Privacy Policy - Obedio Mobile

Effective Date: June 15, 2026

Last Updated: October 1, 2026

Introduction

Branko Blagojević PR Obedio ("Obedio," "we," "us," or "our"), a sole proprietorship registered in the Republic of Serbia (APR registration no. 68322260, tax ID 115381541), operates the Obedio mobile applications for iOS and Android (collectively, the "Apps"). The Apps are professional yacht-crew communication software designed for crew members to receive and respond to guest service requests, exchange text and voice messages, manage on-duty status, and provision smart buttons over Bluetooth.

This Privacy Policy explains what information we collect, why we collect it, how we use it, who we share it with, and your rights regarding your data.

1. Data We Collect

1.1 Account & Authentication

What: Username and password
Why: To authenticate you to the Obedio backend and create a secure session
How Collected: You provide these at login
Recipient: Obedio backend (your yacht operator's server - on the vessel's local network or a dedicated cloud server)
Storage on Device: Login credentials (JWT tokens + refresh tokens) are encrypted on-device:

iOS: Stored in Keychain
Android: Stored in DataStore via Android Keystore

1.2 Crew Identity

What: Crew member ID, display name, role
Why: To identify you in the system, route messages to you, and display crew roster
How Collected: Provided during crew provisioning or imported from backend
Recipient: Obedio backend; transmitted over WebSocket for real-time operations

1.3 Device Identifiers

What:

iOS: Identifier for Vendor (IDFV), transmitted as ios-phone-<IDFV>, plus device name, model, and OS version
Android: Device ID

Why: To associate your device with your account, enable push notifications, and distinguish devices in multi-device scenarios
How Collected: Automatically read from device OS at first registration
Recipient: Obedio backend

1.4 Push Notification Tokens

What:

iOS: Apple Push Notification service (APNs) token
Android: Google Firebase Cloud Messaging (FCM) token

Why: To deliver incoming service requests and crew messages to you in real-time
How Collected: Automatically generated by Apple / Google and shared with Obedio backend
Recipient:

iOS: Apple and Obedio backend
Android: Google Firebase and Obedio backend

1.5 Location

What: None. The Apps do not read, store, or transmit your device's location.
Weather widget: The crew dashboard weather widget uses the vessel's coordinates, which are

supplied by your yacht operator's Obedio backend. Those vessel coordinates are sent to Open-Meteo to retrieve the forecast. They describe the yacht, not your device or your personal whereabouts. If the vessel has no coordinates configured, the widget is simply not shown.

Android permission note: ACCESS_FINE_LOCATION is declared solely because Android 11 and

earlier require a location permission before the operating system will return Bluetooth LE scan results, which the app needs in order to pair Obedio smart buttons. On Android 12 and later the app uses BLUETOOTH_SCAN with the neverForLocation flag. No location value is derived from this permission, and none is transmitted.

iOS: Does not collect or transmit location data.

1.6 Microphone & Voice Data

What: Audio of voice messages you record. The Apps do not offer live voice calls.
Why: To deliver recorded voice messages and spoken service requests to the crew
How Collected: Only while you are actively recording a voice message
Recipient: Obedio backend

1.7 Text Messages & Chat Content

What: Text content of crew-to-crew and crew-to-system messages
Why: To deliver messages and maintain crew communication logs
How Collected: You compose and send
Recipient: Obedio backend

1.8 Photos & Files

What: Images and files you upload (crew photos, guest reference images, etc.)
Why: To display guest information, crew roster photos, and shared reference materials
How Collected: You select and upload via the app
Recipient: Obedio backend

1.9 Guest Information (Received from Backend)

What: Guest name, preferred name, photo, cabin assignment, status, and dietary restrictions, allergies, and medical notes
Why: To provide crew with service context and ensure guest safety (e.g., allergy awareness)
How Collected: Retrieved from the yacht management system and transmitted to your device for display
Recipient: Displayed on your device for in-app context; this information includes special-category health data and is used solely for crew service operations
On-Device Retention: Transient - not persisted long-term to device storage; cleared on logout or app termination

