Privacy Policy

1. Overview

CrewGravity ("the Service") helps cabin crew and shift workers manage their schedules and share them with family and friends — only as much as the owner decides. Your detailed schedule (flight numbers, times, cities) is visible only to people you send a Safe Link, and only as much as that link allows. Of your schedule, friends and group members see only your days off, and mutual friends also the fact that you're in the same city on the same day (they do see your profile — name, @ID, photo, home base, airline and the like). This policy explains what we collect, why, and how it is protected. Contact: hello@crewgravity.com

2. What we collect

• Account: email, password (for accounts that sign in with email and password — stored only as a hash), display name, public handle, worker type (crew/shift/viewer), home base, time-reference city, airline (optional), language
• Profile photo: stored only if you upload one (emoji and badges are not stored as files).
• Social sign-in: when you use Google, Kakao or Apple we receive your email and basic profile from them.
• Schedule data: roster photos/PDFs/CSV files you upload (processed only for analysis), the resulting entries (flights, shifts, days off, personal events), recurring activities and custom entry types
• Flight ticket images: e-ticket or boarding pass images you upload (processed only for analysis) — they may contain the passenger name, booking reference, flight number and seat
• Seat notes: note text and handwriting strokes you save in-flight, with the related flight number and date
• Sharing settings: Safe Link configuration (circle class, period, quiet mode), care notes, friendships and nicknames, groups, block list, invite and QR records
• Usage records: the days and platform you opened the app, roster and ticket parse outcomes (airline, duration, size, document type, AI usage in tokens — never the photo itself), feature counters, error reports (when something breaks in the app or on the web: the error type, message and the code location where it happened, and in the app whether the app crashed — no photos, rosters or schedule entries are attached, and Safe Link, invite and QR tokens and account identifiers in any URL in the report are masked)
• Payment data: paid products are sold only inside the app, through the App Store or Google Play. Your payment instrument (card number, CVC and the like) is handled by Apple or Google on their own screens — we never receive or store it. The app does not pass your name or email to RevenueCat, so the purchase records we receive through it contain no name, email or card details. What we receive through RevenueCat (our subscription-management provider) and keep is: your account identifier, the notification type and identifier, the transaction and original-transaction identifiers, product name (including the new product when you switch plans) and billing interval, the entitlement name, whether a free-trial or introductory period applies, amount, currency, tax rate, store commission rate and the exchange rate applied, the time of purchase / renewal / cancellation / refund and the cancellation or expiry reason, the subscription expiry and billing grace-period end times, the store and store country, and whether it was a test (sandbox) purchase; for a gift, the recipient's account identifier and the gifted period are recorded as well, and for a Sync Miles refund, the number of miles reclaimed, and for a Premium gift refund, the gifted time taken back. We do not keep RevenueCat's notifications in full — only these items are taken from them and kept as evidence for refunds and disputes.
• What we do NOT collect: no GPS or real-time location, no microphone or audio, no contacts. Status is computed purely from your schedule data.

3. Why we process it

• Providing the Service: identifying your account and signing you in, turning rosters into schedules, showing the calendar, home, widgets and watch, computing time zones
• Sharing — Safe Link: showing your schedule to the people you send a Safe Link, as far as that link's Circle Class, period and quiet mode allow
• Sharing — OFF Sync, friends and groups: showing friends and group members only your days off (days with only leave, sick leave or personal plans also appear simply as off, with no reason) and, to mutual friends only, the fact that you're in the same city on the same day (group members who are not your friends see only your days off) — the server never sends them flight numbers, times, other cities, notes or your email address. Through the path older app versions use, the type code of those days off (e.g. ADO, ATDO), how the entry was added and when it was saved can also be read.
• Protecting the same-city indicator: to make it harder (though not impossible) to use the same-city indicator to work out where you are, for each date from about 4 months back to 4 months ahead we record a summary value (hash) of where and when your schedule places you and when it last changed, and a date whose place in your schedule changed shows no same-city for 24 hours. Other users cannot see this record, and it is deleted with your account.
• Payments: confirming Premium subscription, Sync Miles and gift purchases, checking subscription status, recording refunds, taking back the unused time of refunded gifts and statutory record-keeping
• Safety and abuse prevention: enforcing usage limits, handling blocks and reports, stopping token brute-forcing and other abnormal access
• Improving the Service: aggregate usage analytics to see where features fail (we do not profile individuals for marketing)
• Support: answering your emails and keeping a record of them
• Shared flight timetable (from 2026-10-07): collecting flight numbers, airports and scheduled times without any link to who uploaded them, to fill in scheduled times missing from other users' rosters — details in section 4

