Privacy Policy

Who we are

WestMar LLC is a Florida limited liability company operated by Nicholas Mello, its sole owner and developer. WestMar builds and publishes native iOS applications, currently SteerJobs, Voyager: Cosmic Odometer, YourBPM, and ShiftJar.

For anything in this policy — questions, requests, or complaints — email nmello427@gmail.com. Messages go directly to the person who wrote the code.

What each app collects

WestMar apps do not share a common account system. Each app collects its own data for its own purpose, and that list is specific to the app you are using.

SteerJobs

SteerJobs is a business tool, not a personal one. It is bought by a construction company and used by that company's crew, and the company can see what its crew submits. That is the point of the product, and you should know it before you use it.

• Account information — the email address used to sign in, and the company you belong to.
• Job site photos — images you capture to document work phases. A company admin reviews and approves each phase, so admins see the photos crew members submit.
• Job documents and resumes — files uploaded to a job or a personnel record.
• Check-in location — GPS coordinates recorded at the moment you check in, used to confirm presence on a job site. Location is captured at check-in only. SteerJobs does not track your location in the background or between check-ins.
• Hours and work records — hours logged per user per job, phase status, and job progress. Company admins can see weekly hours per user per job.

All of it is stored in Supabase, in the United States (us-east-1). Photos, job documents, and resumes live in storage buckets scoped to a single company. Every database table enforces row-level security keyed on company ID, so visibility ends at the company boundary — one company can never see another company's data.

How long it is kept: job and photo records are retained for as long as the company's account is active, because a construction record is worth little if it disappears mid-project. There is no automatic purge. Data is deleted when you or your company asks, within 30 days of the request.

Voyager: Cosmic Odometer

Voyager calculates how fast you are moving through the universe. That math needs your latitude, because the Earth-rotation component of your speed depends on how far you are from the equator.

• Coarse latitude — requested once, at an accuracy of roughly three kilometres. Voyager asks for "when in use" location permission, takes a single reading, keeps only the latitude number, and discards the rest.

That latitude never leaves your phone. Voyager has no networking code of any kind — there is no server for it to send anything to. Decline the location prompt and the app still works; it falls back to a default latitude and every other feature behaves normally.

Voyager offers a one-time $2.99 Pro unlock through Apple's in-app purchase system. Apple processes the payment and tells the app whether you own it. WestMar never sees your payment details.

YourBPM

YourBPM has not been released. There is no public build, no server, and no user data. When it ships, this section will describe exactly what it reads — including any Apple Health access — and that description will be published here before the app is available to anyone.

ShiftJar

ShiftJar is a tip tracker for restaurant servers and bartenders. It has no account system, no login, and no WestMar server behind it.

• Shift records — tips, hours, tip-outs, job name, and any notes you add. Entered by you, stored on your device.

If you are signed into iCloud, shift records sync through Apple's CloudKit to your private iCloud database — the part of iCloud only your Apple ID can reach. WestMar cannot see, query, or retrieve it; Apple's infrastructure moves it between your own devices. With iCloud off, ShiftJar stores everything locally and works fully offline.

CSV export is user-initiated: the file is generated on your device and goes only where you choose to send it.

How long it is kept: as long as you keep it. Data lives on your device and in your iCloud, not with WestMar. Deleting the app removes its local data; iCloud copies can be removed from iOS Settings or within the app.

Because WestMar holds no ShiftJar data, there is nothing for WestMar to delete, correct, or export on your behalf — you already hold the only copy.

No analytics. No ads. No tracking.

This is worth stating flatly rather than burying in a list: no WestMar app contains an analytics SDK. No TelemetryDeck, no PostHog, no Firebase, no Amplitude, no Mixpanel, no Segment. No WestMar app contains an advertising SDK or an ad network of any kind. No app asks for App Tracking Transparency permission, because none of them track you.

There is no crash-reporting service beyond the anonymised crash reports Apple collects and shares with every developer. There is no attribution SDK, no session recording, and no behavioural profiling.

Each app's data stays isolated

WestMar apps do not talk to each other. There is no shared login, no shared profile, and no combined dataset across apps. SteerJobs and YourBPM run on entirely separate Supabase organisations and projects — not just separate tables, separate infrastructure. ShiftJar has no server-side footprint at all. Nothing collected in one app is used to build a picture of you across the others.

Deleting an app removes its on-device data. Data held on a server, where an app uses one, is removed on request as described below.

What is never done with your data

• Your data is never sold, to anyone, for any price.
• Your data is never shared with advertisers, ad networks, or data brokers.
• Your data is never used to train machine learning models.
• Your job site photos are never used for marketing, case studies, or App Store screenshots without your written permission.

These are not aspirations subject to a future policy update — they are the operating rules across every WestMar app.

Third-party services

A small number of outside services are involved in running and distributing the apps. Each one receives only what it needs to do its job.

• Apple — distributes the apps through the App Store and TestFlight and processes in-app purchases. Apple provides aggregate, anonymised download and crash statistics; it does not tell WestMar who individual users are. Apple's own privacy policy governs that data.
• TestFlight — used for beta distribution, currently for SteerJobs and ShiftJar. If you join a beta, Apple shares your email address with WestMar so the build can reach you, along with crash logs and any feedback you choose to submit.
• Apple iCloud (CloudKit) — syncs ShiftJar data between your devices through your Apple ID's private database. Apple hosts it under your account; WestMar has no access to its contents.
• Supabase — hosts the SteerJobs database and file storage in the United States (us-east-1). Supabase stores the data described in the SteerJobs section above and is contractually a data processor acting on WestMar's instructions.
• Stripe — processes SteerJobs subscription billing on the web. Stripe receives the billing contact and payment details of the person who subscribes on behalf of a company; WestMar receives a subscription status, never a card number. Crew members who simply use the app never touch Stripe.
• Apple Push Notification service — delivers SteerJobs job assignment and to-do notifications. Push goes through Apple's APNs directly, with no third-party push vendor in between.

