Delete my account), or write to ops@jems-marine.com and we will do it. Deleting your account does not cancel a subscription: Apple bills it, so cancel it with Apple (section 5a).

3b. Records Import — only if you order it

Records Import is an optional, paid service on the web version: you upload scans of your boat’s past paperwork — service invoices, work orders, survey reports and similar papers — and we suggest records from them for you to approve.

• Where your pages go. Each file you upload is stored as a document in your boat’s own record, like any document you add, and stays there until you delete it.
• Who reads them. Once your order is paid, your pages are read automatically, by our server sending them to Anthropic, the company whose service does the reading for us. Anthropic deletes what it is sent within 30 days, except where it must keep it longer by law or to enforce its usage policy, and does not use it to train its models without our express permission, which we do not give. A JEMS Marine team member may look at a page the reader could not read clearly. Nobody else sees your pages.
• What we keep. The suggested records are kept on our server, locked with your boat’s own key, until you approve or reject them. Approved records become part of your boat’s record. We keep the order itself — who placed it, the number of pages, the price and its dates — for our accounts.
• Nothing is added without you. No record is added to your boat until you, or another owner or manager of the boat, approves it.

4. Location and What Leaves Your Device

This is the largest of the few places information leaves your device, and the one that runs constantly, so it is worth being exact. The others are named elsewhere in this policy: the optional sign-in and sync, and a backup’s recovery key if you let JEMS Marine help, in section 3a; the optional crash and analytics reporting, and feedback you choose to send, in section 5; plans and purchases in section 5a; and chart regions you choose to download. Sharing your live position with a boat’s owner, captain and manager, if you say yes to it, is in section 3a.

When theONE refreshes weather, radar, or charted depth, or puts a name to a place, it sends a position — a latitude and longitude — directly from your device to the services below. None of it passes through our server.

• NOAA / National Weather Service (api.weather.gov) — forecast, active marine alerts and waves (height, period and swell, where the forecast gives them) for your position. Measured buoy readings come from NOAA’s National Data Buoy Center, below.
• NOAA CO-OPS (api.tidesandcurrents.noaa.gov) — tide predictions for the nearest station. The app picks that station on the device and asks for it by its station number, so no position is sent for tides.
• NOAA National Data Buoy Center (www.ndbc.noaa.gov) — buoy readings. The app asks for a buoy by its station number, so no position is sent for buoys.
• Iowa State University (mesonet.agron.iastate.edu) — NEXRAD weather radar imagery for the area you are viewing.
• NOAA chart services (gis.charttools.noaa.gov, encdirect.noaa.gov, distribution.charts.noaa.gov) — charted depth used by auto-routing and by the route editor’s depth check, aids to navigation, and chart region downloads.
• U.S. Army Corps of Engineers National Channel Framework, hosted on ArcGIS (services7.arcgis.com) — maintained-channel data. This one receives a bounding box around the area you are routing through rather than a single point.
• Apple, through iOS — the place-name lookup that turns a position into the name of a town or harbour (for the weather and tides you are reading, the ends of a route or a leg, and a man-overboard pin) and finds the places you type, such as a homeport, a destination or a vendor’s address; and the map under the chart, which loads the area on screen.

What goes with that position: nothing about you. No name, no vessel name, no email, no account, no advertising or device identifier. Requests to NOAA also carry a User-Agent header that identifies the app, its version, our website, and our operations address (ops@jems-marine.com) — NOAA requires callers to identify themselves. That is our contact information, not yours. Positions sent to the National Weather Service (api.weather.gov) are rounded to four decimal places, about 11 metres; the other services receive the position as your device reports it.

These services are independent of us and handle requests under their own policies. NOAA (including its National Data Buoy Center) and the Corps of Engineers are U.S. government services; Iowa State University's Mesonet is a third party. So is Apple, which handles what it receives under its own privacy policy.

Turning it off. Location is a standard iOS permission. You can revoke it at any time in Settings → Privacy & Security → Location Services → theONE. With location off, theONE falls back to the homeport coordinates you set on the vessel; if you have set no homeport, weather, tides, and sun times simply show as unavailable. Tracks, anchor watch, a man-overboard pin and following your position on the chart need it; the rest of the app works without it. With location off, theONE shares no live position either, and it never asks for more location permission in order to share one.

theONE also uses your location on the device to follow your position on the chart, to stamp where a vendor work session began, to keep an anchor watch you set, and to record tracks. A leg records its track while it runs. With no leg running, a cruising track starts by itself when the boat is underway — above 2 knots for three minutes while theONE is open — and is saved after 30 minutes stopped. While a track is recording or an anchor watch is set, theONE keeps reading your position with the screen off or another app open, and iOS shows its location indicator for as long as it does. Cruising tracks starting by themselves is on unless you turn it off: in theONE, Menu (☰) → Settings → This iPhone → Display → Record tracks by itself. If you never sign in, those stay on the device. If you do, the vendor clock-in position and the finished track travel with the boat’s record, as section 3a says; your running position does not, unless you have said yes to sharing it with that boat’s owner, captain and manager — and then only while theONE is open on the screen on that boat (section 3a).

