The short version: CrewMark keeps what it needs to show you your roster and career history, on our servers in Frankfurt (EU). Your roster PDF is read and not kept. The parsed roster is saved as an encrypted snapshot so we can show what changed, check long-window flight-time limits and keep your career record. Other crew members' names from your roster are never stored in plain text. We use no third-party analytics, no tracking pixels and no advertising cookies; we only count, on our own server, on which days people use each CrewMark app (§2). No roster data is sent to AI providers. You can export your data or delete your account at any time.

What changed in versions 1.2 (23 October 2026), 1.2.1 (25 October 2026), 1.2.2 (26 October 2026), 1.2.3 (27 October 2026), 1.2.4 (27 October 2026), 1.2.5 (28 October 2026), 1.2.6 (29 October 2026) 1.2.7 (30 October 2026), 1.2.8 (30 October 2026) and 1.2.9 (30 October 2026)

1.2.9: §2 now gives the exact start of app usage counts: 30 November 2026, 30 days after we emailed users about them on 30 October 2026. Accounts that do not get our announcement emails are not counted. You can object by writing to customer.support.crewmark@gmail.com: we then leave your account out and delete what was recorded.
1.2.8: §2, §3 and §6 now cover app usage counts. When this is switched on, CrewMark records, on its own server, when you last used CrewMark and on which days you used the web app, the iPhone app or the Android app (one entry per day per app, with no pages, IP address or device ID). It is used only for counts on the admin dashboard (how many people use CrewMark, are online, use each app), per airline and overall, never to look at one person, and is deleted after 13 months. Counting starts no earlier than 30 days after we email registered users about it. The website (www.crewmark.tech) is still not measured. §2.2 now says plainly that we use no third-party analytics.
1.2.7: §3 and §4 now cover the live flight card: to show where your aircraft is, our server asks adsb.lol for the position of the flight's callsign or registration; for accounts that have gates turned on, it also asks AeroDataBox for the gate and terminal of the flight number. Only the flight number, date, callsign or registration is sent, never your name, email or roster.
1.2.6: §2, §3 and §6 now cover the crew survey on www.crewmark.tech/crew-survey: what it collects, that we store it only with your consent, and that we delete it automatically after 12 months. The survey takes no files, and we no longer email survey answers to our support inbox. §2.3 now explains health-related roster codes (sick leave, medical appointments and checks, fatigue or unfit reports). CrewMark keeps them only with your separate, explicit consent (Art 9(2)(a)), which you can give at sign-up or later and withdraw at any time in Settings → Privacy. Without it, those days are saved as 'Absence'. Accounts that do not answer within 30 days are treated as not consenting. The same consent, now called sensitive data, also covers union dues in salary contracts (trade-union membership): without it they are not stored and the salary estimate leaves them out. If you agreed before union dues were added, the app asks you once more. §4 and §9 now say plainly that we send our emails and receive support mail through a Google Gmail account, that Google processes that mail under its own terms for Gmail (we have no separate data-processing agreement with Google), and that it may be processed outside the EU. §2 and §6 now give the remaining retention periods: the security log 12 months, rejected sign-up applications 90 days after the rejection, deletion records 3 years (each by a daily job), and emails to our support address 24 months after the conversation ends (deleted by hand).
1.2.5: new §2.5 says which details you must give to open an account, and new §2.6 describes the public certificate verification page and what it shows. §2 and §6 now cover our server logs, our web server access logs (deleted after 14 days) and emails to our support address. §13 explains why we do not contact each colleague named on a roster. §11 now says which changes apply at once and which get 30 days’ notice. Erasure requests from people without an account are processed within one month. We do not collect phone numbers.
1.2.4: privacy and legal requests now go to our support address, customer.support.crewmark@gmail.com, because the crewmark.tech mailboxes are not active yet. Nothing else changed.
1.2.3: §14 now describes exactly what the “★ CrewMark member” badge shows: with Badge only, the pill sits next to your name as printed on the other member’s roster and nothing else from your account is shown; with Badge and name, your Crew identity name is added when it differs. Switching back to Hidden removes the badge at once.
1.2.2: §13 now describes “Crew I've flown with”: a list built from your own rosters that only you can see. New §2.4: we do not use real rosters to develop or test CrewMark. §4 and §9 now say exactly where backups are stored. §8 now covers what the iPhone app keeps on your phone.
1.2.1: in-app notifications are now deleted 90 days after they are sent, not only when you delete your account.
One policy for www.crewmark.tech and app.crewmark.tech: the two copies had drifted apart.
The full list of service providers, including Cloudflare (encrypted backups) and OpenWeatherMap (airport weather), and a corrected section on transfers outside the EEA.
Sign-in with passkeys and optional MFA is now described, with the data each needs.
Sign-up no longer asks for your phone number or date of birth, and asks you to confirm you are 18 or older. Date of birth is optional in Settings and used only on your career certificate.
Medical certificate records are stored only with your explicit consent.
Swap listings are stored in our database without full names and are deleted after the duty date (at the latest 30 days after posting). Feedback no longer stores a copy of your roster.
One statement on deletion and backup timing (30 days), used on every page.
Your right to object (Art 21) where we rely on legitimate interest.
The AI rules assistant is switched off. No roster data is sent to AI providers.
A list of what your browser stores, and the correct EASA flight-time limits.

