PassageMaster™

Privacy Policy

Effective date: 16 July 2026. This version takes effect on the "Last updated" date.
Last updated: 9 November 2026
Version: 0.7

This Privacy Policy explains how Astramara, LLC ("Astramara", "we", "us") collects, uses, shares, and protects personal information when you use PassageMaster™ (the "Service"). It also describes your rights under the EU General Data Protection Regulation (GDPR), the UK GDPR, the California Consumer Privacy Act as amended by the CPRA (CCPA/CPRA), and other privacy laws that may apply where you live.

We designed PassageMaster™ to be offline-first and to keep as much of your data on your device as possible. Where the Service must send data to a third party to function (for example, to fetch weather or to answer a Quartermaster question), we describe that below. If you are signed in with an active membership, copies of your boat records also sync through our cloud to your other devices on the same account and boat. That is described under Sync across your devices below.

Our website (www.passagemaster.com)

Astramara, LLC operates www.passagemaster.com and is responsible (the "controller") for personal data collected through it. This section covers visitors to our website. Our app is covered by the rest of this policy.

Essential storage. We store your privacy choice, the policy version and the time you chose, in your browser for up to 6 months, so we don't ask again on every visit. Our hosting provider, Cloudflare, processes technical request data (such as IP address, browser details and the page requested) to deliver and secure the site. We rely on our legitimate interest in running a secure website; you can object by contacting us at privacy@passagemaster.com, and we will consider your circumstances.

Analytics, only with your consent. If you click "Accept analytics", we use:

Google Analytics keeps visitor-level and event-level data for 2 months; summary reports that don't identify individual visitors may be kept longer. Cloudflare keeps detailed Web Analytics data for 7 days, then keeps a reduced summary that we can view for up to 6 months.

We don't send your name, email, account details, crew, health or vessel information to analytics. Our legal basis is your consent. You can withdraw it at any time through "Privacy choices"; withdrawal doesn't affect earlier processing. When you withdraw, we stop further analytics collection and delete the Google Analytics cookies we can reach in your browser. This doesn't delete data already sent, which is kept as described above.

Sharing and transfers. Google and Cloudflare may process this data in the United States and other countries. They process it for us as our service providers (processors) under their data processing terms, which include safeguards for transfers outside your country, such as Standard Contractual Clauses and, for Cloudflare, the EU-U.S. Data Privacy Framework.

Sale and targeted advertising. We don't sell website analytics data or share it for cross-context behavioral advertising.

1. Who is responsible for your data

Astramara, LLC is the controller of personal data processed through the Service.
Contact: privacy@passagemaster.com; Mailing address maintained in company records and available upon legally required request.
EU/UK representative (GDPR Art. 27 / UK Rep), if appointed: not currently appointed.

2. Information we collect

Account and identity. When you create an account, our identity provider processes your email address and authentication credentials, and we store an account identifier, subscription status, and related settings.

Name used in the welcome email. Stripe Checkout collects an individual name. We do not copy that name into our account database. The membership welcome email may greet you with a first name from your sign-in token when that name is present. If it is not, the greeting uses the first word of the Checkout name, read at the time of sending and not stored by us. If neither name is usable, the greeting does not include a name.

Billing. Our payment processor handles your payment. We receive and store billing metadata (such as customer and subscription identifiers, plan, and status). We do not store full payment card numbers; card data is handled by the payment processor.

Checkout also collects a billing address. We do not copy the street address onto the account record. A refusal of a new membership for a halted billing place stores the country code and, when present, the state or province code, with the account identifier, the Checkout session identifier, and a timestamp. It does not store the street, city, or postal code.

Boats and devices. If you register boats or devices, we store details such as boat name/notes and a device key, label, platform, and browser user-agent. One account and one membership cover one hull for new boats. Accounts that already have more than one boat are left as they are.

Content you enter. Imported passages, boat profile (which may include name, type, MMSI, call sign, and dimensions), emergency contacts and equipment notes, Settings contacts, Float Plan drafts (including the people onboard and any medical or mobility notes you choose to add), Logbook trips and tracks, Dinghy Logs, Systems and Maintenance records and the files you attach to them, BridgeSpan packs, To Do items, sticky notes, the crew briefing, and app settings. This content is stored on your device. If you are signed in with an active membership, it also syncs as described below.

A captain-supplied GRIB file stays on your device. We do not store that GRIB file on our servers. The boat profile name, when you have saved one, may also be stored on the Stripe customer as metadata so support can identify the hull. MMSI, call sign, and other profile fields are not sent to Stripe.