5. Crash Reporting and Analytics

theONE includes two optional components, both switched off:

• Crash reporting (Sentry). Off by default. It starts only if you turn it on in Menu (☰) → Settings → This iPhone → Privacy & Lock → Crash Reporting. When it runs it is configured to send no personal information: no screenshots, no view hierarchy, no session replay, and crash reports are scrubbed of email addresses, file paths, vessel name, owner name, and homeport before they leave.
• Product analytics (PostHog). Off by default. It starts only if you turn it on, under Analytics on the same Privacy & Lock page.

Both travel by way of our own server at api.theonevcc.com, which passes them on to Sentry or PostHog. The toggles govern: nothing is sent unless you have turned it on, and both are off until you do.

Feedback you send. Menu (☰) → Settings → Help & Feedback → Send Feedback writes a message to feedback@theonevcc.com in your own Mail app, or copies it for you to paste elsewhere; nothing goes unless you send it. Unless you turn off “Include device + recent error logs” first, it carries your app version and build, iOS version, device model, locale, text size and up to 500 lines of theONE’s own log from the past hour, with email addresses, file paths, the paths of web addresses, positions and the names of your boat and the people on her taken out before you see them. The screen shows you exactly what will go.

5a. Plans and Purchases

theONE’s paid plans are auto-renewing subscriptions sold through Apple’s App Store. Apple takes the payment: we never see your card or any other payment details.

The app uses RevenueCat (revenuecat.com), a service that records App Store purchases for us. When theONE opens, it asks RevenueCat which plans are on offer and whether a plan has been bought. Until you sign in, RevenueCat knows you only by a random identifier it makes. Once you are signed in, the app gives RevenueCat your theONE account’s identifier — a random number, not your name or email — so a plan follows your account to your other devices. Nothing else of yours is passed to it: no vessel name, owner name, email or homeport. RevenueCat tells our server when a purchase, renewal, cancellation or expiry happens for that account. Our server then keeps your plan, the App Store product it came from and when it runs to, and a record of each such notice (its type and when it arrived); and, while Founding Captain spots are open, whether you hold one. Apple and RevenueCat handle what they receive under their own privacy policies.

To cancel or change a plan, use your Apple account: in the iPhone’s Settings app, tap your name → Subscriptions. Deleting theONE or your theONE account does not cancel a subscription.

6. Apple Calendar

If you grant calendar access, theONE can write your trips and maintenance dates into a calendar it creates in your calendar account, named for your vessel. If your iPhone is signed into iCloud, that calendar lives in iCloud and those events sync through iCloud like any other calendar event, under Apple's privacy policy. Only what you put on the event goes into it. This is optional; declining calendar access leaves the rest of the app working.

7. The App Store and TestFlight

theONE will be distributed through Apple’s App Store; until then, test builds go to testers through Apple’s TestFlight. Apple provides us with the standard information it gives every developer — downloads, purchases and subscriptions, and, from people who chose in their iPhone’s settings to share with app developers, usage figures and crash logs. That comes from Apple under Apple’s privacy policy, not from anything the app sends us.

8. The Founding Captain Form on This Website

The homepage of theonevcc.com has a form where you can ask for a Founding Captain spot. Apart from signing in to the web version (section 3a) and the website analytics described below, it is the one place on this site that collects anything you type, and it only collects what you type into it.

When you submit that form we store three things: the email address you entered, the date and time you submitted it, and the browser user-agent string your browser sends with the request. That record is kept in private storage at Vercel, our web host. It is not public and it is not indexed. When a new signup arrives we may also be sent a notification at our operations address, carrying the address you entered, the time and that user-agent string; it is emailed to us through Resend (resend.com), the service that delivers our mail.

We use that address for one thing: to contact you about Founding Captain access to theONE. We do not sell it, and we pass it to no one beyond the two services named above that store and deliver it for us.

Signing in to the web version uses five cookies, each set only by its sign-in and portal pages and each doing one job: one keeps you signed in — until 12 hours pass without use, for 7 days at most, or until you sign out; one ties an emailed sign-in code to the browser that asked for it, for the ten minutes the code works, and goes once the code is used; one holds a random key by which our server recognises, for up to 400 days, a browser where your account has already proved its email address, so it is not asked for the second step every time; one lasts a minute, to show the confirmation of a change you have just made, such as a document added; and one lasts a day, so that a one-time invite or guest-code form cannot be sent twice. If you choose Light or Dark under Appearance on the web version’s pages, a further cookie remembers that one word for a year; Auto removes it. All of them are our own, set by theonevcc.com and sent back to nobody else, and none is used to follow you or to measure your visits. Apart from those and the one analytics cookie described in the next paragraph, this site sets no cookies. Reading these pages is not logged by us beyond the ordinary server request logs our host keeps and the analytics in the next paragraph. Looking at a boat’s positions on the web version is different: each visit is written in her owner’s access log (section 3a).