We will ask for separate consent before using data for any other purpose.

4. AI processing

Roster photos, PDFs and CSV files are sent to an AI API to convert them into schedule entries.From October 2, 2026 they are processed by Google's Gemini API, and by Anthropic's Claude API only when Gemini is unavailable (until then, only the Claude API is used). Uploaded files are used only for that conversion and are not stored on our servers. Under their paid API terms, neither provider uses this data to train models.

Flight ticket images (e-tickets and boarding passes) are sent to the same AI API as rosters to convert them into flight entries. They may contain the passenger name and booking reference; they are used only for that conversion and are not stored on our servers. Under their paid API terms, neither provider uses this data to train models.

Live flight status is not handled by AI — it is looked up through AeroDataBox (via RapidAPI). Only the flight number and departure date are sent; nothing that identifies you.

Shared flight timetable (posted 2026-09-30 · effective 2026-10-07): from the effective date, theflight numbers, departure/arrival airports and scheduled times (and the date of each flight) from uploaded rosters and flights saved in calendars — including flights saved before that date — are stored without any link to who uploaded them, as a shared timetable used to fill in scheduled times missing from other users' rosters. The timetable keeps only how many times the same values were seen — no names, emails or account identifiers. Because the rows are not linked to anyone, deleting your account does not remove them (section 10), and there is currently no setting to switch off this processing on its own. Questions: hello@crewgravity.com.

5. Processors and international transfers

We use the processors below to run the Service. They process data outside Korea — in India (Mumbai, where Supabase stores the main database, sign-in data and files) and in the United States.

• Supabase (operated from the US · data stored in Mumbai, India) — database, authentication and file storage (account, schedule, notes, profile photo) · kept while your account exists
• Vercel (US) — web hosting (access logs)
• Google (US) — AI analysis of roster photos/PDFs/CSV files and flight ticket images (Gemini API, from October 2, 2026) · not stored on our servers, not used for model training
• Anthropic (US) — AI analysis of roster photos/PDFs/CSV files and flight ticket images (from October 2, 2026, only as a backup when Gemini is unavailable) · not stored on our servers, not used for model training
• AeroDataBox / RapidAPI (US) — live flight status (flight number and departure date)
• PostHog (US) — product analytics (user identifier, screens visited, feature events — payment events, when a purchase or refund is applied, also carry the product name, number of miles and store; transaction identifiers and amounts are not sent). On the web its data, such as identifiers, is kept in browser storage (localStorage and sessionStorage) rather than cookies, and in the app it is kept in on-device app storage — in a browser where that storage is unavailable, analytics data is not stored at all and no cookie is set. Error reports (error type, message, the code location where it happened, and in the app whether the app crashed) also go to PostHog — no photos, rosters or schedule entries are attached, Safe Link, invite and QR tokens and account identifiers in URLs are masked before sending, and on the web nothing is sent from Safe Link, invite, QR or sign-in pages.
• Apple · Google (US) — in-app payment processing (Apple or Google receives the payment method directly)
• RevenueCat (US) — purchase confirmation and subscription status · data transferred: account identifier, purchase and subscription transaction data, and device and app information from the app (operating system and its version, app version, language setting, country of access)
• Google · Kakao · Apple (US · Korea · US) — social sign-in
• Google AdSense/AdMob (US) — when ads are shown, they may use cookies or advertising identifiers

When and how: data is transferred over encrypted connections (TLS) at the moment you use the related feature. Refusing transfers: the Service cannot run without these providers, so you can refuse by deleting your account (Account tab). If you only object to one feature (AI analysis, live status, payments, ads), simply do not use it — that data is then never transferred.

