Privacy Policy

1Who we are

Off Watch is published by Appert. This policy covers the Off Watch app for Android and its Wear OS companion, distributed on Google Play under the package name com.appert.offwatch. It covers nothing else.

Appert is the data controller for the limited diagnostic data described in section 4 and section 5. We are not a controller of your rest record, because your rest record never reaches us.

For anything in this policy, including a request about your data, write to antonis.dev.info@gmail.com.

2The short version

There is no account to make and no server of ours. Nothing about your hours — not a vessel, not a rank, not a remark, not one hour — is sent anywhere. Your record is on your phone. If Android's own backup is switched on, it travels with the rest of your phone to your own Google account, and you can save a copy of the whole record as a file whenever you like.

What does leave the phone is anonymous usage and crash reporting: which screens were opened and what went wrong, so that a fault at sea gets fixed. It never carries what you wrote. That is not only a promise about our care — it is a property of how the app is built, and section 4.1 explains exactly how.

The free version shows one banner, from Google AdMob, and asks your permission before it does. Your record is never used to target it — it cannot be, because it never leaves your phone. Off Watch Plus removes the banner entirely. Section 4.2 is the detail.

Purchases go through Google Play, and we never learn who you are.

The rest of this page says all of that again, precisely, with the parts a regulator or a Google Play reviewer needs.

3What stays on your phone

All of the following is stored only on your device, in the app's own private storage:

• Every day you record — the date, which half-hour slots are work and which are rest, which rest was disturbed, the UTC offset you were keeping, and any remark you typed.
• Your contracts — vessel name, IMO number, flag, rank, and your sign-on and sign-off dates.
• Your rule sets — the published STCW and MLC figures, and any limits you have edited.
• Your settings — your name as it appears on an exported form, your reminder and alert times, your language, and whether you have finished onboarding.
• Your watch session and your purchase state.

None of this is transmitted to us. There is no sync, no cloud copy under our control, and no route by which we could read it. If a court asked us to produce your record, we could not.

Files you export

The IMO/ILO-layout PDF, a CSV month and a JSON backup are written through Android's own document picker. You choose where each file goes, and the app is never told the path — it is handed a one-time reference to the single file you picked, and nothing else on your device. Where the file goes after that is between you and wherever you saved it.

4What leaves your phone

Four things travel off the device. Only the first is collection by us alone; the second involves a third party, and we say so plainly.

4.1 Anonymous usage and crash reporting

The app uses Google Firebase Analytics and Firebase Crashlytics. Section 5 lists exactly what they collect, in Google Play's own categories. All of it is encrypted in transit with TLS. None of it is sold, and none of it is shared with a third party for their own purposes — Google processes it on our behalf.

What matters more than that list is what structurally cannot be in it. Analytics events in Off Watch are not free text, and cannot become free text. A value attached to an event in this app can only be a number, a true/false flag, or a choice from a fixed list written into the app's source code. There is no text option. Putting a vessel name, a rank, a remark or your own name into an event is not something we have merely promised not to do — it will not compile.

Three further routes are closed by hand:

• The breadcrumb trail attached to a crash report records the name of what you did, never its contents. Editing a remark is recorded as the fourteen characters OnRemarkChange, whatever the remark said.
• A crash report carries an error's type and its stack trace. The error's message is stripped out before the report is assembled, because a message can carry a file name you typed or a document you picked.
• The detailed stream of what you tapped goes only to crash reports, never to analytics.

We never set a user ID on either service, and there is no account, sign-in or profile to derive one from. The identifiers in section 5 are per-installation identifiers generated by Google's libraries; they identify a copy of the app, not you.

There is no in-app switch to turn this off. We would rather say that plainly than offer a toggle that does nothing. Collection is disabled entirely in development builds, so nothing is reported while the app is being worked on.

4.2 Advertising, in the free version

The free version of Off Watch shows a single banner at the bottom of most screens. It is served by Google AdMob. Off Watch Plus removes it — on a device with Plus the ads library is never even started, so nothing here applies to you at all.

No part of your record is used to target it. Your hours, your vessel, your rank, your remarks and your contracts never leave your phone and are never available to an ad request. That is the same structural guarantee as section 4.1, and it is not weakened by this section.

What AdMob does receive is what any ad request carries: your device's advertising ID, coarse information about the device and app, and an approximate location derived from your IP address. It uses that to select and measure the ad. Unlike the analytics in section 4.1, Google is not merely acting on our behalf here: AdMob uses this data for its own advertising purposes, which Google Play counts as sharing rather than collection. We have said so in our Data Safety declaration and we say so here.

Google's handling of it is covered by the Google Privacy & Terms for partner sites and apps and the Google Privacy Policy.