1. Who we are

Controller: CrewMark is operated by its founder as a sole trader based in Belgium.

Contact: customer.support.crewmark@gmail.com

Websites: www.crewmark.tech and app.crewmark.tech

Our full imprint details (legal name, postal address and registration details) will be published on an Imprint page. Until then, you can ask for them at customer.support.crewmark@gmail.com.

If CrewMark moves to a company, we will update this policy before the change takes effect.

2. Personal data we process

Personal data we process, where it is stored and the legal basis
Category	Examples	Where and how it is stored	Legal basis
Account and application	Personal email, work email, first and last name, airline, home base, qualification, an optional crew ID and application note, your confirmation that you are 18 or older (stored as a date and time), and profile details you add later (for example display name, nationality or fleet)	Our database in Frankfurt. A rejected application is deleted 90 days after the rejection (see §6).	Art 6(1)(b): needed to provide the service
Date of birth (optional)	Only if you add it in Settings → Profile. We do not ask for it at sign-up. We do not collect phone numbers.	Our database in Frankfurt; used only on your career certificate	Art 6(1)(b): you add it for your certificate
Sign-in and security	Sign-in link records (time, IP address and browser; the link itself only as a hash), session tokens, passkey public keys and credential IDs, the MFA secret and hashed recovery codes if you turn MFA on, and a security log of sensitive actions (time, IP address, browser)	Our database in Frankfurt. Security-log entries are deleted after 12 months (see §6).	Art 6(1)(b), and Art 6(1)(f): keeping accounts secure
App usage counts	When you last used CrewMark (date and time) and which app (web app, iPhone app or Android app), and one entry for each day you used each app. No pages, screens, IP address or device ID. The apps say which app they are; older iPhone and Android versions are recognised by their browser type	Our database in Frankfurt. Day entries are deleted after 13 months, by a daily job; both go when you delete your account (see §6).	Art 6(1)(f): knowing how many people use CrewMark and which apps to support. Admins see only counts per airline and overall, never a person; airline moderators see only their own airline, and counts under 3 are hidden. You can object by email (see §1); we then leave your account out and delete what was recorded
Roster snapshots	Duty codes, flights, report and release times, hotels and layovers, and the crew lineup from each roster you upload	Encrypted in our database with a key derived for your account (see §15)	Art 6(1)(b); sick and medical codes only with your explicit consent, Art 9(2)(a) (see §2.3)
Roster PDF file	The PDF you upload	Read in memory and not stored. Scanned pages are read by our text-recognition (OCR) engine through a temporary file that is deleted as soon as the page has been read.	Art 6(1)(b)
Other crew members' names (in your roster)	The names of colleagues printed on your roster	Pseudonymised and encrypted (see §13). Never stored in plain text.	Art 6(1)(f): legitimate interest (see §13)
Career record	Airlines, crew IDs, bases, ranks and dates you add or we detect from rosters; for each career certificate you create, a verification ID and a fingerprint (hash) of the certified totals	Our database in Frankfurt	Art 6(1)(b)
Your own records	Duty notes, leave requests, salary contracts and settings, in-flight sales figures, and duty codes you suggest	Our database in Frankfurt	Art 6(1)(b); union dues only with your explicit consent, Art 9(2)(a) (see §2.3)
