Mundi Equity Group Ltd. ("we," "us," or "our") operates the DockBook application (the "Service"). This Privacy Policy explains what information we collect, how we use it, and your choices regarding your information when you use our Service.
1. Information We Collect
To provide and improve DockBook, we collect and store the following information:
Account Information
Your email address is required for account creation, authentication, and password resets. This is managed securely through Firebase Authentication.
User Profile Data
Information you provide during setup, such as your name, union local, board, role, and classification. This is used to accurately calculate pay rates and configure the app experience for your specific workplace organization.
Shift Data
All shift details you enter, including dates, times, job types, locations, vessels, notes, dispatch slip photos, and earnings calculations. This is the primary data the app uses to function. Your personal shift data is encrypted at rest and in transit, and we do not have access to your individual shift information.
Dispatch Slip Samples (Optional)
If your local's dispatch slip layout is not yet supported by our scanner, you can choose to send us photos of your slip so we can add support for it. These photos are sent to DockBook and are readable by DockBook staff, unlike the per-shift dispatch slip photos described above under Shift Data. They typically show your name and registration or man number. We use them only to map your local's slip layout, we do not use them for any other purpose, and we delete them once your local is supported. Sending a sample is entirely optional and no feature depends on it.
Vessel Intelligence Content
Photos and text insights you contribute to the Vessel Intelligence community feature, including equipment notes, operational tips, and vessel-specific information. This content is attributed to your chosen handle or username and is visible to other DockBook users.
Financial Information
Earnings data from your shifts, including salary, income, pay calculations, vacation pay accruals, and retirement projections. Individual earnings are used for your personal analytics and are never shared in identifiable form. Only anonymized, aggregated data is used for community features like Live Board Averages.
Subscription Status
Your premium subscription status (e.g., Pro or Trial) is managed through RevenueCat to enable Pro features. We do not store or have access to your payment information. All payment processing is handled by the Apple App Store or Google Play Store.
Identifiers
Firebase User ID and RevenueCat Customer ID, used to link your data across your devices, manage your account, and enable cloud synchronization.
Anonymous Usage and Performance Data (Optional)
If you provide consent, we collect non-personal, anonymous data about how you interact with the app and crash reports:
- Firebase Analytics: App launches, feature usage, interaction patterns, and session duration
- PostHog Product Analytics: Same usage events plus session replay (with input fields masked); see Section 3 for full disclosure
- Firebase Crashlytics: Crash logs and performance metrics to improve app stability
This data is collected to help us understand which features are used most, prioritize new features, and fix bugs. This is optional and can be controlled in the app's Settings.
2. How We Use Your Information
Your information is used exclusively to:
- Provide, maintain, and improve the app's features
- Authenticate your account and secure your data
- Enable cloud synchronization of your data across your devices
- Process in-app subscriptions through our provider, RevenueCat
- Calculate accurate pay rates based on your workplace organization's collective agreement
- Provide anonymized, aggregated data for features like "Live Board Averages" (your personal shift data is never shared in identifiable form)
- Publish aggregate, non-identifying statistics about app usage, such as total shifts logged, total earnings tracked across all users, total hours logged, or the number of workers using DockBook, for marketing and transparency purposes. These statistics are computed by combining data across all users and never disclose any individual's identity, earnings, or activity.
- (If consent is given) Analyze anonymous usage patterns to improve the app and prioritize feature development
- Send account-related emails (verification, password resets) through Resend
3. Data Sharing & Third Parties
We do not sell or rent your personal data, and we do not disclose it to third parties for their own marketing purposes. We use service providers in the categories below to operate the Service. Our current providers are named here. If we add a provider in the same category that receives the same data for the same purpose, we will update this list at least 14 days beforehand without changing the terms you accepted. A provider receiving a new type of data, or serving a new purpose, is a material change and we will ask you to accept an updated policy.
- Firebase (Google): Database hosting, authentication, analytics (with consent), crash reporting, and cloud storage. Firebase's security protocols protect your data from unauthorized access.
- RevenueCat: Manages App Store and Google Play Store subscription status. RevenueCat does not have access to your payment information, only your subscription status.
- Resend: Sends account verification and password reset emails. Resend only receives your email address when triggered by account actions.
- PostHog: Product analytics: receives pseudonymous usage events (taps, screens viewed, feature usage), your Firebase user ID, and de-identified profile fields (role, classification, union local, board, Pro status). PostHog does not receive your name, email, paystub data, individual shift earnings, or any other personally identifying information. Used to understand how the app is used so we can improve it. PostHog also enables session replay (a video-like recording of in-app interactions) with all input fields automatically masked.
- Meta (Facebook): When you consent to analytics, we share subscription conversion events (e.g. trial start, purchase) with Meta to measure advertising effectiveness. On iOS, what we send depends on your answer to Apple's App Tracking Transparency prompt. If you allow tracking, the event includes the conversion type and amount, your hashed (irreversible) email and account identifier, and any Meta click identifier from the link that brought you to the app. If you decline tracking, we send a stripped version containing no information identifying you: no email (hashed or otherwise), no account identifier, and no click identifier. It carries only the type of conversion, when it happened, its amount, your app and device version, and a flag telling Meta you opted out. We set Meta’s limited-data-use flag on these events, which under Meta’s published terms restricts them to aggregated measurement rather than to identifying or targeting you individually. Meta never receives your name, paystub data, individual shift earnings, or your readable email. If you decline analytics consent, nothing is sent to Meta at all.
