Privacy & GDPR
Last updated 8 October 2026 · Contact:
CrewBag is built by a working airline pilot on a simple rule: your data is yours, we keep as little of it as possible, and you can see and delete everything. Everything we run is hosted in the EU.
This website
- No cookies. No ads. No trackers. You can verify that in your browser's network inspector.
- If you request a TestFlight seat, we store: your email, base, operator, platform, and your consent choices (which mails you want, by kind). Purpose: arranging your testing seat and, only if ticked, the emails you chose. Legal basis: consent.
- Internal test team: ticking "apply to the internal test team" on your account page stores one opt-in flag, shown in "Everything we have on you" and revocable on the same page. Legal basis: consent.
- Email check and contact card: "Send me a test mail" sends one plain mail to your signed-in address and stores nothing beyond a per-address rate limit. The contact card is a static file; downloading it records nothing.
- Referrals: every seat gets a random invite code. If you joined through someone's link we store that code (never their email) against your entry, and they earn points when you confirm your seat. If you set a handle, it is shown to colleagues who open your invite link ("Invited by …") and — with your points — on the base list visible to signed-in crew at your own base and airline only. Invite links carry only the random code, never a name or email. Handles starting with crewbag_ are our own channel codes (printed cards, field batches), not people.
- Polls: optional weekly questionnaires. Your answers are stored with your seat, visible only to you and used to write you a personal letter from the founder, analysed only as per-airline/per-base aggregates (never shown below 8 people), and erasable by you at any time — the points you earned stay.
- Notifications: if you enable them in the app, we store a push token for your device. Referral-activity pushes can be muted separately; deleting the app or signing out stops them.
Your account
- Sign-in is by email code — we never store passwords.
- See everything: your account page shows every row we hold against your email, live from our server.
- Delete my account: the same page has a one-click, instant, no-questions erasure of your account and everything linked to your email. Encrypted backups age out automatically (14–90 days).
- Your handle: one per person, changeable once every 30 days on your account page. A handle you drop — by renaming or by deleting your account — is held for 14 days, then released for anyone to take. Names of brands, people and roles are refused at claim and rename.
- Dormant accounts: a seat or account with no activity for 24 months — no sign-in, poll answer, invite or monthly in-app check-in — is deleted and its handle released, after six monthly reminders by email; one sign-in during those six months keeps it. This matches the 2-year audit-trail retention: nothing is kept "for no longer than is necessary" (GDPR Art. 5(1)(e)).
The app
- Your roster, briefings and logbook live on your device and in your own iCloud — not on our servers.
- Bug reports are sent only when you choose to, with the files you tick. We process them under our legitimate interest in finding and fixing defects (GDPR Art. 6(1)(f)); we use them for nothing else and delete server copies about 30 days after we retrieve them, and in any case no later than 90 days after they were sent, even if never retrieved. Roster documents can contain colleagues' names: a redact switch strips crew names, employee IDs and tail numbers before sending, off by default because the unaltered file is usually what reproduces the fault.
- You may object at any time. Not sending is the simplest objection; to delete a report already sent, write to us and we delete it unless we must keep it to defend a legal claim.
- Reports are keyed to an anonymous reporting identity you can reset in the app, which orphans all previous reports.
Usage signals
- On by default where the law allows it, off in one tap. The app counts how its own features are used: opened (duty day, yes or no), roster read (worked or failed), feature used (name only), each dated to the day, plus build, platform and three short codes from your settings and roster: airline, base airport and aircraft type. That list is complete. No roster content, no names, no flights, no files, no email, no account, no location. Our server also records the second it received each batch. Groups smaller than 10 installs are never shown to anyone, including us.
- A random identity minted on your device, never linked to your account, replaced automatically every 13 months and resettable in Settings, Privacy. These signals are first-party analytics, used as a technical tool. They involve no profiling.
- Why we may do this without asking first. Audience measurement for our own account is exempt from the consent rule for devices in France, Spain, the United Kingdom, the United States and Australia, on conditions we meet; processing the counts rests on our legitimate interest (GDPR Art. 6(1)(f)). On every other App Store storefront the app asks first and starts off.
- Your switch. The first roster import shows it; Settings, Privacy keeps it. Off stops recording, not just sending, and clears the queue. That is your right to object (GDPR Art. 21); we never argue against it. To erase what was already sent, write to us with the identity shown in Settings.
- Retention. Raw events are deleted 12 months after receipt; only monthly counts per airline, base and fleet remain, with no identity.
- No advertising IDs, no cross-app tracking, no selling, no third party. App Store label: data not linked to you, no tracking.
Who processes what
- Hetzner (Germany) — our server hosting, EU.
- Brevo (France) — sends sign-in codes, service mails and, with your consent, updates. EU. Our mail carries Brevo bounce and link addresses on em.crewbag.app, and a Brevo open-count pixel set to anonymous: opens are counted, never tied to a person.
- Better Stack (Better Stack, Inc., USA) — runs our public status page, health.crewbag.app. If you open it, your IP address reaches Better Stack. Data is processed primarily in the EU; transfers rest on the EU-US Data Privacy Framework and standard contractual clauses. It never sees your account, reports or roster.
- Apple — TestFlight distribution and, for your own data, your personal iCloud.
- Cloudflare — delivers the in-app weather map tiles (wx.crewbag.app). It does not touch your account, reports, or roster data.
- We sell nothing to anyone.
If something goes wrong — breach protocol
If we ever suffer a personal-data breach, we commit to:
- Assess within 24 h of discovery — what leaked, whose, how.
- Notify the supervisory authority within 72 h where required (GDPR Art. 33).
- Tell affected users directly and plainly — what happened, what we did, what you should do (Art. 34).
- Publish a post-mortem once resolved.
Report a suspected breach or vulnerability: . We answer fast and we don't shoot messengers.
What survives deletion
Two things, by design and legal obligation: the security audit trail (who created/deleted an account, sign-ins with IP address, consent changes — kept 2 years, containing only your email and the event); and — only if you asked us to build or curate an airline setup — the record of that contribution (your account, the setup, the dates of our checks), kept "for the establishment, exercise or defence of legal claims" (GDPR Art. 17(3)(e)). Nothing beyond the provenance itself. The security log keeps your handle and email 24 months after deletion, then erases them; the handle itself is held 14 days, then released for anyone to take. Sign-in IPs are stored for account security; we never store or derive your location.
Your rights
Access, rectification, erasure, restriction, portability, objection — GDPR Arts. 15–21. Most are self-service on your account page; for anything else, , answered within 30 days. You may also complain to your national data-protection authority.