CrewMate — Privacy Policy
Effective date: June 29, 2026
Last updated: July 20, 2026
Canonical URL: https://getcrewmate.app/privacy/
1. Who we are
CrewMate ("CrewMate," "we," "us," or "our") is a mobile application built for airline cabin crew and flight crew. CrewMate is operated by WeisMon Holdings LLC.
If you have any questions about this Privacy Policy or your data, contact us at support@getcrewmate.app.
This policy explains what personal information CrewMate collects, how we use it, who we share it with, how long we keep it, and the choices and rights you have.
2. Scope
This policy applies to the CrewMate mobile application and the services it connects to. It is written for our current launch audience in the United States. CrewMate is not directed to children under 13, and we do not knowingly collect personal information from children under 13. CrewMate is a professional tool for working aircrew. (If you believe a child under 13 has provided us personal information, contact support@getcrewmate.app and we will delete it.)
3. Information we collect
3.1 Information you provide
| Data | When collected | Where stored |
|---|---|---|
| Email address | Sign-up | Supabase Auth |
| Password | Sign-up | Supabase Auth (stored only as a salted bcrypt hash — we never store your plaintext password) |
| Display name | Sign-up | Supabase database (profile) |
| Crew role (e.g. Flight Attendant / Pilot) | Sign-up | Supabase database (profile) |
| Airline (optional) | Sign-up / settings | Supabase database (profile) |
| Home base airport (optional) | Sign-up / settings | Supabase database (profile) |
| Schedule data — trips, duty periods, flight legs, layovers, and off-duty events you enter | Manual entry in the app | Supabase database |
| Hotel name, address, and phone (for layovers) | Manual entry, optionally aided by a place-lookup field | Supabase database |
| Messages you send to "Eddie" (the in-app assistant) | When you chat with Eddie | Stored on your device only (see §3.4); each message is sent to our AI provider to generate a reply |
3.2 Information collected automatically
| Data | What it is | Where it goes |
|---|---|---|
| Product-analytics events | A fixed, governed allowlist of in-app interaction events (for example: a screen was viewed, a tool tile was tapped, the assistant was opened) | Stored in our Supabase database (analytics_events) |
| Crash and error reports | Diagnostic information generated automatically if the app crashes or hits an unexpected error | Sent to Sentry, our crash-monitoring provider |
*About our analytics — what we deliberately do not do. Our product analytics are first-party and pseudonymous. The event properties are restricted to a fixed, governed allowlist and enforced by a database constraint, so they contain no direct profile identifiers and no free text; each analytics row is, however, linked to your account's internal identifier (never to your name or email within the event). We use no third-party analytics SDK, no advertising identifiers, and no cross-app or cross-site tracking*. We use this data only to understand which features are used and to improve the app.
About our crash reports. In the crash and error reports sent to Sentry, our crash-monitoring provider, we exclude direct profile fields from the report's user context before it leaves your device — no email and no username are attached, and the only identifier we include is your account's internal identifier, used to group related reports. Server-side handling of network metadata such as IP address follows Sentry's configuration and terms.
3.3 Information collected only when you use specific features
| Feature | Data | How it is handled |
|---|---|---|
| Location-aware features (e.g. layover suggestions, assistant context) | Approximate location | Only collected if you grant permission. Reduced to a city/country (and, for nearby-place search, a coordinate) on your device and used transiently at the moment of the request. Not stored on our servers. |
| Translator / voice input | Microphone audio | Sent to Google Speech-to-Text to produce a transcript, then discarded. Not stored by CrewMate. |
| Translator photo/OCR | A photo you take for text recognition | Sent to Google Cloud Vision to extract text, then discarded. Not stored by CrewMate. |
| Flight lookup / watchlist | The airline code + flight number you look up | Sent to our flight-data provider to retrieve public flight information. The query contains no personal information. |
3.4 On-device only
Your conversation history with the in-app assistant ("Eddie") is stored only on your device for up to 7 days and is not stored on our servers. Each message you send is transmitted to our AI provider to generate a response.
3.5 What we do not collect
We do not collect: your payment-card or bank-account details — if you purchase a Premium subscription, Apple processes the payment and CrewMate never receives your card number (see "Premium subscriptions" below); passport, visa, or government-ID data; health or biometric data; your contacts/address book; your photo library beyond a photo you explicitly hand to the Translator feature; advertising identifiers; or any third-party / behavioral-advertising analytics.
3.6 First-run onboarding
When you first open CrewMate, the onboarding experience is local to your device and manual — you add your first trip yourself. First-run onboarding does not sync your phone calendar and does not request calendar permission.
4. How we use your information
We use your information to:
- Create and operate your account, and sign you in.
- Provide CrewMate's core features (your schedule, layover tools, flight information, the assistant, and related tools).
- Respond to your support requests.
- Keep the app secure, diagnose crashes, and fix bugs.
- Understand which features are used so we can improve the product.
We do not sell your personal information, and we do not use it for third-party advertising.