Swap marketplace	Duties you offer, the part of your roster shown with them, proposals and the messages exchanged. Each party is stored with crew ID, base, rank, airline and the display name they chose, if any; no full names are stored. Colleagues in a shared crew lineup are stored as initials and role only.	Our database in Frankfurt. A listing is deleted the day after its duty date, and at most 30 days after posting; its proposals are deleted with it.	Art 6(1)(a): consent, given when you post; withdraw it by removing the listing
Notifications	In-app messages about roster changes: the roster period, the number of changes and the changed dates	Our database in Frankfurt (not encrypted); deleted after 90 days, or earlier with your account	Art 6(1)(b)
Feedback	Category, message and whether you want a reply. If you tick “Attach my roster”, we store a link to your encrypted roster snapshot, not a copy.	Our database in Frankfurt; deleted with your account. Our team gets an email with the category and message (no roster data), and your email address only if you asked for a reply.	Art 6(1)(f): improving the service
AI rules assistant history	Questions and answers from before the assistant was switched off	Our database in Frankfurt, until you delete your account. The assistant is off and nothing is sent to AI providers.	Art 6(1)(b)
Crew Connect	Places you suggest, and your ratings, comments and reports	Our database in Frankfurt, with your account ID. Other crew see ratings and comments without your name.	Art 6(1)(b)
Erasure requests from people without an account	The name, airline and email given in the form, plus IP address and browser	Our database in Frankfurt, until the request is processed and then for 30 days. Requests that are never confirmed are deleted 30 days after submission.	Art 6(1)(c): legal obligation to handle erasure requests
Crew survey (www.crewmark.tech/crew-survey)	Your airline and your answers about your role, contract type, roster system and layout, duties, flight-time rules, how your pay is built up and what you would want from CrewMark; your name and email only if you give them. No files. Answers are not linked to a CrewMark account.	Our database in Frankfurt, deleted automatically 12 months after you send it (see §6). Our support inbox gets a notice naming only the airline.	Art 6(1)(a): your consent, given with the tick box on the form. You can withdraw it at any time by emailing us; we then delete your answers.
Announcement emails	Which announcements we sent you, whether delivery worked, and your opt-out	Our database in Frankfurt	Art 6(1)(f): telling users about the service; you can unsubscribe at any time
Server logs	For each request our API server handles: the time, your IP address, the address requested and the result code	Log files on our server in Frankfurt, up to 20 MB each and at most five per service; when they are full the oldest is overwritten (see §6)	Art 6(1)(f): keeping the service running and secure
Web server access logs	For each page or file our web server sends: the time, your IP address, the page requested without any query part, the result code and your browser type. Sign-in tokens, cookies and the codes in unsubscribe and verification links are removed before anything is written	Log files on our server in Frankfurt, deleted automatically after 14 days (see §6)	Art 6(1)(f): keeping the service running and secure, and investigating abuse
Emails to our support address	What you write to us, and the email copy of feedback you send from the app	Our support mailbox, a Google Gmail account (see §4). Deleted by hand 24 months after the conversation ends (see §6).	Art 6(1)(b) and Art 6(1)(f): answering you and handling requests
Browser storage	Sign-in token, cached roster and settings (full list in §8)	Your browser only	Strictly necessary for features you use

2.1 How you sign in

Magic-link email, optional passkey (WebAuthn) and optional MFA. For passkeys we store a public key and credential ID, never biometrics. For MFA we store the authenticator secret and hashed recovery codes.