Your choice, and how to change it

Before a single ad is requested, we ask. Off Watch uses Google's User Messaging Platform, a consent platform certified by Google, to show you the choice required where you are — in the EEA, the UK and anywhere else with an equivalent requirement. Nothing is requested until you have answered it, and if the app cannot reach Google to ask, it shows no ads at all.

You can reopen that choice at any time: Settings → Ad privacy. The row appears wherever the form itself says you are entitled to change your answer.

You can also reset or delete your advertising ID from your device's own settings, under Privacy → Ads, at any time and independently of us.

The advertising ID is used for advertising and for nothing else. Firebase Analytics and Crashlytics do not receive it: the two settings that would allow that are switched off in the app's configuration and remain off.

4.3 Android's own backup

If Android Backup is switched on for your device, your Off Watch data is included in it along with the rest of your phone. That copy goes into your own Google account. It is not a copy we hold, we have no access to it, and we are not told it exists. Google's handling of it is covered by the Google Privacy Policy.

Some things are deliberately excluded from that backup: your current watch session, your purchase entitlement, and the analytics and crash-reporting identifiers — the last of these so that restoring onto a new device does not make one person look like two.

You can turn Android Backup off in your device settings. If you do, use the app's own backup export to keep a copy of your record somewhere you control.

4.4 Your paired watch

If you use the Wear OS app or tile, your phone sends a short summary to your watch over Bluetooth, through Android's Wearable Data Layer, and the watch sends back the taps you made on it. The summary is text the phone has already written out — the date, the day's slots, where you stand, a short projection — plus the timestamps needed to record a tap made out of Bluetooth range at the time you made it rather than the time your phone heard about it.

Both ends are your own devices. There is no network hop, no server and no third party. It never leaves the pair.

5What we collect, in Google Play's categories

This table is the same declaration we have made on Google Play's Data Safety form. If the two ever disagree, that is a fault and we want to hear about it.

Nothing is sold, ever. The rows marked "No" are collected by us and processed by Google on our behalf, and are passed to nobody. The three rows marked "Yes" are the advertising ones described in section 4.2: AdMob uses that data for Google's own advertising purposes, which Play counts as sharing. They apply to the free version only and only after you have consented, and Off Watch Plus removes them entirely.

No row above is any part of your record. Not an hour, not a vessel, not a rank, not a remark. That holds for the advertising rows as firmly as for the rest — see section 4.1 for why it is a property of the code rather than a promise.

Retention

We hold no copy of any of this ourselves. It sits in Google's systems under the retention settings for our project and is deleted by Google when they expire: crash reports after 90 days, and analytics event data after the period configured in Google Analytics, which is capped at 14 months.

Everything else the app holds — your entire rest record — is processed only on your device. Google Play does not require on-device-only data to be declared here. We have listed it in section 3 anyway, because you are entitled to know where your hours live without reading a form.

6What we never do

• No advertising ID in our analytics. The free version's banner uses one — see section 4.2 — but Firebase never receives it: advertising-ID and SSAID collection are both switched off in the app's configuration and stay off. The two are independent, and we keep them that way.
• No Android device ID. Collection of the device's SSAID is switched off too.
• No user ID. We never set one on either Firebase service, and there is no account to derive one from.
• Nothing you typed, ever, in an event. See section 4.1 — this one is enforced by the code, not by discipline.
• No selling. We do not sell your data, to anyone, at any price. The advertising data in section 4.2 is shared with Google for advertising — that is disclosed rather than denied, it is the free version only, and Plus removes it — and it is the only sharing that happens anywhere in this app.
• No profiling by us, and never from your record. Nothing we receive is used to build a profile of you or to make an automated decision about you. AdMob selects the banner from what section 4.2 lists; your hours, vessel, rank, remarks and contracts are not in that list and cannot be, because they never leave your phone at all.
• Nothing of yours carried to another app or website. We operate no cross-app tracking and no SDK of ours does. What an advertising ID enables on your device generally is between you and Google, and you can reset or delete it in your device settings at any time.
• No server of our own. There is nowhere for us to keep your record, and nothing of yours for anyone to breach, buy or subpoena from us.

7Permissions the app holds, and the ones it does not

What the app asks for

• Notifications — the daily reminder, missing-day nudges and limit alerts. You grant this, and you can switch each type off separately. Nothing about limits is ever sent while your record says you are resting.
• Run at startup, wake lock, foreground service — used by Android's own job scheduler to re-register the daily job after your phone restarts.
• Internet and network state — to send the diagnostics in section 5, to talk to Google Play about purchases, and to fetch the free version's banner.
• Billing — to sell Off Watch Plus through Google Play.
• Advertising ID — used by AdMob for the free version's banner, and by nothing else in the app. It is not requested by the Wear OS app, which shows no ads at all.

