These are the questions to answer before agreeing to an installation, because they decide whether the on-board app is a risk or a safety net.
The yacht is offline for weeks
Nothing breaks and nothing is lost. Being offline is what the on-board app is built for.
Everything crew save aboard is written to the yacht's own database immediately. The sync queue only copies it to the cloud afterwards. Time offline never discards anything from that queue, however long it lasts. Changes made in the office queue up in the other direction just as patiently.
When a connection comes back, both queues empty on their own, in order, and the two sides catch up with each other. The pill aboard shows Syncing N changes… while it works through the backlog, and the yacht's pages in the cloud app show Receiving N changes from vessel….
After a month with no contact, both apps turn their indicator red: Offline for over 30 days on the yacht, Vessel offline for over 30 days — check with crew in the office. That is a prompt to check the yacht's comms hardware, not a sign that anything has been lost.
A change gets stuck
Occasionally a single change cannot be applied. The app retries it for a while, then stops and flags it instead of dropping it silently: a red pill aboard, a red pill in the cloud, and a row in Sync errors. Unrelated changes keep flowing around it. Stuck changes can be retried from the Sync errors section using Replay failed changes, or investigated with Nauticare support if they continue to fail. They are worth chasing, because that work exists only on the yacht until they are cleared. See Sync Errors.
Files larger than 120 MB cannot be uploaded to the cloud. They stay on the yacht and show on the pill aboard as a file that couldn't sync.
The on-board server fails
Split the data in two:
- Anything already synced is safe. It is in the cloud, and losing the yacht's hardware does not affect it.
- Anything not yet synced was only on that server. If it cannot be recovered from the machine, it is gone. How much that is depends on when the yacht last had a connection. The Last sync and Last seen readings on the On-board app tab tell you.
Because a dead server can never report that it has finished uploading, the normal decommission cannot complete. Nauticare has a deliberate escape route for this: a forced completion that skips the drain step, revokes the device and returns the yacht to cloud-only, so the office can work normally again. There is no button for it in the app. Ask Nauticare support.
The route is deliberately hard to use, because it accepts data loss. It needs a written reason, which is kept in an audit record, and the yacht's exact name typed back as confirmation, to guard against doing it to the wrong yacht. It can only be used on a yacht whose decommission has already been started.
Once the yacht is cloud-only again, crew and office both work in the cloud app as before. New hardware can be installed later. That is a fresh install, set up from the cloud's current data.
Reducing the exposure
The real protection is connectivity, not procedure. A yacht that gets even a brief connection each day has at most a day of work at risk. A yacht that never syncs has all of it at risk. If the sync pill has been grey for a long time, act on it.