Information about other people. Some records hold information about other people, such as crew names, phone numbers, and health notes in a Float Plan, or the people in your contacts. Only enter it if you have their permission or another right to share it with us, and to have it synced and shared as you choose. Please let them know how it is used, for example by pointing them to this policy.

Sync across your devices. When you are signed in with an active PassageMaster™ membership, your boat records sync across your devices on the same account and boat:

Which device records the boat's Logbook, and a man-overboard incident (described below), also sync for the same boat.

We keep the synced copies on our cloud provider's servers so your other devices can catch up. Only your signed-in devices on that account and boat can read them. Sync stays within one account. It is not a public track, it is not Share location, and it is not filed with the U.S. Coast Guard or any other authority. If you're signed out or not a member, your data stays on that device. Map layers, offline charts and packs, cached weather and tides, a captain-supplied GRIB file, and Quartermaster's on-device question log always stay on the device. Share location links are not part of sync.

You share a Float Plan yourself, from your device. We do not send it for you, file it with any authority, or contact rescue services.

Health information. Medical or mobility notes in a Float Plan are health information, which many privacy laws treat as sensitive. They are optional. We do not need health information to provide the Service. If you add them, they are stored on your device and sync to your other devices on the same account and boat like the rest of the Float Plan draft. We use them only to store and sync them for you. You can edit or delete them at any time, and the change syncs to your other devices.

Your device storage. Records are kept in your browser's storage on each device. If you clear your browser storage, remove the app, or reset the device, anything on that device that has not synced or been backed up is deleted, and we cannot recover it.

Location and vessel telemetry. When you connect Signal K or enable device GPS, the Service processes position, speed, heading, depth, wind, and similar values to power live features. Unless you turn on Share location (below), a man-overboard incident is published as described below, or an internet AIS request is made as described below, this live telemetry is used on your device and is not persisted to our servers as a public track. Logbook and Dinghy Log tracks recorded from it sync privately as described under Sync across your devices; they are not a public track.

Internet AIS. While Harbor, Nearby, Planning, or Underway is open, a position is available, and the device is online, the Service can send that latitude and longitude and the search radius in nautical miles to our server, including a refresh every five minutes. A fresh result already on the device can be reused instead of a new request. When a connected own-vessel MMSI is available, that MMSI is included on the same request so the reply can omit own-ship. It comes from the live vessel connection, not from the boat profile. The MMSI is not sent to aisstream.io. When the server is configured with an aisstream.io key, it uses the position and radius to request nearby vessels from aisstream.io for that request. The key stays on the server. If the key is not set, the server does not call aisstream.io. This disclosure is not a claim that a traffic picture is shown. It is not CPA or TCPA. An empty display is not an all-clear.

Share location. If you create a Share location session, we store a share token and, for new sessions, a password hash (not the password in plain text) on our servers. While the session is active we receive throttled heartbeats with share-safe geometry: last reported position, the recorded trail since sharing started, and the planned line when one is published. New sessions require a password. People who have both the link and the password can view that geometry until you revoke access or the session expires. We do not put the password in the link or in email. You choose 14, 30, or 60 days when you create the session. The default is 30 days. Older sessions created without a password hash remain viewable with the link alone until you set a password or revoke the session. Share location is not a distress beacon and does not notify an EPIRB, a rescue coordination center, or the U.S. Coast Guard. It is not limited to family. Dinghy Log tracks and man-overboard incidents are not published on Share location.

Man-overboard incident. The on-device mark is held in memory. It is where the boat was at the press, not where the person is. No position means no mark. The mark stays in memory on the device. It is not saved with your other onboard data, and it is not written to Share location. The incident, including that boat position when one exists, may be published on this boat's Signal K network for other open screens, and, when you are signed in with sync, to same-boat cloud so another captain device can catch up. Screens that learn it from the cloud label the source as cloud and show the time it was heard. It does not go to shore followers. It is not a distress transmission.

Voice. If you use speech features, audio may be processed by your browser's speech-recognition capability (which, on some browsers, uses a third-party cloud service). Recognized text may be sent to the Quartermaster assistant as described below. Wake-word detection runs on your device.

Quartermaster interactions. Questions and the grounded context needed to answer them are sent to our AI provider through our server. A local audit log stores recent question/answer summaries on your device.

Technical/operational data. Our servers process your IP address for security and rate-limiting. The app does not currently use a third-party product-analytics SDK. Website analytics are described under Our website (www.passagemaster.com).