What the app never asks for

• Location, of any kind — neither precise nor approximate
• Storage or file access — exports and backups go through the system document picker instead
• Camera, microphone, contacts, calendar, phone, SMS, health data or body sensors
• Exact alarms

If you inspect the app's manifest you will find three entries we did not ask for — ACCESS_ADSERVICES_AD_ID, ACCESS_ADSERVICES_ATTRIBUTION and ACCESS_ADSERVICES_TOPICS. They arrive inside Google's analytics and ads libraries and cannot be removed from them. Off Watch performs no attribution and uses no Topics-based advertising, so in this app they do nothing. We would rather explain them here than have you find them and wonder.

8Purchases

Off Watch Plus is sold through Google Play, either as a subscription or as a one-off lifetime unlock. Google Play handles the entire transaction. We never see your name, your card, your address or your order. The app is told only which of our products this Google account owns, and it uses that to unlock features. Anything Google collects in the course of a purchase is covered by the Google Privacy Policy and Google Play's own terms.

Nothing about your record is sent with a purchase. Your entitlement is deliberately excluded from Android's backup, so that it cannot travel to a device it was not bought on.

The free version of Off Watch has no time limit and asks for no payment method. There is no trial period, and so there is no date about your installation that we store or need to store. The free version is funded by the banner in section 4.2, and buying Plus removes it — on a device with Plus the ads library is never started at all.

9Your rights, and the bases we rely on

If you are in the United Kingdom, the European Economic Area or Switzerland, the UK GDPR and the GDPR give you rights over personal data about you. Appert is the controller for the diagnostic data in section 5 and, together with Google, for the advertising data in section 4.2. Nothing else reaches us at all.

Our lawful bases

• Legitimate interests (Article 6(1)(f)) for the anonymous usage and crash reporting — keeping the app working across the range of devices seafarers actually carry, and finding out what broke. We have weighed this against your interests: what is sent carries no part of your record, no advertising identifier and no identifier of you, and it is the least we can send and still fix faults.
• Your consent (Article 6(1)(a)) for the advertising in section 4.2, gathered through Google's User Messaging Platform before any ad is requested. You can withdraw it at any time, as easily as you gave it: Settings → Ad privacy. Withdrawing it does not take away anything the free version does — the record, the limits and the alerts are unaffected.
• Performance of a contract (Article 6(1)(b)) where processing is needed to deliver a purchase you have made.

Your rights

You have the right of access, rectification, erasure, restriction, portability, and objection — including objection to the legitimate interests above and withdrawal of the advertising consent in section 4.2. Two practical points follow from how the app is built:

• We cannot give you a copy of your record, correct it, or delete it for you, because we do not have it. It is on your phone. The app's export and backup screens hand you the whole thing as a PDF, a CSV or a JSON file whenever you want it — that is portability, in your own hands, without having to ask us.
• For the diagnostic data in section 5, write to antonis.dev.info@gmail.com. Because that data carries no identifier of you, we may need your help to locate it, and there may be nothing we can single out as yours. We will tell you honestly what we found and what we did.

Deleting everything

Uninstall the app. Your record goes with it, because it never left your device. If Android Backup is switched on, delete the app's backup from your Google account as well, in your Google account's backup settings. The diagnostic data expires on the schedule in section 5.

Transfers and complaints

The diagnostic data in section 5 and the advertising data in section 4.2 are processed by Google on infrastructure that may sit outside your country, under Google's own transfer safeguards. You have the right to complain to your data protection authority — in the UK, the Information Commissioner's Office; in the EEA, the supervisory authority where you live.

10Children

Off Watch is a professional working record, kept by officers and ratings serving at sea. It is intended for adults, its Google Play target audience is 18 and over, and it is not directed at children. There is nothing in it for a child — no account, no messaging and no social feature — and we do not knowingly collect anything from one. The free version does show a banner, which is why the app is declared to Google Play as 18 and over and is not enrolled in the Families policy programme; the consent request is configured to say the user is not under the age of consent, consistent with that.

If you believe a child has used the app and you would like the diagnostic data in section 5 looked at, write to antonis.dev.info@gmail.com.

11What this app is not

It is your own copy of your hours of work and rest. It is not the ship's official record and does not replace it. Nothing in it is a finding by any administration, flag state or port authority.

The verdicts are arithmetic on your own entries, measured against the limits you selected. That is not legal advice, and it is not an inspection.

The app only knows what you enter. A day with no entry is not a quiet day; it is a day the app knows nothing about, and it says so rather than counting it as rest.

12Changes to this policy

If this policy changes, the date at the top of this page changes with it and the change is described here. Anything material will also be noted in the app's release notes on Google Play.

• 11 September 2026 — First version.

13Contact

Write to antonis.dev.info@gmail.com for anything in this policy — a question, a request about your data, or a correction to something here you think is wrong.

Off Watch is published by Appert. Google Play package name com.appert.offwatch.