Ad and analytics scripts are never loaded on Safe Link viewer pages, invite links, or the sign-in screen — the token in those URLs is itself the permission to read.

6. Sharing with third parties

Of your schedule, friends (added by invite link, QR or @ID) and group members see only your days off — and mutual friends also the days you're in the same city — not your email address. They do see your profile (name, @ID, photo, home base, airline and the like). Your detailed schedule is visible only to people you send a Safe Link, at the circle level (Circle Class) you chose, and only in that one direction. Because the same-city indicator appears only when you are both in the same city that day, the other person learns that you're in their city on that day. Entry notes and seat notes are never shown to anyone. The @ID and display name set automatically at sign-up follow the first part of your email address; you can change them in your profile if you prefer (the @ID once). We never sell personal data, and disclose it to authorities only when legally required and only to the minimum extent.

7. Cookies and similar storage

On the web, your sign-in session (the essential storage that keeps you signed in) is kept in localStorage, and product analytics (PostHog) data in localStorage and sessionStorage — neither uses cookies. Blocking essential storage will sign you out. Cookies may be used only while ads are being shown, by Google (AdSense) for advertising on web pages other than those named in section 5 (Safe Link, invite links and sign-in). In the app, your sign-in session and the anonymous analytics identifier are kept in on-device app storage. We do not use session replay (screen recording).

How to refuse: block or clear this site's cookies and site data (storage) in your browser settings. Ad personalisation can be turned off at adssettings.google.com.

8. App permissions

The mobile app requests the permissions below. None of them is mandatory.

• Camera (optional) — only to scan a friend's QR code. Nothing is saved or sent.
• Photos (optional) — to upload a roster or flight ticket photo or pick a profile picture. Only the photo you choose is processed.
• Notifications (optional) — requested only when you turn on flight alerts in the app, or set a reminder on a seat note in the Apple Watch or Galaxy Watch app. Flight alerts and the lock screen live card are built on your device from your roster and the scheduled times in Safe Links you received; alerts are scheduled and shown on that device only. Nothing is sent to our servers and no push token is created. The Android app detects device startup so it can restore scheduled alerts after a restart (used only when flight alerts are on), and may ask for Alarms & reminders access so alerts ring on time. Without it, alerts can run a few minutes late.
• Never requested — location, microphone, contacts. Status comes from your schedule, not GPS.

You can revoke a permission in your device settings at any time; only that feature stops working.

9. Payments and refunds

Premium subscriptions, Sync Miles and gifts are sold only inside the CrewGravity app and charged by the App Store or Google Play; they are not sold on the website. RevenueCat is used to confirm purchases and check whether a subscription is still active. We never handle the payment instrument itself (card number, CVC) — we only receive the record passed to us through RevenueCat after the payment is complete.

• When: when a purchase, renewal, cancellation or refund actually happens, via the notification (webhook) RevenueCat sends; and when a gift is delivered, when you open the gift card in the app to check for undelivered gifts, when a purchase moves to another account, when we are notified that a subscription has expired, been refunded or had its refund reversed, or receive a late notice for a period that has already ended, or when a test (sandbox) purchase expires or is cancelled, our server asks RevenueCat for the current purchase or subscription status.
• Why: granting and revoking subscription access, making sure one payment is not credited twice, handling refunds and disputes (including taking back the unused time of a refunded gift), tax filing and statutory bookkeeping.
• How long: the periods Korean e-commerce law requires — 5 years for contract and withdrawal records, 5 years for payment and delivery records, 3 years for consumer complaints and disputes. During those periods payment records survive account deletion, because the law requires it; only the billing record remains — schedules, notes and friendships are deleted with the account.
• Refunds: request them from the store you paid through (Apple or Google) — see the Refund & Cancellation Policy.