- VesselFinder: The Live Position map on a vessel's profile is embedded from VesselFinder, a third-party AIS vessel-tracking service. When you open that map, your device loads content directly from VesselFinder's servers, which receive your device's IP address, basic technical details your browser sends (such as device and browser type), and the vessel identifier (IMO number) you are viewing. VesselFinder does not receive your name, email, account identifier, shift data, or earnings. Because the map is part of the feature itself rather than analytics, it loads whenever you open a vessel's Live Position, regardless of your analytics settings. This embedded map is governed by VesselFinder's own privacy policy and terms of use.
- Apple App Store / Google Play Store: Process subscription payments. We never receive or store your payment information.
Our contracted service providers are obligated to protect your data and use it only for the purposes we specify. VesselFinder is not a contracted processor; its embedded map is an independent service governed by VesselFinder's own terms.
We may also disclose personal information without your consent where the law allows or requires it: to comply with a subpoena, warrant, court order, or other lawful request; to enforce our Terms of Service; to detect, prevent, or respond to fraud, security, or technical issues; or to protect the rights, property, or safety of our users, the public, or us. If we are involved in a merger, acquisition, financing, or sale of all or part of our business, personal information may be transferred as part of that transaction, and we will give you notice before it becomes subject to a different privacy policy.
4. Data Security
We prioritize the security of your information and use industry-standard security measures:
- Data encryption in transit (HTTPS/TLS)
- Data encryption at rest (Firebase security)
- Firebase Security Rules to prevent unauthorized access
- Regular security audits and updates
- Secure authentication through Firebase Auth
However, no method of transmission over the internet or electronic storage is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.
5. Data Retention
- Active Accounts: We retain your shift data and profile information for as long as your account is active and you continue to use the Service.
- Deleted Accounts: If you delete your account, all personal data (email, profile, shift data, vessel contributions) is permanently deleted from our systems within 30 days.
- Analytics Data: De-identified analytics data is retained for up to 26 months to understand long-term usage trends. Some of it is pseudonymous rather than anonymous, meaning it is keyed to an account identifier rather than to your name or email. Aggregated data cannot be linked back to you.
- Backup Data: Backup copies of deleted data may persist in our backup systems for up to 90 days before being permanently purged.
6. Your Rights & Data Control
You have the following rights regarding your data:
- Access: You can view and edit your profile information at any time within the app.
- Deletion: You have the right to delete your account and all associated data, including your email, profile, shift history, and vessel and equipment notes. In the app, open the side menu, tap Edit on your profile, and select Delete Account in the Danger Zone, then confirm with your password. You can also email support@dockbook.ca to request deletion. Deletion is permanent and cannot be undone. Your data is removed within 30 days, and backup copies within 90 days.
- Portability: You can export your shift data at any time through the Reports feature.
- Consent Withdrawal: You can disable analytics collection at any time in Settings → Privacy.
- Correction: You can update or correct your profile information and shift data at any time within the app.
7. Children's Privacy
DockBook is not intended for use by anyone under the age of 18. We do not knowingly collect personal information from children under 18. If you are a parent or guardian and believe your child has provided us with personal information, please contact us at support@dockbook.ca, and we will delete such information from our systems.
8. California Privacy Rights (CCPA)
If you are a California resident, you have the right to:
- Request information about the categories and specific pieces of personal information we have collected about you
- Request deletion of your personal information
- Opt-out of the sale of your personal information (note: we do not sell personal information)
To exercise these rights, contact support@dockbook.ca. We will verify your identity before processing your request.
9. International Users
DockBook serves longshore workers in Canada and the United States. Your account and app data are stored and processed in the United States. Our database and application servers are operated by Google Cloud Platform in the United States, and the third-party providers listed in Section 3 may process data in the United States or other countries. We remain accountable for your information under Canadian privacy law wherever it is processed, and we require our providers to protect it to a comparable standard. By using the Service you consent to this cross-border transfer and processing for the purposes described in this policy.
10. Changes to This Policy
We may update our Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of any material changes by:
- Updating the "Last Updated" date at the top of this policy
- Posting a notice within the app
- Sending an email to your registered email address (for significant changes)
Your continued use of the Service after changes are posted constitutes your acceptance of the revised Privacy Policy. We encourage you to review this policy periodically.
11. Do Not Track
Some browsers include a "Do Not Track" (DNT) feature that signals to websites you visit that you do not want to have your online activity tracked. DockBook does not currently respond to DNT signals because we only collect data necessary for app functionality and, when consented to, anonymous analytics that cannot identify you.
Accountability. A designated privacy contact at Mundi Equity Group Ltd. is responsible for our compliance with this policy and with applicable privacy law. Reach them at support@dockbook.ca.
Breach notification. If a breach of security safeguards creates a real risk of significant harm to you, we will report it to the Office of the Privacy Commissioner of Canada and notify you as soon as feasible, as required by PIPEDA.
12. Contact Us
For questions about this Privacy Policy, to exercise your data rights, or for any privacy-related concerns:
- Email: support@dockbook.ca
- Mail: Mundi Equity Group Ltd.
- 1100-225 6 Ave SW
Brookfield Place
Calgary, Alberta T2P 1N2
Canada
We will respond to privacy inquiries within 30 days.