2. Third-Party Data Processors

We rely on the following third-party service providers:

Service	Purpose	Data Shared	Region
Open-Meteo	Weather forecast for the vessel	Vessel coordinates supplied by the operator's backend - not device location	EU-based
Google Firebase Cloud Messaging	Push notification delivery (Android)	FCM token; notification content	Google Cloud
Apple Push Notification Service	Push notification delivery (iOS)	APNs token; notification content	Apple

Obedio Backend: Self-hosted on the yacht's local area network (LAN) or a dedicated cloud server operated by/for the yacht operator. This is first-party infrastructure operated by Obedio and/or the yacht operator.

3. Security & Encryption

In Transit: All communications between the app and backend use HTTPS/WSS with TLS 1.2 or higher.
At Rest (Device): Authentication tokens (JWT, refresh tokens) are encrypted using device-native secure storage:

iOS: Keychain encryption
Android: DataStore encryption via Android Keystore

Non-Sensitive Data: Crew ID, display name, and other non-authentication data may be stored in app preferences in plain text for performance (e.g., to avoid repeated lookups).

Note: We do not use third-party crash reporting or analytics SDKs. iOS does not use Firebase SDK (a GoogleService-Info.plist configuration file may exist but Firebase Analytics is not linked).

4. Data Retention & Deletion

On Device: Credentials and crew identity data persist until you sign out or unpair the device.
On Backend: The authoritative copy of all data is retained on the Obedio backend according to the yacht operator's data governance policy.
Deletion: To delete your account and associated data:

Unpair your device via the app (clears local credentials)
Request account deletion via the Obedio backend administrator or contact info@obedio.de
The yacht operator may retain operational logs as required by maritime regulations or internal policy

5. Children

The Obedio Apps are not directed to, marketed to, or intended for use by children under 13 (or the applicable age of digital consent in your jurisdiction). If you believe a child has provided information through the app, contact us immediately at info@obedio.de.

6. Your Privacy Rights

6.1 GDPR (European Users)

If you are located in the European Union or United Kingdom:

Access: You have the right to request a copy of personal data we hold about you
Correction: You may request correction of inaccurate data
Erasure: You may request deletion ("right to be forgotten"), subject to operational and regulatory retention requirements
Portability: You may request your data in a portable format
Objection: You may object to processing of your data

6.2 CCPA (California Users)

If you are a California resident:

Access: You have the right to know what personal information we collect and how it is used
Deletion: You may request deletion of personal information (subject to exceptions for necessary business operations)
Opt-Out: You may opt out of any "sale" or "sharing" of personal information for cross-context behavioral advertising (Obedio does not engage in such practices)
Non-Discrimination: We will not discriminate against you for exercising your CCPA rights

6.3 General

To exercise any of these rights, contact: info@obedio.de

We will respond to verified requests within 30 days (45 days for GDPR if necessary).

7. Special-Category Health Data

Guest dietary restrictions, allergies, and medical notes are classified as special-category personal data under GDPR Article 9. We process this data only for the legitimate purpose of crew service operations and guest safety. This data is accessed solely by authorized crew members on an as-needed basis and is not shared with external parties beyond the yacht operator's internal system.

8. Changes to This Policy

We may update this Privacy Policy periodically. Material changes will be communicated in-app or via email to registered account holders. Your continued use of the App after changes constitutes acceptance of the updated policy.

9. Contact Us

For privacy inquiries, data requests, or concerns:

Data Controller: Branko Blagojević PR Obedio Email: info@obedio.de Website: https://obedio.de/privacy Registered Address: 26340 Bela Crkva, Republic of Serbia Company Registration No.: 68322260 (APR, Republic of Serbia) Tax ID (PIB): 115381541