10. Retention & deletion

Data is kept while your account exists. You can permanently erase your account and all data (schedules, friends, Safe Links, notes, profile photo, …) at any time via Account → Delete my account. Deletion is immediate and irreversible. Payment and transaction records are kept separately for the period Korean e-commerce law requires (5 years for contracts and payments, 3 years for consumer complaints) and then destroyed in a non-recoverable way.

Some records remain after your account is deleted. Roster and ticket parse outcomes and AI usage (token counts) stay as statistics with the account identifier removed (the photo and schedule contents were never stored). A Gift Seat you sent to a friend keeps your display name as the sender, which the recipient can still see (the account identifier is removed). Payment and transaction records (including gift delivery and refund records) remain for the statutory periods above.

Flight numbers, airports, scheduled times and flight dates in the shared flight timetable (from 2026-10-07, section 4) are not linked to anyone's account, so deleting an account does not remove them. They are overwritten when the schedule changes.

11. Security measures

• Access control: row-level security in the database means you can only read and write your own data; shared data is gated server-side — Safe Link viewers get only the circle you chose, and friends and group members get only whether you're off and whether you're in the same city (for the exception on the path older app versions use, see section 3).
• Encryption: all traffic is encrypted with TLS; passwords are stored only as hashes.
• Sharing tokens: Safe Link and QR tokens are unguessable random values; QR tokens expire in 5 minutes and work once. No third-party scripts run on pages that carry a token.
• Data minimisation: roster and ticket photos are not stored after conversion; location and microphone are never collected.
• Operational: service keys live only on the server, never in app or web code; the number of people with access is kept minimal.

12. Your rights and how to exercise them

You may request access, correction or erasure of your data, restriction of processing, or withdrawal of consent — in-app (Account tab) or by contacting hello@crewgravity.com. We respond without undue delay and within 10 days. Where GDPR or similar laws apply, you also have the rights to portability and to object.

Complaints: in Korea you may contact the Personal Information Infringement Report Center (KISA, privacy.kisa.or.kr, 118), the Personal Information Dispute Mediation Committee (kopico.go.kr, 1833-6972), or the police cybercrime unit (ecrm.police.go.kr, 182).

13. Privacy officer

We appoint a privacy officer under Article 31 of the Korean Personal Information Protection Act. Questions, complaints and remedies about personal data — and the access, correction, erasure and restriction requests in the previous section — are all received at the address below and answered without undue delay.

• Privacy officer — name / title: Insuk Kang (Representative)
• Where to file access, correction or erasure requests — the in-app Account tab (handled immediately) or hello@crewgravity.com
• Contact — hello@crewgravity.com · privacy enquiries are handled by email

Company name, representative, address, business registration number and e-commerce registration number are published in the Operator section of the Terms of Service.

14. Children

The Service is not directed to children under 14, and you confirm you are 14 or older when signing up.

15. Changes

Updates are posted here at least 7 days before they take effect (30 days for changes that reduce your rights); material changes are announced in the Service. Posted: 2026-09-25 · Effective: 2026-10-02 (shared flight timetable clauses — sections 3, 4 and 10: posted 2026-09-30 · effective 2026-10-07; payment clauses — sections 2, 3, 5 and 9, web-purchase wording removed, the payment-record items, what is transferred to RevenueCat and the payment analytics events: posted 2026-10-05 · effective 2026-10-12; where analytics and sign-in data are stored and when cookies are used — sections 5 and 7: posted 2026-10-05 · effective 2026-10-12; what friends and group members can see (days off and same city only), the record that protects the same-city indicator, and email addresses no longer shown to friends — sections 1, 3, 6 and 11: posted 2026-10-31 · effective 2026-11-07; where Supabase stores data corrected to Mumbai, India — section 5: posted 2026-10-31 · effective 2026-11-07; the record of gifted time taken back on a refund and its purpose — sections 2, 3 and 9: posted 2026-10-31 · effective 2026-11-07; AI analysis of flight ticket images — sections 2, 4, 5, 8 and 11, error-report items — sections 2 and 5, RevenueCat lookups on subscription expiry and refunds — section 9, Apple sign-in and passwords — sections 2 and 5, what remains after account deletion — section 10: posted 2026-10-31 · effective 2026-11-07)