Privacy Policy

1. What Crew stores

• Account and profile information: your email address, display name, unique handle, sign-in identifier, and profile choices such as your home airport and avatar color. Clerk handles account authentication.
• Travel information: flight numbers, airlines, routes, departure dates, available flight times and statuses, and any seat or boarding-group details you provide. We also store named-trip information and your saved-flight associations.
• Social and privacy settings: friend requests, friend relationships, close-friend selections, custom-group names and membership, trip invitations, flight audiences, and people excluded from viewing your flights.
• Trip comments: the text you post, your author identity, and the posting time. Comments are visible only to the trip organizer and accepted members. Authors can delete their own comments, and the organizer can remove any comment. Leaving a trip removes your access but does not delete your past comments; deleting the trip or your account removes the associated comments from active application storage.
• Notification information: device push-notification tokens, device platform, and your notification preferences, so we can deliver the alerts you enable.
• Optional Gmail connection information: the email address of the mailbox you connect and an encrypted Google refresh token. The Gmail content accessed during a scan is described below.

2. Optional Gmail import

Connecting Gmail is optional and separate from signing in to Crew with Google. Each signed-in user chooses their own mailbox and grants permission on Google's consent screen. You can use Crew without connecting Gmail.

Permission requested: https://www.googleapis.com/auth/gmail.readonly. This permission allows read-only access to Gmail messages and mailbox information; it does not permit Crew to send, edit, or delete email. The scope is broader than a flight-only permission because Google does not provide a flight-confirmation-only Gmail scope. Crew's importer limits its requests to the workflow below.

• When you connect: Crew reads the connected Gmail profile's email address to identify the mailbox in the app, then stores that address and the encrypted refresh token.
• When you tap Scan Gmail: Crew searches your mailbox for subjects associated with itineraries, flight confirmations, e-tickets, booking confirmations, and reservation confirmations. Spam and trash are excluded. Each scan retrieves up to 50 matching messages.
• What is read: the matching messages' text or HTML bodies are processed on Crew's server to identify flight numbers, dates, airports, available times, and seat information. Attachments, including PDFs, are not processed by this importer.
• What is returned to you: extracted flight candidates and import warnings are shown in the app for review. A booking email is not treated as proof that you completed a past flight.
• What is saved: only flight records you select and confirm are added to your account. Raw email bodies are processed during the scan and are not written to Crew's application database by the importer.

How Crew uses this information

• Account and profile information identifies your account and lets you sign in.
• Travel information provides your saved flights, trip organization, travel history, and flight displays.
• Friend, group, and audience information controls the travel you choose to share and the people allowed to see it.
• Device and notification preferences support flight and social notifications.
• Google mailbox information and credentials provide the optional, user-requested Gmail flight-import feature. Gmail data is not used to create advertising profiles, determine creditworthiness, or train generalized artificial-intelligence or machine-learning models.

3. Google API Services: Limited Use

Crew's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• Gmail data is used only to provide the flight import feature you request.
• Gmail data is not sold, and is not used for advertising, including personalized or retargeted ads.
• Gmail data is not transferred to others except as necessary to provide the import feature, to comply with applicable law, or as part of a merger or acquisition with appropriate notice.
• Humans do not read your Gmail data unless you give explicit consent for specific messages, it is necessary for security purposes or to comply with applicable law.

4. Sharing with friends

Flight visibility follows your audience and trip-sharing selections. Friends you exclude cannot view the affected flights, including through shared trip groups. Imported flights are saved with a private audience unless you subsequently share them or explicitly contribute them to a shared trip. Sharing an imported flight does not share your Gmail messages, mailbox address, or Google credentials with friends.

Service providers and website visits

Crew uses service providers for hosting and database storage, account authentication, flight information, and push notification delivery. These include Replit, Clerk, FlightAware, Expo, and Apple. Google provides the optional Gmail connection. Providers receive information needed to perform their functions; raw Gmail messages are not sent to the flight-information provider by the import pipeline.

The Gmail-import backend runs on Replit. Clerk stores the encrypted Gmail connection in your account's private metadata; it is not included in the public profile or shared flight data. The importer does not send raw Gmail message bodies to advertising services or an external AI service.

Visiting this website may generate technical request logs, such as browser and network information. This website loads fonts from Google Fonts, which receives the browser requests needed to deliver those fonts.

Storage, retention, and deletion

• Raw Gmail messages: matching email bodies are temporarily processed to produce your review results; the importer does not persist those bodies in the application database.
• Gmail connection: your mailbox address and refresh token remain in encrypted private account metadata until you disconnect Gmail in Crew or delete the linked account. Revoking Google's permission stops further authorized access, but you should also disconnect in Crew to remove the stored connection.
• Confirmed imports: disconnecting Gmail does not remove flights you already imported. Removing a saved flight removes its association with your account. Underlying flight records may remain in the application database.
• Account deletion: deleting your account removes the Clerk identity, stored Gmail connection, application account, and account-linked records such as saved-flight associations, friendships, groups, and device registrations from active application systems.

The retention and erasure rules for unlinked imported-flight records, technical logs, and service-provider backups still require owner confirmation before this draft can be finalized. No fixed backup-deletion deadline is represented here.

5. Security

Google authorization and Gmail API requests use HTTPS. Stored Gmail connection information is encrypted on the server using AES-256-GCM before being written to private account metadata. Gmail imports require an authenticated Crew account, and the authorization response is bound to the account that initiated it. No method of storage or transmission is completely secure, and we cannot guarantee absolute security.

6. Your controls

• Disconnect Gmail using the Gmail control on the Import flights screen in the app.
• Revoke access at any time from your Google Account's third-party connections page.
• Delete your account from the Profile screen in the app.
• Change sharing per flight or per friend in the app.

Disconnecting Gmail requests revocation of the Google grant and removes the stored Gmail connection. For privacy, access, correction, or deletion questions, contact the support address below. We may need to confirm your account identity before handling a request.

7. Changes to this policy

If this policy changes materially, we will update this page and, where appropriate, notify you in the app.

8. Contact

For privacy questions or support, contact jusleen1114@gmail.com.