2.2 What we do not collect

No third-party analytics or tracking tools (no Google Analytics, Mixpanel, Segment, Hotjar or similar). We count app use ourselves, as described above, and do not measure the website
No tracking pixels, no advertising cookies, no third-party cookies
No selling or renting of personal data, and no advertising profiles
No passwords: you sign in with an emailed link or a passkey
No phone numbers
No biometric, religious or political data; health data and union dues only as described in §2.3

2.3 Special categories of data

Some features can involve special-category data (Art 9 GDPR) because of what you choose to upload or enter:

Medical certificate records (the expiry date and an optional note) are stored only with your separate, explicit consent (Art 9(2)(a)), recorded with the date and the version of the consent text. If you withdraw consent, we delete these records immediately.
Health-related roster codes. Rosters can show sick leave, medical appointments and checks (for example the medical examination or the medical certificate's validity), and fatigue or unfit reports. This is health data. CrewMark keeps these codes only with your separate, explicit consent for sensitive data (Art 9(2)(a)), which is never part of accepting the terms. You can give it with an unticked box at sign-up, or later when the app asks or in Settings → Privacy; we record the date and the version of the consent text. With your consent the codes stay inside your encrypted roster snapshot and are used only to show you your own roster, check your flight-time limits and estimate your pay.
Without that consent, before a roster is stored, every sick, medical, fatigue or unfit day is replaced by a neutral 'Absence' (a medical examination rostered as duty becomes 'Duty' with its times), and the medical certificate's validity date from the roster is dropped. The date stays, so flight-time checks still count the day as neither duty nor rest; pay estimates that depend on sick days are not made, and the app says so.
Union dues. Union dues in a salary contract show that you are a union member (trade-union membership is also special-category data). The same consent covers them; the consent text names them from its version of 30 October 2026. Without that consent we do not store union dues: they are removed when a salary contract is saved, union dues stored before are removed too, and the salary estimate leaves them out and says so. With your consent they are stored with that contract and used only for your salary estimate. If you agreed to the earlier text, which named only sick days and medical appointments, the app asks you once more; until you agree, your sick and medical codes are kept but union dues are not.
Withdrawing consent. Turn the switch off in Settings → Privacy at any time. Every roster we store for you is then changed straight away to the neutral form, and union dues are removed from your salary contracts; the roster codes cannot be restored from our side. Turning consent on again applies to rosters you upload from then on. If you had an account before this consent existed, the app asks you once; if you do not answer within 30 days, we treat it as no and change your stored rosters to the neutral form. Withdrawing does not affect processing that happened before.

We never share these data or use them for anything else. You can delete them at any time by deleting the record, the roster snapshot or the salary contract.

2.4 Development and testing

We do not use your roster, or any real roster, to develop or test CrewMark. Our automated tests use made-up rosters and anonymised samples with no real names.

2.5 What you must give us

To open an account you must give a personal email address, a work email address, your first and last name, your airline and your home base, and confirm that you are 18 or older. We need them to sign you in and to check that you are airline crew. They are needed to enter into our contract (the Terms); no law obliges you to give them, but without them we cannot open an account. To see your roster you need to upload one. Everything else is optional.

2.6 Certificate verification page

Each career certificate you create prints a web address of the form crewmark.tech/verify/ followed by its verification ID. Anyone who has that address, for example an employer you give the certificate to, can open the page without signing in. While the certificate is valid, the page shows the name on your certificate, a short form of your name (first name and last initial), the issue date and the document fingerprint, and, recalculated from your roster snapshots when the page is opened: your employee number, current airline, rank and contractual base, the period your rosters cover, your employment history, and your duty, flight duty period and block-time totals by company, by month and by aircraft type.

If you delete the roster data behind a certificate, or your account, the certificate is revoked and the page shows only the issue and revocation dates. An ID we never issued shows nothing about anyone. These pages ask search engines not to index them. Legal basis: Art 6(1)(b), because you create the certificate to share it.

