Where your data sits, and how you get it back.
The questions a sceptical captain asks before putting the boat's business into somebody else's software. Answered plainly, including the parts that aren't finished.
Where it lives
In a managed Postgres database in Frankfurt, inside the EU, with one row-level-secured tenant per vessel. Access is enforced by the database itself rather than by the application asking politely. A query for another vessel's rows returns nothing, even when the code asking for them is wrong.
Your vessel identifier never appears in a URL. Which boat you're looking at comes from your session, so a link pasted into a crew group cannot expose another vessel.
The account that serves every request cannot bypass those rules, cannot create tables, and owns nothing. That isn't a policy. It is the database account's own permissions, and we test it on every deployment.
Who can reach it
Your crew
Only people your administrator has invited. Remove someone and their open sessions die in the same transaction — not at their next login, immediately.
Us, for support
Support access is time-boxed and recorded, so there's a record of who looked and when. We're still building the enforcement that makes it impossible rather than merely logged. Until that's done, treat this as an honest description of process, not a technical guarantee.
Nobody else
No advertising, no analytics on your operational data, nothing trained on it, nothing sold to anyone.
When something goes wrong
You build the diagnostic bundle yourself, from inside the product. You can read all of it before it goes anywhere, and you send it from your own mail client. Personal data is left out by default and replaced with stable pseudonyms, so a fault can be traced without handing over your crew list.
What you read is what you send. That's the whole reason for doing it that way round.
If the connection drops
The boat keeps working for thirty days without reaching us. That covers an Atlantic crossing with room to spare.
If a payment fails, you get seven days to sort it out. Those are two separate clocks on purpose. Being out of contact is not the same as not paying, and a vessel mid-ocean is the last one that should lose its watchbill over a declined card.
If you leave
You export your data and go. No exit fee, no retention period to argue your way out of, no support ticket needed to get a copy of your own logbook.
Inside the product nothing is ever deleted, only archived, so the history behind a panel you stopped using is still there, and still comes with you.
Ask us something harder
If there's a question this page doesn't answer, it's probably the one worth asking.