Legal terms acceptance records. When you click I Agree on the first-entry acceptance screen (or a later re-acceptance screen), we record: the date and time of acceptance; your account identifier; the version of each accepted document (Terms of Service, Privacy Policy, Disclaimers, EULA, and Subscription & Refund Policy); the purpose of the record (to prove that you agreed to those specific versions); and technical identifiers of that session, including IP address and browser user-agent. We retain these records for at least five (5) years, and longer if needed for legal, fraud-prevention, or dispute-resolution purposes. This processing is necessary to form and perform our contract with you (GDPR / UK GDPR Article 6(1)(b)). It is not a bundled GDPR consent checkbox, and it is not consent to process Quartermaster chat content.

Server check. Signed-in calls to account APIs and to cloud Quartermaster check the latest acceptance record against the current Terms, Privacy, Disclaimers, and EULA versions. A missing or stale record is refused. The exceptions are reading or recording acceptance, and reading or deleting the account profile. The membership welcome email can be sent after membership is on. Accepting the terms, by itself, does not send the email.

Email we send. Microsoft (Microsoft 365) sends plain-text mail from our mailbox: one membership welcome email, and seasonal pause notices (pause scheduled, pause started, and pause resumed). The welcome goes to the login email on the account after membership is on (a trial, paid access, or a complimentary grant). It is not sent at sign-up. Seasonal pause notices go to that same login email. That same mailbox can send the trial-ending reminder and the post-purchase acknowledgement described in the Subscription and Refund Policy. Those two messages are sent only when the price is USD 10.00 per month or USD 110.00 per year. If sending the reminder or the acknowledgement fails, we retry. A GRIB request composed in the Service is handed to your own email program. We do not send that message.

Boat-event text messages. If you opt in, we store your mobile phone number and your consent to text you about your boat. Twilio is the texting provider. We store the Victron VRM personal access token you provide so the watch can run while the tablet is off. A text names Victron VRM and the time of that reading. A stale or missing reading does not send. One text is sent per episode. These texts are decision-support. They are not a certified alarm. Text messaging originator opt-in data and consent are not shared with third parties for their marketing. Message frequency, STOP, and HELP are in the Terms of Service.

3. How we use information

We process personal data to: provide and secure the Service; authenticate you; process subscriptions and payments; record and retain your acceptance of our legal terms; answer Quartermaster questions; provide weather, tide, chart, and survey information; request nearby vessels for internet AIS while Harbor, Nearby, Planning, or Underway is open, as described above; operate an optional password-gated Share location session when you request one; sync your boat records across your signed-in devices on the same account and boat, as described above; send the membership welcome email, seasonal pause notices, the trial-ending reminder, and the post-purchase acknowledgement; send opted-in boat-event text messages; maintain reliability and prevent abuse; comply with legal obligations; and communicate with you about the Service.

4. Legal bases (GDPR / UK GDPR)

We rely on: performance of a contract (GDPR / UK GDPR Article 6(1)(b)) to provide the Service you request, including account administration, legal-terms acceptance records, and syncing your boat records across your devices; legitimate interests (to secure, maintain, and improve the Service, balanced against your rights); consent (for example, where required for device sensors such as microphone/location, which you can control through your browser/device); and legal obligation (for example, tax and accounting records).

Health information in Float Plan notes is a special category of personal data under the GDPR and UK GDPR. We process it on the basis of your explicit consent, which you give when you choose to add those notes. You can withdraw that consent at any time by deleting the notes. When you add health information about someone else, you confirm that you have their permission.

The I Agree clickwrap is contract formation, not a GDPR consent checkbox for all processing. Quartermaster chat (your question text, grounded context, embeddings, and usage/wallet ledger) is processed only when you use that feature, under Article 6(1)(b) for the AI assistant service you request — it is not bundled into the Terms of Service checkbox.

5. AI and automated processing

The Quartermaster assistant is an AI system. When you interact with it, you are interacting with AI, not a human. It is decision-support only, may be inaccurate or incomplete, and must not be relied upon for navigation, collision avoidance, or emergency response. To answer a question, we send your question text and relevant grounded context to our AI provider (OpenAI) through our server. We do not use your content to train third-party foundation models where our provider settings allow us to opt out, and we do not sell your data. The Service does not make automated decisions that produce legal or similarly significant effects about you within the meaning of GDPR Article 22.

For the man-overboard crew card, Quartermaster speaks only the crew card in the Disclaimers. It does not add its own seamanship advice.

Syncing does not send your boat records to our AI provider. Quartermaster receives only your question and the context needed to answer it.

6. Sharing and subprocessors

We share personal data only with service providers ("subprocessors") that help us operate the Service, under contracts that require appropriate protection. These currently include:

Waterway Guide and NoForeignLand are not current overlays. EOX is not a current live satellite choice. A corridor package already stored on a device may still open. Vector Charts is not a current chart choice in the app. We do not describe a working internet AIS traffic picture. The internet AIS request described above is not that claim.