5. Who we share information with (subprocessors)
CrewMate relies on the following service providers, who process data on our behalf only to provide their service. We do not sell or rent your data to anyone.
| Provider | What they process | Purpose |
|---|---|---|
| Supabase | Account email, hashed password, profile, schedule, layover, and analytics data | Authentication, database, and backend functions (hosted in the US) |
| Google (Gemini) | Your messages to the assistant + transient location context (city/country) | Generating assistant replies |
| Google (Speech-to-Text) | Microphone audio (transient) | Voice transcription |
| Google (Cloud Vision) | Photos you submit to Translator (transient) | Text recognition |
| Google (Cloud Translation) | Text you submit for translation (transient) | Translation |
| Google (Places) | Coordinates / category for nearby-place search (no personal identity tied to the query) | Layover place suggestions, hotel lookup |
| AviationStack | Airline code + flight number (no personal information) | Flight information lookup |
| Frankfurter | Currency codes (no personal information) | Exchange rates |
| OpenWeather | City name (no personal information) | Weather lookup |
| Sentry | Crash/error diagnostics — the client excludes email and username from the report's user context (sendDefaultPii off) and includes your internal account identifier; server-side handling of network metadata such as IP address follows Sentry's configuration and terms |
Crash and error monitoring |
Assistant AI provider. Your messages to the assistant are sent to Google's Gemini API to generate replies. The Gemini API is used through a billing-enabled Google project; under Google's paid-tier Gemini API terms, Google does not use those messages to train or improve its models. Google may, however, retain limited logs for abuse prevention and for legal, regulatory, or configured logging purposes. We retain Anthropic as an inactive fallback provider that is not used unless we switch providers; if it were ever activated, your assistant messages would be processed by that provider under its applicable terms. We will update this policy if the active assistant provider changes.
We may also disclose information if required by law, to enforce our Terms, or to protect the rights, safety, or property of CrewMate, our users, or others.
5A. Premium subscriptions (if offered)
If CrewMate offers Premium subscriptions and you subscribe, we process purchase and subscription information from Apple's App Store so we can deliver and manage your subscription. This includes: the subscription product identifier; Apple transaction identifiers (the original and latest transaction IDs); your subscription and entitlement status; purchase and expiration dates; auto-renewal, billing-grace-period, refund, and revocation information; an app-account token that links your purchase to your CrewMate account; and the App Store server-notification records Apple sends us about your subscription's lifecycle.
Payment method. Apple, not CrewMate, processes your payment. CrewMate does not receive or store your credit-card number or other payment-card details. We do process the purchase and subscription history described above.
How this data is used. Only to: deliver your Premium entitlement, restore your purchases, handle renewals, grace periods, refunds, and revocations, keep the subscription secure, provide support, reconcile our records, and meet legal and compliance obligations. It is not used for advertising.
Apple as the purchase platform and data source. Apple / the App Store is the platform through which any subscription is purchased and a source of the data above; Apple's own handling of your payment and Apple Account is governed by Apple's privacy policy.
Account deletion. If you delete your account, your subscription-entitlement record and the transaction-identity binding are deleted with it. For the subscription-notification records Apple has sent us, CrewMate removes the direct account association from those retained records. Limited Apple transaction and notification identifiers may remain for security, reconciliation, fraud prevention, dispute handling, and legally required recordkeeping. These retained identifiers are not used for advertising.
6. How long we keep your information
| Data | Retention |
|---|---|
| Account identity (email + hashed password) | Until you delete your account |
| Profile, schedule, layover, and event data | Until you delete your account |
| Product-analytics events | Until you delete your account — they are automatically and permanently deleted when your account is deleted (enforced at the database level by a cascade tied to your account record), and are not separately retained or anonymized afterward |
| Assistant ("Eddie") chat history | Up to 7 days, on your device only — auto-clears, or you can clear it manually at any time |
| Microphone audio / Translator photos | Not retained by CrewMate (transient) |
| Crash/error reports | Per Sentry's retention settings (the client excludes email and username from the report's user context before sending) |
7. Your choices and rights
- Access — You can view your data inside the app (your schedule, profile, and assistant history). For a formal export, contact support@getcrewmate.app.
- Deletion — You can delete your account from within the app (Account screen → Delete account). Deleting your account removes your account record and cascades to permanently delete your profile, schedule, layovers, events, and analytics events. If you have subscribed to Premium, see "Premium subscriptions" (§5A) for how subscription and Apple notification records are handled on deletion. You may also request deletion by emailing support@getcrewmate.app.
- Do Not Sell or Share — CrewMate does not sell or share your personal information for advertising, so no opt-out is needed. We state this here for the avoidance of doubt.
- California residents (CCPA) — California residents have rights to know, access, and delete their personal information, and not to be discriminated against for exercising them. The access and deletion mechanisms above apply to you; contact support@getcrewmate.app for any request.
If we expand to the EU/UK in the future, additional GDPR-specific rights and mechanisms will be added to this policy at that time.
8. Security
We protect your information with:
- Encryption in transit — traffic between the CrewMate app and our backend is protected with HTTPS. Connections from our backend to our third-party providers also use HTTPS, with one exception currently under review: the flight-information lookup provider may not use HTTPS on its present service tier. That lookup contains only an airline code and a flight number and no direct personal identifiers.
- Encryption at rest — our database encrypts stored data (AES-256).
- Password protection — passwords are stored only as salted bcrypt hashes.
- Access controls — row-level security restricts each user's data to that user; server-side keys for third-party services are never embedded in the app.
No method of transmission or storage is 100% secure, but we work to protect your information using industry-standard measures.
9. Children's privacy
CrewMate is a professional tool intended for adult aircrew and is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe we have collected such information, contact support@getcrewmate.app and we will delete it.
10. Changes to this policy
If we make material changes to this policy, we will update the "Last updated" date above and, where appropriate, notify you in the app. Your continued use of CrewMate after changes take effect means you accept the updated policy.
11. Contact us
Questions, requests, or concerns about your privacy:
Email: support@getcrewmate.app
Operator: WeisMon Holdings LLC
Governing law: This policy is governed by the laws of the State of New York, USA.