Privacy policy
ShipOfficer is a ship officer's personal logbook. This page says which data the app keeps, where it is kept, who can see it, how long it stays and how you delete it.
1. Who is responsible
The data controller is Ali Oktay, publishing as Z-Deck (zdeck.tech), as an individual. Contact: info@zdeck.tech.
2. What the app stores
Only what you type. There is no analytics, advertising or tracking library in the app, and the app does not read your contacts, location, camera or photos.
| Data | Why | Where it comes from |
|---|---|---|
| Account: e-mail, name, password (stored only as a hash) | Signing in; identifying your logbook | You, at sign-up |
| Logbook entries: ship particulars, crew list lines (names, ranks, nationality, dates, passport and seaman's book numbers), port calls, stores and spares, medicines, cargo lines, persons on board, cash and temperature declarations, last ports of call | Keeping your logbook; producing the port document workbook you ask for | You, entry by entry |
| Device label and last-use time of each sign-in token | Ending a session on a lost phone; expiring unused sessions after 30 days | The app, when you sign in |
| IP address and e-mail of sign-in attempts | Rate limiting and lock-out against password guessing | The server, for two hours |
| Server access logs (IP address, path, time) | Operating and securing the service | The web server; size-limited rotating files |
Crew members' data. When you enter another person's name or document number into your logbook, you are the one deciding to record it. Do this only for the crew list you are responsible for on board, and only what the port documents require.
3. Where it is kept
On a single server rented from Hostinger in Manchester, United Kingdom. The connection between the app and the server is encrypted (HTTPS). Your logbook lives in its own isolated tenant on the database; row-level security keeps every account's data separate.
The United Kingdom holds an EU adequacy decision (renewed to 27 December 2031). For users and data subjects in Türkiye, storage abroad is a transfer under Article 9 of the KVKK; the legal basis for that transfer is being confirmed with counsel and will be stated here.
4. Who can see it
- You, in the app, and nobody else through the app.
- The operator (the controller above) has technical access to the server for maintenance and backups, and does not read logbooks.
- Processors: Hostinger (server hosting, UK); Sentry (error monitoring; events carry no personal data, request bodies or cookies); Apple and Google (app distribution, under their own terms).
- No data is sold, shared for advertising, or given to shipping companies. ShipOfficer is separate from MarOps; a company cannot see your personal logbook.
5. How long it stays
- Your logbook: until you delete the account.
- Sign-in attempts: two hours. Unused sign-in tokens: 30 days, then they expire.
- Backups: a daily copy is kept for 14 days on the server and for 30 days on the operator's office machine, with restricted access. Deleted data can therefore remain in a backup for up to 30 days and is never restored into a live account.
6. Deleting your account
In the app: Me → Close account → Delete account, confirm with your password. Deletion is immediate: every logbook entry is physically deleted, all sign-in tokens are removed, and your name and e-mail are erased from the account record. An audit line stating only the date and the number of entries deleted is kept; it contains no personal data. The same e-mail can open a new logbook later; the old one does not come back.
Without the app: see the account deletion page.
7. Your rights
You may ask what is held about you, correct it (every entry is editable in the app), delete it, or object to processing. Write to info@zdeck.tech from the e-mail address of your account. You may also complain to the supervisory authority: the Personal Data Protection Board (KVKK) in Türkiye, or the data protection authority of your EU country.
8. Security
- Passwords are stored as salted hashes; sign-in tokens are stored as SHA-256 digests and cannot be read back.
- Every request is bound to your tenant; another account's data is not reachable, and this is covered by automated tests.
- Password guessing is slowed and locked per e-mail and address.
9. Who the app is for
Professional seafarers, 18 or older. The app is not intended for children.
10. Changes
Changes are dated on this page. Version: draft 1, 13 September 2026.