3. Why we process this data

Your account: to create it, sign you in and keep it secure.
Checking you are crew: an admin reads your application, and we email a verification link to your work address.
Roster parsing and archive: to read your roster, show changes between uploads, check long-window limits and keep your career record.
Rule breakdowns and salary estimates: calculated from your roster and settings, partly in your browser and partly on our server.
Swap marketplace: to show your listing to crew it can match, and their offers to you.
Service emails: sign-in links, verification, approval decisions and deletion confirmations; and release announcements, which you can unsubscribe from.
Weather at your destination: our server asks OpenWeatherMap for the weather at an airport's coordinates. No personal data is sent.
Live flight: on a flight day, our server asks adsb.lol where the aircraft is, by the flight's callsign or registration, and works out the progress, arrival time and delay as estimates. For accounts with gates turned on, it also asks AeroDataBox for the gate and terminal of that flight number. Only the flight number, date, callsign or registration is sent, never your name, email or roster.
Handling requests: data-protection requests from users, and erasure requests from crew without an account.
Crew survey: to decide which airlines and roster systems CrewMark supports next. We use your email only to reply to you.

4. Service providers we use

Hostinger and Cloudflare process data for us and act on our instructions (as processors under Art 28 GDPR). Google is different: see its row. OpenWeather, adsb.lol, AeroDataBox and Let’s Encrypt receive no personal data.

Service providers, their role, location and safeguards
Provider	What they do for us	Location	Safeguards
Hostinger International Ltd	Hosts our server: the application and the database	Data centre in Frankfurt, Germany; company based in Cyprus (EU)	Processor; data stays in the EU
Google (Gmail)	We send our emails (sign-in links and notices) and receive support mail through a Google Gmail account	Google's infrastructure; the mail may be processed outside the EU (US parent company)	No separate data-processing agreement: Google processes this mail under its own terms for Gmail. For transfers outside the EU, Google relies on the EU-US Data Privacy Framework.
Cloudflare, Inc. (R2 storage)	Stores our daily database backups, which are encrypted before upload with a key Cloudflare does not have	Stored in an EU location we chose for the bucket; US parent company	Processor; Cloudflare relies on the EU-US Data Privacy Framework for access from outside the EU. The backups are encrypted before upload, so Cloudflare cannot read them.
OpenWeather (OpenWeatherMap)	Weather for airports on your roster	Not applicable	Not a processor: receives only airport coordinates, no personal data
adsb.lol	Live aircraft positions for the live flight card (open data under the ODbL licence, credited in the app)	Not applicable	Not a processor: receives only a callsign or aircraft registration, no personal data
AeroDataBox (via RapidAPI)	Gates, terminals and revised times for the live flight card, only for accounts with gates turned on	Not applicable	Not a processor: receives only a flight number and date, no personal data
Let's Encrypt (ISRG)	Issues our HTTPS (TLS) certificates	Not applicable	No personal data: domain names only

We do not use AI providers: the AI rules assistant is switched off. No roster data is sent to AI providers.

See §9 for transfers outside the EEA.

5. Your rights under the GDPR

Your rights and how to use them
Right	How to use it
Access (Art 15)	Settings → Privacy & security → Export my data downloads a JSON file with your profile, career history, duty notes, sign-in records, swap listings and a list of your roster snapshots. You can download each snapshot from your roster history in Settings. For anything else we hold, email customer.support.crewmark@gmail.com.
Rectification (Art 16)	Edit your profile in Settings. Changes to airline, home base or rank are checked by an admin first.
Erasure (Art 17)	Settings → Privacy & security → Request account deletion. We email you a confirmation link that works for 15 minutes; your account is deleted when you confirm. When you confirm deletion from the link we email you, your data is removed from the live database straight away. Encrypted backups are kept for 30 days and then deleted. Requests from people without an account are processed within one month (Art 12(3) GDPR).
Restriction (Art 18)	Email customer.support.crewmark@gmail.com. We can suspend your account without deleting it.
Portability (Art 20)	The export above is machine-readable JSON.
Object (Art 21)	Where we rely on legitimate interest (for example, other crew members' names in your roster), you can object at any time; email customer.support.crewmark@gmail.com.
Withdraw consent	Remove a swap listing, set your crew identity visibility back to Hidden, or turn off sensitive data in Settings → Privacy, at any time. This does not affect what happened before.
Complaint (Art 77)	You can complain to the Belgian Data Protection Authority: www.dataprotectionauthority.be

We answer requests within one month (Art 12(3)). We make no decisions about you that are based solely on automated processing and have legal or similarly significant effects (Art 22).