If you create a Share location session, we disclose the share-safe geometry described above to people you choose to give the link and, for new sessions, the password (older passwordless sessions remain viewable by the link until you set a password or revoke). That is not a sale of personal information and is not a distress or rescue notification.

Synced boat records are available only to your signed-in devices on the same account and boat. We do not share them with shore followers or other accounts. If you share a Float Plan or export a trip yourself, you decide who receives it.

We may also disclose information to comply with law, enforce our terms, or protect rights, safety, and property. If Astramara is involved in a merger, acquisition, or asset sale, data may be transferred as part of that transaction.

7. International transfers

We are based in the United States and our providers may process data in the United States and other countries. Where we transfer personal data from the EU/EEA or UK, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses (and the UK Addendum) or other lawful transfer mechanisms.

8. Retention

We keep personal data only as long as needed for the purposes described here or as required by law. Account and billing records are retained for the life of your account and for as long as required for tax, accounting, legal, fraud-prevention, and dispute-resolution purposes afterward. Legal-terms acceptance records (including IP address, user-agent, accepted document versions, and purpose) are retained for at least five (5) years. Share location records remain until you revoke them or they expire. The default lifetime is 30 days. At creation you may choose 14, 30, or 60 days. That lifetime is not a distress-record retention period. Synced copies of your boat records are kept while your account and boat exist. When you delete a synced record, the deletion syncs and the record is removed from our synced copy. Deleting your account deletes your account, boat, and device records, including the synced boat records stored with them; legal-terms acceptance records are kept as described above. Track segments and attached files are kept in separate private storage, and those linked to a deleted record or account may remain there until they are cleaned up. You can ask us at privacy@passagemaster.com to delete them sooner. Data stored locally on your device remains until you delete it or clear your browser storage. The on-device man-overboard mark is memory only.

9. Your rights

Depending on where you live, you may have rights to access, correct, delete, or port your personal data; to object to or restrict processing; and to withdraw consent. You can export or delete your account data from within the Service, or contact us at privacy@passagemaster.com. The in-app account export covers your account, boat, and device records and your legal-terms acceptance records. For a copy of the synced boat records we hold, such as Float Plans, contacts, trips and tracks, or to have them deleted, contact us at privacy@passagemaster.com. You can also export a logged trip from the Logbook.

EU/EEA and UK (GDPR/UK GDPR): you also have the right to lodge a complaint with your local supervisory authority.

California (CCPA/CPRA): you have the right to know, delete, correct, and to opt out of "sale" or "sharing" of personal information, and not to be discriminated against for exercising your rights. We do not sell your personal information and do not "share" it for cross-context behavioral advertising. Some information is "sensitive personal information" under California law, such as precise location in Logbook and Dinghy Log tracks and health information in Float Plan notes. We use it only to provide the features you ask for and as otherwise permitted by law, and not to infer characteristics about you, so we do not offer a separate choice to limit its use.

Other U.S. states: if you live in a state with its own consumer privacy law, you may have similar rights, including to access, correct, delete, and get a copy of your personal information, and to opt out of its sale, targeted advertising, or profiling. We do not sell personal information or use it for targeted advertising or profiling. If we decline your request, you can appeal by replying to our decision. If we deny your appeal, you may contact your state attorney general.

Elsewhere: wherever you live, you can contact us at privacy@passagemaster.com to use the rights described here.

We will verify requests and respond within the timeframes required by applicable law.

10. Cookies and local storage

We use browser local storage, IndexedDB, OPFS, and a service worker to keep the Service working offline and to keep you signed in. We do not use third-party advertising cookies. Website cookies and the website privacy-choice banner are described under Our website (www.passagemaster.com).

11. Children

The Service is not directed to children under 18, and we do not knowingly collect personal data from them as account holders. PassageMaster™ may be used aboard by a mixed-age crew under the responsibility of the account holder and the vessel's captain. A captain may record in a Float Plan that someone onboard is a child, with their name and any notes the captain chooses to add. That is trip information entered by the captain, not an account for the child. Enter only what you need, and only with a parent's or guardian's permission. If you believe we hold an account for a child, contact us at privacy@passagemaster.com.

12. Security

We use technical and organizational measures appropriate to the risk, including encryption in transit and least-privilege access. Synced boat records require you to be signed in, and access is limited to your account and boat. No method of transmission or storage is fully secure, and we cannot guarantee absolute security.

13. Changes

We may update this Privacy Policy. Material changes will be signaled in-app or by email before they take effect, and the "Last updated" date above will change.

14. Contact

Astramara, LLC — Mailing address maintained in company records and available upon legally required request.
Privacy: privacy@passagemaster.com