Website analytics (PostHog). Since November 2, 2026, this site measures how it is used with PostHog (posthog.com), the analytics service we use, which processes the data in the United States for us only. On your first visit our server gives your browser one cookie, named theone_vid: a random number with nothing about you in it, kept for one year, set by theonevcc.com and sent to no other site. It lets us tell a returning visitor from a new one, and which post or link first brought you here. With it we record, for each page you open: the page’s address without anything after the “?”, except the campaign tags utm_source, utm_medium, utm_campaign, utm_content and utm_term; the page or site that linked to it; when you arrived and left, and how far down the page you scrolled; which links and buttons you clicked, by their wording and where they lead, and where on the page you clicked; your browser, operating system, screen size, language and time zone setting, and whether you are on a phone, tablet or computer; and your country and, in the United States, your state, which our web host works out from your internet address. While a visit lasts, PostHog keeps a note of it in that browser tab, which goes when the tab is closed. We never record anything you type into a form (asking for a Founding Captain spot is counted as a request, without your email address), we do not record your screen or replay your visit, we do not look up your city or exact location, and PostHog does not keep your internet address. We use none of this for advertising, and we do not sell or share it. PostHog keeps these records for one year on the plan we use; if that ever changes, this page will say so first.

Your choices. No analytics cookie is set, and nothing about you or your visit is recorded, if your browser sends a Global Privacy Control or Do Not Track signal, or if you use the “Turn off analytics cookie” link at the foot of every page (theonevcc.com/?count=off; the cookie then holds only the word “off”, and theonevcc.com/?count=on turns it back on). Visitors in the European Union, the European Economic Area, the United Kingdom and Switzerland get no analytics cookie either. In all of these cases our server still adds one to a plain count of pages opened without the cookie, noting only the page and which of these reasons applied, so we know how many visits go uncounted; that count carries no cookie, no number that could link two visits, and nothing else about you, and your internet address is not passed on. Clearing your cookies gives you a new random number. The web version’s sign-in and portal pages are never counted. Questions: ops@jems-marine.com.

To have your address removed from that list, email ops@jems-marine.com and we will delete the record.

9. What We Do Not Do

• We do not sell or rent your information.
• We do not use advertising networks or ad tracking, and the app contains no advertising SDK.
• We do not build a profile of you. If you never sign in, no vessel data of yours is on any server of ours. If you do sign in, section 3a says exactly what we then hold and why.

The only circumstance in which we would disclose information is where we are required to comply with applicable law, legal process, or an enforceable governmental request — and in practice we hold very little that could be disclosed.

10. Your Choices

Because your data lives on your device first, most of your control is exercised there rather than by writing to us:

• Location. Revoke it in iOS Settings, as described above. To keep location on but stop cruising tracks starting by themselves, switch off Record tracks by itself in theONE’s Settings → This iPhone → Display.
• Your position. Whether a boat’s owner, captain and manager can see where you are is your answer, and you can change it at any time: in theONE, Menu (☰) → Settings → This iPhone → Privacy & Lock → Your position. Turning it off deletes at once what was kept from your phones on that boat.
• Calendar, contacts, camera, microphone, speech recognition, Face ID and local network. Each is a separate iOS permission you can grant or revoke at any time.
• Crash reporting and analytics. Both are off unless you turn them on, and can be turned back off in the app, in Settings → This iPhone → Privacy & Lock.
• Subscriptions. Cancel or change a plan in your Apple account (the iPhone’s Settings app → your name → Subscriptions), as section 5a says.
• Deletion. Deleting the app removes its data from the device. If you signed in, delete your account in the app as well, in Settings → Account & Plan → Account (section 3a). Check your device backups if you also want it gone from those. To be removed from the Founding Captain list, write to us.

If you have a question about information we hold as a business — a Founding Captain signup, or an email you have sent us — write to ops@jems-marine.com and we will tell you what we have and delete it on request, subject to any legal obligation to keep it.

11. Children's Privacy

theONE is for people 13 and older. We do not knowingly collect personal information from children under 13; the app asks your age before it opens and cannot be used by anyone who says they are under 13. From 13 to 17, a parent or legal guardian agrees to these documents for you, and the app records that on your device with the date and the version agreed to. If you believe a child under 13 has provided us with personal information, please contact us so we can remove it.

12. International Users

theONE is operated from the United States, and NOAA-backed weather, tides, and charts cover US coastal waters. The services listed in section 4 are operated in the United States, so a position sent from outside the US is processed there, where data protection laws may differ from those in your jurisdiction.

13. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date at the top of this page. When a change affects the app — to this policy or to the Terms — theONE shows you its agreement screen again, once, with the new date. A change that concerns only this website, such as its analytics, is dated here and not asked for again in the app.

14. Contact

Questions about this policy can be sent to ops@jems-marine.com.
JEMS Marine, LLC, Maryland, USA.