Your rights

Wherever you live, you can ask WestMar to:

• Delete your data — have the data associated with your use of an app erased.
• Get a copy of your data — receive an export of what an app holds about you, in a readable format.
• Correct your data — fix anything inaccurate.

Email nmello427@gmail.com with the app name in the subject line. Requests are acknowledged within 5 business days and completed within 30 days. There is no charge, and you will not be asked to create an account or fill in a form to make a request.

One practical note for SteerJobs: because it is a company tool, some records — approved phase photos, logged hours on a closed job — belong to your employer's account rather than to you personally. If deleting them outright would gut your company's job history, WestMar will tell you plainly, remove what is genuinely yours, and put you in touch with your company admin for the rest.

For ShiftJar, these rights are self-serve by design: your records sit on your device and in your private iCloud, so deletion, export, and correction happen in the app itself, instantly, without asking anyone.

California privacy rights (CCPA/CPRA)

If you live in California, you have the right to know what personal information is collected about you, to request its deletion, to request correction, and to receive a copy in a portable format. Exercise any of them at nmello427@gmail.com.

The categories collected are listed app-by-app above: identifiers (email address), geolocation (SteerJobs check-in coordinates, Voyager's coarse latitude, which never leaves the device), visual information (job site photos and uploaded documents), professional information (hours and job records), and financial information (ShiftJar shift and tip records, which stay on your device and in your private iCloud and never reach WestMar's systems). They are collected to operate the apps, and for no other purpose.

WestMar does not sell personal information and does not share it for cross-context behavioural advertising. That has never happened and there is no mechanism in any app that could make it happen — there is no advertising SDK to send it to. Because nothing is sold or shared in that sense, there is no "Do Not Sell or Share My Personal Information" link to offer. You will never be discriminated against for exercising any of these rights; there is no worse tier of service to put you in.

UK and European privacy rights (GDPR)

If you are in the United Kingdom or the European Economic Area, WestMar LLC is the data controller for the data described in this policy.

Legal basis. SteerJobs data — account details, photos, check-in location, hours — is processed to perform the contract between WestMar and your company, and to provide the service you are using. Beta participation and any optional feedback rest on your consent, which you can withdraw at any time by leaving the beta. Voyager's latitude reading rests on your consent, given through the iOS permission prompt and revocable in Settings at any moment; the app is fully functional if you refuse. ShiftJar's records stay on your device and in your private iCloud; WestMar never receives them, so there is no WestMar processing to base.

Your rights. Access, rectification, erasure, restriction of processing, data portability, and the right to object to processing. Where processing rests on consent, you can withdraw it without affecting anything done before you did. Requests go to nmello427@gmail.com and are answered within 30 days.

Transfers. SteerJobs data is stored in the United States. Transfers out of the UK/EEA rely on the European Commission's Standard Contractual Clauses, which form part of WestMar's agreement with Supabase.

Complaints. You can lodge a complaint with your national data protection authority, or with the UK Information Commissioner's Office. Raising it with WestMar first is welcome but not required.

EU representative. WestMar has not appointed an Article 27 representative in the EU or UK. WestMar does not currently target or market its apps to users in those regions. If that changes, a representative will be appointed and named here before it does.

Children's privacy

No WestMar app is directed at children. SteerJobs is a tool for construction companies and their employed crew. ShiftJar is a workplace earnings tool for tipped workers. Voyager is a general-audience app with no social features, no chat, no user-to-user contact, and no user-generated content.

WestMar does not knowingly collect personal information from anyone under 13. No app participates in Apple's Kids Category. If you believe a child has provided personal information through a WestMar app, email nmello427@gmail.com and it will be deleted promptly.

Security

What is actually in place, stated without embellishment:

• All data in transit is encrypted with TLS.
• Data at rest in Supabase is encrypted using Supabase's platform encryption.
• ShiftJar data in iCloud is encrypted in transit and at rest under Apple's CloudKit security model, inside your personal Apple ID account.
• Row-level security policies keyed on company ID isolate each company's data at the database layer, so isolation does not depend on application code getting every query right.
• Exactly one person — Nicholas Mello — has administrative access to the backend.

What is deliberately not claimed: WestMar holds no SOC 2 certification, has not commissioned a third-party penetration test, and does not use end-to-end encryption. No system is perfectly secure. The most effective protection here is that very little is collected in the first place.

If a breach affects your data, you will be told by email, and the relevant regulators will be notified within the deadlines the law sets — 72 hours under GDPR, and whatever the applicable US state law requires.

Changes to this policy

When this policy changes, the "Last updated" date at the top of this page changes with it. Material changes — anything that meaningfully affects what is collected or how it is used — will additionally be announced through an in-app notice or an email to affected users before the change takes effect.

Previous versions are available on request. Continuing to use a WestMar app after a change takes effect means the revised policy applies to you.

Contact

Privacy questions, deletion requests, and data exports all go to the same place: