Privacy Policy

Who we are

Westmar LLC is a Florida limited liability company operated by Nicholas Mello and Jack Mello. Westmar builds and publishes native iOS applications, currently SteerJobs, Voyager: Cosmic Odometer, YourBPM, ShiftJar, PaverLab, and Davy Jones: The Abyss.

For anything in this policy — questions, requests, or complaints — email hello@westmardev.com. Messages go directly to the person who wrote the code.

What each app collects

Westmar apps do not share a common account system. Each app collects its own data for its own purpose, and that list is specific to the app you are using.

SteerJobs

SteerJobs is a business tool, not a personal one. It is bought by a construction company and used by that company's crew, and the company can see what its crew submits. That is the point of the product, and you should know it before you use it.

• Account information — the email address used to sign in, and the company you belong to.
• Job site photos — images you capture to document work phases. A company admin reviews and approves each phase, so admins see the photos crew members submit.
• Job documents and resumes — files uploaded to a job or a personnel record.
• Check-in location — GPS coordinates recorded at the moment you check in, used to confirm presence on a job site. Location is captured at check-in only. SteerJobs does not track your location in the background or between check-ins.
• Hours and work records — hours logged per user per job, phase status, and job progress. Company admins can see weekly hours per user per job.

All of it is stored in Supabase, in the United States (us-east-1). Photos, job documents, and resumes live in storage buckets scoped to a single company. Every database table enforces row-level security keyed on company ID, so visibility ends at the company boundary — one company can never see another company's data.

How long it is kept: job and photo records are retained for as long as the company's account is active, because a construction record is worth little if it disappears mid-project. There is no automatic purge. Data is deleted when you or your company asks, within 30 days of the request.

Voyager: Cosmic Odometer

Voyager calculates how fast you are moving through the universe. That math needs your latitude, because the Earth-rotation component of your speed depends on how far you are from the equator.

• Coarse latitude — requested once, at an accuracy of roughly three kilometres. Voyager asks for "when in use" location permission, takes a single reading, keeps only the latitude number, and discards the rest.

That latitude never leaves your phone. Voyager has no networking code of any kind — there is no server for it to send anything to. Decline the location prompt and the app still works; it falls back to a default latitude and every other feature behaves normally.

Voyager offers a one-time $2.99 Pro unlock through Apple's in-app purchase system. Apple processes the payment and tells the app whether you own it. Westmar never sees your payment details.

YourBPM

YourBPM has not been released. There is no public build, no server, and no user data. When it ships, this section will describe exactly what it reads — including any Apple Health access — and that description will be published here before the app is available to anyone.

ShiftJar

ShiftJar is a tip tracker for restaurant servers and bartenders. It is free, and a banner ad pays for it. It has no account system, no login, and no Westmar server behind it.

• Shift records — the date, tips and any cash or credit split, hours, tip-outs, hourly wage, section, job and role names, and any notes you add. Entered by you, stored on your device.

If you are signed into iCloud, shift records sync through Apple's CloudKit to your private iCloud database — the part of iCloud only your Apple ID can reach. Westmar cannot see, query, or retrieve it; Apple's infrastructure moves it between your own devices. With iCloud off, ShiftJar stores everything locally and works fully offline.

CSV export is user-initiated: the file is generated on your device and goes only where you choose to send it.

How long it is kept: as long as you keep it. Data lives on your device and in your iCloud, not with Westmar. Deleting the app removes its local data; iCloud copies can be removed from iOS Settings or within the app.

Because Westmar holds none of your shift records, there is nothing for Westmar to delete, correct, or export on your behalf — you already hold the only copy.

Advertising. ShiftJar shows one banner ad at the top of the Dashboard and History screens, and nowhere else. The ads come from Google AdMob through Google's Mobile Ads SDK, which is built into the app. According to Google's published disclosure, to choose, show, and measure those ads its SDK may collect the following from your device and send it to Google:

• Device identifiers — your device's advertising identifier, if you allow tracking (see below), or other identifiers limited to this app or developer.
• IP address and approximate location — your IP address, which Google may use to estimate a general area. ShiftJar never asks for location permission and never reads GPS.
• Advertising data — such as which ads you have been shown.
• Product interaction — such as app launches and taps.
• Diagnostics — crash logs, performance data such as launch time, hang rate, and energy use, and other diagnostic data.

Google uses this data for advertising, analytics, and diagnosing its SDK, under its own privacy policy and not on Westmar's instructions. The ads themselves can come from other advertising companies that buy through Google, and Google says it may use the device identifier for third-party advertising and analytics and may share performance data with other companies that display ads. How Google uses information from sites or apps that use its services explains what Google does with it, and Google's Ad Settings covers ad personalisation tied to a Google account or browser. Westmar holds none of this data. Westmar's AdMob account reports totals, such as how many ads were shown and what they earned; it does not tell Westmar who you are.

Your shift records are not part of this. ShiftJar does not send your tips, hours, wages, job names, or notes to Google, and does not pass them to the ad SDK.

Tracking permission. The first time you open ShiftJar, iOS asks whether to let the app track your activity across other companies' apps and websites. If you allow it, Google can use your device's advertising identifier to show you personalised ads and to measure them across apps. If you choose "Ask App Not to Track", iOS withholds that identifier and you still see ads, without it. ShiftJar works exactly the same either way, and you can change your answer at any time in iOS Settings → Privacy & Security → Tracking. If tracking requests are switched off or restricted on your device, iOS does not ask and treats that as a no. Your answer decides only whether Google receives the advertising identifier; the other collection listed above happens whenever ads load.

Where it is offered. ShiftJar's App Store release is for the United States only.

PaverLab

PaverLab is a paver-installation training app — guided lessons, labs that grade a design against spec, and a freeform pattern sandbox. It is bought once, through the App Store. It has no account system, no login, and no Westmar server behind it.

• Lesson progress — which lessons you have opened and completed, how far you got in each, and your knowledge-check scores. Stored in a local database on your device.
• Lab and Sandbox inputs — the dimensions, materials, and layouts you enter to check a design. They stay on your device.

None of it leaves your phone. PaverLab has no networking code of any kind and does not use iCloud — there is no server for it to send anything to and no sync between devices. It works fully offline.

Apple processes the purchase. Westmar never sees your payment details.

How long it is kept: as long as the app is installed. Deleting the app removes it.

Because Westmar holds no PaverLab data, there is nothing for Westmar to delete, correct, or export on your behalf — you already hold the only copy.

Davy Jones: The Abyss

Davy Jones: The Abyss is an open-world pirate game. It is bought once, through the App Store, with no ads and no in-app purchases. It has no account system, no login, and no Westmar server behind it.

• Saved games — your voyage and your game settings. Stored on your device.

Westmar collects no data from Davy Jones: The Abyss. The game has no analytics, no advertising, no tracking, and no third-party SDKs, and it sends nothing to Westmar.

If you are signed into iCloud, your saved voyage is also kept in iCloud, so it follows you to your other devices and comes back if you reinstall. Apple stores it in your Apple Account under Apple's privacy policy; Westmar cannot see or retrieve it.

If you are signed into Game Center, the game reports your achievements and leaderboard scores to it. Game Center is Apple's service, and Apple's privacy policy governs it. The game has no chat and no other way to contact other players.

Apple processes the purchase. Westmar never sees your payment details.

How long it is kept: as long as you keep it. Deleting the app removes the saves on your device. Starting a new game erases your saved voyage, including the copy in iCloud.

Because Westmar holds no Davy Jones: The Abyss data, there is nothing for Westmar to delete, correct, or export on your behalf — you already hold the only copy.

Analytics, ads, and tracking

This is worth stating flatly rather than burying in a list: one Westmar app shows ads, and that app is ShiftJar. It contains Google's Mobile Ads SDK and asks for App Tracking Transparency permission, as its section above describes. No other Westmar app contains an advertising SDK or an ad network of any kind, and no other app asks for tracking permission.

No Westmar app contains a separate analytics SDK. No TelemetryDeck, no PostHog, no Firebase, no Amplitude, no Mixpanel, no Segment. In ShiftJar, Google's ad SDK collects the usage and diagnostic data listed above for Google's own advertising and analytics; Westmar sees none of it beyond the ad totals its AdMob account reports.

There is no crash-reporting service beyond the anonymised crash reports Apple collects and shares with every developer and, in ShiftJar, the crash logs Google's ad SDK collects for itself. Apart from Google's ad SDK in ShiftJar, which measures and personalises ads as described above, no Westmar app contains an attribution SDK, session recording, or behavioural profiling.

Each app's data stays isolated

Westmar apps do not talk to each other. There is no shared login, no shared profile, and no combined dataset across apps. SteerJobs and YourBPM run on entirely separate Supabase organisations and projects — not just separate tables, separate infrastructure. ShiftJar, PaverLab, and Davy Jones: The Abyss have no Westmar server behind them at all. Westmar uses nothing collected in one app to build a picture of you across the others.

Deleting an app removes its on-device data. Data held on a server, where an app uses one, is removed on request as described below.

What is never done with your data

• What you put into a Westmar app, and what Westmar holds about you — shift and tip records, job site photos, documents, hours, check-in locations, your sign-in email, lesson progress, saved games — is never sold, to anyone, for any price.
• It is never shared with advertisers, ad networks, or data brokers. The only data that reaches Google or its advertising partners from any Westmar app is the device, ad, and diagnostic data Google's SDK collects in ShiftJar, described in the ShiftJar section above.
• Westmar never uses your data to train machine learning models.
• Your job site photos are never used for marketing, case studies, or App Store screenshots without your written permission.

These are the operating rules across every Westmar app.

Third-party services

A small number of outside services are involved in running and distributing the apps. Each one receives only what it needs to do its job, except Google AdMob, whose SDK decides what it collects (listed in the ShiftJar section).

• Apple — distributes the apps through the App Store and TestFlight and processes app purchases and in-app purchases. Apple provides aggregate, anonymised download and crash statistics; it does not tell Westmar who individual users are. Apple's own privacy policy governs that data.
• TestFlight — used for beta distribution, currently for SteerJobs and ShiftJar. If you join a beta, Apple shares your email address with Westmar so the build can reach you, along with crash logs and any feedback you choose to submit.
• Apple iCloud (CloudKit) — syncs ShiftJar data between your devices through your Apple ID's private database. Apple hosts it under your account; Westmar has no access to its contents.
• Apple iCloud (key-value storage) — keeps your Davy Jones: The Abyss saved voyage in your Apple Account so it follows you between devices. Apple hosts it under your account; Westmar has no access to its contents.
• Apple Game Center — receives Davy Jones: The Abyss achievements and leaderboard scores when you are signed into Game Center. Apple runs it under Apple's own privacy policy.
• Google AdMob — serves the banner ads in ShiftJar. Google's Mobile Ads SDK collects the device, ad, and diagnostic data described in the ShiftJar section and sends it to Google, which handles it under its own privacy policy rather than on Westmar's instructions. No other Westmar app uses it.
• Supabase — hosts the SteerJobs database and file storage in the United States (us-east-1). Supabase stores the data described in the SteerJobs section above and is contractually a data processor acting on Westmar's instructions.
• Stripe — processes SteerJobs subscription billing on the web. Stripe receives the billing contact and payment details of the person who subscribes on behalf of a company; Westmar receives a subscription status, never a card number. Crew members who simply use the app never touch Stripe.
• Apple Push Notification service — delivers SteerJobs job assignment and to-do notifications. Push goes through Apple's APNs directly, with no third-party push vendor in between.

Your rights

Wherever you live, you can ask Westmar to:

• Delete your data — have the data associated with your use of an app erased.
• Get a copy of your data — receive an export of what an app holds about you, in a readable format.
• Correct your data — fix anything inaccurate.

Email hello@westmardev.com with the app name in the subject line. Requests are acknowledged within 5 business days and completed within 30 days. There is no charge, and you will not be asked to create an account or fill in a form to make a request.

One practical note for SteerJobs: because it is a company tool, some records — approved phase photos, logged hours on a closed job — belong to your employer's account rather than to you personally. If deleting them outright would gut your company's job history, Westmar will tell you plainly, remove what is genuinely yours, and put you in touch with your company admin for the rest.

For ShiftJar, these rights are self-serve by design: your records sit on your device and in your private iCloud, so deletion, export, and correction happen in the app itself, instantly, without asking anyone. The same goes for PaverLab: its only record is your lesson progress, which sits on your device and nowhere else, and deleting the app is the deletion. Davy Jones: The Abyss works the same way: its saves sit on your device and in your iCloud, and starting a new game erases them.

One exception to self-serve: the ad data Google collects through ShiftJar is held by Google, not Westmar. The iOS tracking setting decides whether Google receives your advertising identifier; it does not stop the other collection listed in the ShiftJar section, which happens whenever ads load. Requests to see or delete that data go to Google under its privacy policy.

California privacy rights (CCPA/CPRA)

If you live in California, you have the right to know what personal information is collected about you, to request its deletion, to request correction, and to receive a copy in a portable format. Exercise any of them at hello@westmardev.com.

The categories collected are listed app-by-app above: identifiers (email address; in ShiftJar, your IP address and the device identifiers Google's ad SDK collects), geolocation (SteerJobs check-in coordinates; Voyager's coarse latitude, which never leaves the device; in ShiftJar, the general area Google estimates from your IP address), internet or other network activity (in ShiftJar, the ads you are shown and how you interact with them, collected by Google's ad SDK), visual information (job site photos and uploaded documents), professional information (hours and job records), and financial information (ShiftJar shift and tip records, which stay on your device and in your private iCloud and never reach Westmar's systems). Westmar collects them only to operate the apps. In ShiftJar, Google collects the ad data described above and uses it for its own advertising, analytics, and SDK diagnostics.

Westmar does not sell personal information for money. ShiftJar's ads are the one place California's broader definitions come into play: if you allow tracking at the iOS prompt, Google can use your device's advertising identifier to show you ads based on your activity in other companies' apps and websites, and California law can treat that as "sharing" personal information for cross-context behavioural advertising, or as a "sale". Turning off tracking for ShiftJar in iOS Settings → Privacy & Security → Tracking, or choosing "Ask App Not to Track" when the app first asks, withholds your advertising identifier, which ends that cross-app use. The other ad data described in the ShiftJar section still goes to Google while ads load. ShiftJar works the same either way. Outside ShiftJar's ads, no Westmar app sells or shares personal information in that sense. You will never be discriminated against for exercising any of these rights; there is no worse tier of service to put you in.

UK and European privacy rights (GDPR)

If you are in the United Kingdom or the European Economic Area, Westmar LLC is the data controller for the data Westmar holds. The ad data collected in ShiftJar is handled by Google, as the ShiftJar section describes.

Legal basis. SteerJobs data — account details, photos, check-in location, hours — is processed to perform the contract between Westmar and your company, and to provide the service you are using. Beta participation and any optional feedback rest on your consent, which you can withdraw at any time by leaving the beta. Voyager's latitude reading rests on your consent, given through the iOS permission prompt and revocable in Settings at any moment; the app is fully functional if you refuse. ShiftJar's records stay on your device and in your private iCloud, PaverLab's lesson progress stays on your device, and Davy Jones: The Abyss saves stay on your device and in your iCloud; Westmar never receives any of them, so there is no Westmar processing to base. ShiftJar's ads are served by Google AdMob; ShiftJar's App Store release is limited to the United States, and it is not intended for use in the UK or EEA.

Your rights. Access, rectification, erasure, restriction of processing, data portability, and the right to object to processing. Where processing rests on consent, you can withdraw it without affecting anything done before you did. Requests go to hello@westmardev.com and are answered within 30 days.

Transfers. SteerJobs data is stored in the United States. Transfers out of the UK/EEA rely on the European Commission's Standard Contractual Clauses, which form part of Westmar's agreement with Supabase.

Complaints. You can lodge a complaint with your national data protection authority, or with the UK Information Commissioner's Office. Raising it with Westmar first is welcome but not required.

EU representative. Westmar has not appointed an Article 27 representative in the EU or UK. Westmar does not currently target or market its apps to users in those regions. If that changes, a representative will be appointed and named here before it does.

Children's privacy

No Westmar app is directed at children. SteerJobs is a tool for construction companies and their employed crew. ShiftJar is a workplace earnings tool for tipped workers; it shows advertising and is not intended for children. Voyager is a general-audience app with no social features, no chat, no user-to-user contact, and no user-generated content. PaverLab is a training app for the hardscape trade, with no social features, no chat, and no user-to-user contact. Davy Jones: The Abyss is a game rated 13+ on the App Store, with no accounts, no chat, no user-to-user contact, and no user-generated content.

Westmar does not knowingly collect personal information from anyone under 13. No app participates in Apple's Kids Category. If you believe a child has provided personal information through a Westmar app, email hello@westmardev.com and it will be deleted promptly.

Security

What is actually in place, stated without embellishment:

• All data in transit is encrypted with TLS.
• Data at rest in Supabase is encrypted using Supabase's platform encryption.
• ShiftJar data in iCloud is encrypted in transit and at rest under Apple's CloudKit security model, inside your personal Apple ID account.
• Davy Jones: The Abyss saves in iCloud sit inside your personal Apple Account, under Apple's iCloud security model.
• Row-level security policies keyed on company ID isolate each company's data at the database layer, so isolation does not depend on application code getting every query right.
• Exactly one person — Nicholas Mello — has administrative access to the backend.

What is deliberately not claimed: Westmar holds no SOC 2 certification, has not commissioned a third-party penetration test, and does not use end-to-end encryption. No system is perfectly secure. The most effective protection here is that Westmar itself collects very little in the first place.

If a breach affects your data, you will be told by email, and the relevant regulators will be notified within the deadlines the law sets — 72 hours under GDPR, and whatever the applicable US state law requires.

Changes to this policy

When this policy changes, the "Last updated" date at the top of this page changes with it. Material changes — anything that meaningfully affects what is collected or how it is used — will additionally be announced through an in-app notice or an email to affected users before the change takes effect.

Previous versions are available on request. Continuing to use a Westmar app after a change takes effect means the revised policy applies to you.

10 October 2026. ShiftJar now shows banner ads from Google AdMob and asks for iOS tracking permission, starting with version 1.0, build 7. Earlier versions of this policy said that no Westmar app contained an advertising SDK or asked for tracking permission, and that no data went to ad networks. That is no longer true for ShiftJar, and the sections above now say so. Nothing has changed for any other app.

Contact

Privacy questions, deletion requests, and data exports all go to the same place:

Westmar LLC Attn: Nicholas Mello
506 Park Dr.
Bradenton, FL 34209
United States
hello@westmardev.com