6. How long we keep data

Your account: while it exists. When you confirm deletion from the link we email you, your data is removed from the live database straight away. Encrypted backups are kept for 30 days and then deleted. Requests from people without an account are processed within one month (Art 12(3) GDPR).
Roster snapshots: for the life of your account, because they are your career archive (see §6a). If you delete one snapshot, it is hidden immediately, can be restored for 30 days, and is then permanently deleted. “Delete all roster history” removes them at once.
Inactive accounts: if you don't sign in for 5 years, we email you. If you still don't sign in within 30 days, we delete your roster history; your account stays and you can upload again.
Sign-in links: expire 15 minutes after we send them. The record of each link (time, IP address, browser) stays with your account until you delete it.
Security log: each entry is deleted 12 months after it was written, by a daily job. If you delete your account before then, entries about you stay until that date without your email, name or IP address: only the event type, the time, and the admin if an admin acted. This lets us show what happened and investigate abuse.
App usage counts: each day entry (which app you used that day) is deleted 13 months later, by a daily job. When you last used CrewMark is kept with your account. Both are deleted with your account.
Swap listings: deleted the day after the duty date, and at most 30 days after posting, by a daily job. Proposals are deleted with their listing.
Notifications: deleted 90 days after they are sent, by a daily job, or earlier with your account.
Feedback and AI assistant history: deleted with your account. The emailed copy of your feedback is support mail and is deleted like it (see below).
Erasure requests from people without an account: processed within one month (Art 12(3) GDPR). We keep the request record for 30 days after processing, to show that we handled it. Requests that are never confirmed are deleted 30 days after submission.
Crew survey answers: deleted automatically 12 months after you send them, by a daily job. To have them deleted sooner, email customer.support.crewmark@gmail.com with your airline and roughly when you answered. Survey answers are not linked to a CrewMark account, so they are not part of an account export or account deletion.
Rejected applications: if we reject your application to join, your account details and application are deleted 90 days after the rejection, by a daily job, in the same way as an account deletion. Only a deletion record (below) stays.
Deletion records: when an account is deleted we keep a one-way hash of the account ID and email, the airline and role, and the optional reason you gave (for a rejected application, a fixed note saying so). Each record is deleted 3 years after the deletion, by a daily job. Certificates you issued stay listed as revoked, by verification ID only.
Roster PDF files: not kept (see §2).
Server logs: kept in files of up to 20 MB, at most five per service. When they are full the oldest file is overwritten, so how long an entry lasts depends on how busy the service is.
Web server access logs: deleted automatically after 14 days.
Emails to our support address: kept in our support mailbox until 24 months after the conversation ends, then deleted by hand (we check the mailbox once a month). If a data-protection request, complaint or legal claim about the conversation is still open, we keep it until that is closed.
Backups: taken daily, encrypted, and deleted after 30 days.

6a. Why we keep roster snapshots for the life of your account

Three reasons:

Change detection. When your airline publishes an updated roster, we compare it with your last upload and show what changed (added or removed duties, new times, aircraft changes).
Long-window limits. EASA limits flight time to 900 hours in a calendar year and 1,000 hours in any 12 consecutive calendar months (ORO.FTL.210(b)). Duty is limited to 190 hours in any 28 consecutive days (ORO.FTL.210(a)). Checking these limits needs months, sometimes years, of history.
Your career record. Crew often change airlines several times. Your snapshots are a personal record you keep when you move. The career certificate summarises what you uploaded; it is not an official logbook or licence record.

Keeping snapshots is the purpose of the archive, so we keep them until you delete them or your account (Art 5(1)(e) GDPR). You can delete any of them at any time.

7. Security

Our measures (Art 32 GDPR) include:

HTTPS everywhere (TLS 1.2 or newer), with certificates from Let's Encrypt
Roster snapshots and other crew members' names encrypted at rest (details in §15)
No passwords; sign-in links are stored only as SHA-256 hashes
Optional passkeys (WebAuthn) and authenticator-app MFA; moderators must use MFA
The database is not reachable from the internet, and services run in separate containers
Daily encrypted backups, stored off the server and deleted after 30 days

If a personal-data breach happens, we will notify the Belgian Data Protection Authority within 72 hours where required (Art 33), and tell you without undue delay if it is likely to put you at high risk (Art 34).

