1. Using Vessly on your own #
- Where: a SQLite database in the app's private storage on your phone (Room on Android, GRDB on iOS). Other apps cannot read it; the operating system's device encryption protects it when the phone is locked.
- Account: none. There is no sign-in and no Vessly server involved in individual use.
- Photos: GPS location metadata is removed from every photo and scanned receipt before it is saved; only date and orientation are kept.
- Export: PDF and CSV exports and a full backup file are free in every plan, so you can leave with everything at any time.
- What does leave the phone: anonymous crash reports and usage statistics (Firebase) tied to a random installation ID, and, only when you use them, AI Mechanic requests. Details in the Privacy Policy.
2. Backups #
- Backup file: a ZIP archive with a manifest, a copy of the database, your photos and documents. You decide where it goes.
- Pro cloud backup: the same content is uploaded over TLS to your own Google Drive, using the narrowest Google permission there is (`drive.appdata`): a hidden folder only this app can see. No other app and no person can browse it, and it never passes through our servers.
- We cannot read it. The backup is in your Google account, under your password and your two-factor settings. Losing access to that account means losing the backup; disconnecting Drive in Settings stops the backup.
- Last backup time is shown in Settings so you can check that it actually ran.
3. Vessly Fleet #
- Sign-in: Google Sign-In or a six-digit one-time code sent to your e-mail. The code is random, valid for ten minutes, limited in attempts and never returned in a response.
- Hashed identity: the server stores a one-way SHA-256 hash of your Google ID or e-mail address, not the raw value, plus the display name you choose. Sessions use signed, short-lived tokens with a refresh token.
- App Check: every request to our server must carry a Firebase App Check token proving it comes from a genuine build of the app.
- In transit: all traffic between the app and the server, and between the server and our providers, uses TLS (HTTPS).
- At rest: fleet data lives on Cloudflare: a D1 index (who belongs to which fleet), one Durable Object per fleet holding that fleet's boat data, and object storage for photos. Cloudflare encrypts stored data at rest. A fleet's data is never loaded into the same process as another fleet's.
- Boat limit and lapsed subscriptions are enforced on the server, not in the app; data is never deleted because a subscription ended.
Who sees what in a fleet
Each member has a title (owner, captain, engineer, crew, guest and others). The titles map to four permission levels, enforced on the server:
- OwnerCreates and pays for the fleet, invites members, assigns roles, hides or shows amounts, dissolves the fleet.
- ManagerEdits boats and records, invites crew and guests with roles narrower than their own; cannot change roles.
- CrewAdds records and completes tasks on the boats in their scope. Sees amounts only if the owner allows it.
- ViewerRead-only access to the boats in their scope.
Hidden amounts are not hidden in the interface; they are removed on the server. When the owner hides costs from crew, the amount column is stripped from every response to those members; their phones never receive it.
Boat scope: a member can be limited to specific boats; records of other boats are not synced to them.
Leaving and deleting: a member who leaves keeps their entries in the fleet under "Former member". Deleting your account erases your hashed identity and display name, removes your device tokens and billing record, dissolves fleets you own together with their data and photos, and deletes your RevenueCat customer record. See Privacy Policy §5.
4. AI Mechanic #
- You start it. Nothing is sent until you type a message.
- Not used for training. Anthropic processes requests under its commercial API terms, which do not allow training on customer data.
- What is sent: your message, the response language and a short context block from your log: boat type, model and year; up to four engines with hours; up to five recent maintenance records; up to eight pieces of installed equipment. No boat names, amounts, notes, photos or documents.
- Path: app → our Cloudflare Worker (App Check verified) → Anthropic API (Claude Haiku) → streamed back to you.
- Our server does not store the conversation. It keeps only a monthly message counter per hashed identity for the allowance (15 messages a month on Free, 30 on Pro) and a running cost budget.
- At the provider: Anthropic processes the request under its commercial API terms as our service provider; we grant it no other rights to your data.
- Advice, not diagnosis. The app says so under every answer; see the Terms of Use.
5. Service providers #
These are the companies that process data on our behalf, and only for the purposes shown. The same list is used on the Security page.
| Provider | What for | What it receives |
|---|---|---|
| Apple (App Store) | Selling and billing subscriptions on iOS; push delivery (APNs) | Payment details (never seen by us); push token |
| Google Play | Selling and billing subscriptions on Android | Payment details (never seen by us) |
| RevenueCat | Recognising active subscriptions across devices | Store receipt, app user ID (random, or linked to your Fleet ID), purchase history |
| Google Firebase | Crash reports, anonymous usage statistics, performance, App Check, push messaging | Random installation ID, device model, OS and app version, technical events; push token |
| Cloudflare | Running our server; storing Fleet data; relaying AI Mechanic requests | Fleet boat data and photos, hashed identities, display names, device tokens, subscription state |
| Anthropic | Answering AI Mechanic questions | Your message and the boat context block (no names, amounts, notes or photos) |
| Resend | Sending sign-in codes and support e-mails | Your e-mail address, the one-time code or your support message |
| Google Drive (your account) | Optional Pro cloud backup, in your own Google account | Your backup, in a hidden app-only folder we cannot access |
What each provider receives, and your rights, are set out in full in the Privacy
6. Reporting a security problem #
If you find a vulnerability in the app, the server or this website, please tell us before telling anyone else, and give us a reasonable time to fix it. Include steps to reproduce and, if you can, the app version. We will acknowledge your report, keep you informed, and credit you if you wish.
We are a small team and do not run a bug bounty programme; we cannot pay for reports, but we do read every one and we fix what is found.
Security contact: [email protected]
7. Service status #
Fleet sync and AI Mechanic depend on our server. Its current state and recent incidents are on the status page. Everything else in the app works without it.