8. Cookies and browser storage

We set no analytics, advertising or third-party cookies. The app keeps some data in your browser’s localStorage so pages load quickly and your settings stick:

your sign-in token
a cached copy of your roster, roster archive, profile and duty notes
your tax profile and in-flight sales figures, for the salary estimate
a cached exchange rate
interface preferences: theme, time-zone mode, roster view and release-announcement settings
flags that remember you have seen the swap-market notices

While you complete an MFA sign-in, a short-lived step token is kept in sessionStorage. All of this is strictly necessary for features you use, so no consent banner is needed (ePrivacy Directive, Art 5(3)). You can remove it with “Clear local cache” in Settings, or in your browser settings.

The iPhone app keeps your sign-in in the iOS Keychain, and a copy of your roster, profile and settings in a small database inside the app on your phone, so you can read them without signal. Changes made offline (for example marking a notification as read) wait there until you are back online. This copy is deleted when you sign out, and entries older than 120 days are dropped.

9. Transfers outside the EEA

Our servers and database are in Frankfurt (EU). Encrypted backups are stored with Cloudflare and our emails go through a Google Gmail account; both are US companies. Where personal data may be processed outside the EEA, they rely on the EU-US Data Privacy Framework.

No roster data is sent to AI providers.

Encrypted backups are stored with Cloudflare R2 in an EU location; Cloudflare is a US company. We send our emails and receive support mail through a Google Gmail account; Google processes that mail under its own terms for Gmail, without a separate data-processing agreement with us, and may process it outside the EU, relying on the EU-US Data Privacy Framework. Our servers and database stay in Frankfurt wherever you use CrewMark from.

10. Age limit

CrewMark is for working airline crew aged 18 or over, and you confirm your age when you sign up. We do not knowingly collect data from anyone under 18. If you believe a minor has registered, email customer.support.crewmark@gmail.com and we will delete the account.

11. Changes to this policy

When we change this policy we publish the new version here, with its date and a list of what changed. Clarifications, corrections and changes in your favour apply when they are published. If a change reduces your rights or uses your data in a new way, we tell registered users by email at least 30 days before it applies. Earlier versions are available on request.

12. Contact

Questions, requests or complaints: customer.support.crewmark@gmail.com

We answer within one month (Art 12(3) GDPR).

13. How we handle other crew members' names

Your roster lists the colleagues you operated with on each sector. We keep those names so the app can show you things like “you have flown with this person 14 times”. Those colleagues are data subjects too, and most never signed up for CrewMark. We protect them like this:

Pseudonymisation when we save a roster. Each name is turned into a 12-character HMAC-SHA256 code, using a 32-byte key unique to your account. The plain name is not stored in our database.
Encrypted copy for you. Next to the code we store the name encrypted with your account's key (Fernet), so the app can show it to you when you are signed in.
“Crew I’ve flown with” is for you only. This list counts the flights you shared with each colleague, across your own uploaded rosters. It is built when you open it, from your snapshots only, and shown only to you. It reads no other user’s data, and nothing in it is shared with anyone else.
No cross-referencing. The same person gets a different code in each user's archive, so names cannot be matched across users (unless that person opts in, see §14).
Swap listings. If you share a duty's crew lineup on a swap listing, only your colleagues' initials and role are stored.
Erasure for people without an account (Art 17). Anyone named in a CrewMark archive can ask us to remove their name using our erasure form at www.crewmark.tech/erasure. We email a confirmation link, then remove their code and encrypted name from every affected snapshot. Requests from people without an account are processed within one month.
Objection (Art 21). They can also object to this processing at any time by emailing customer.support.crewmark@gmail.com.
No sharing. Crew names, coded or not, are never sold, never shared with advertisers and never used for marketing or profiling.

Legal basis: legitimate interest (Art 6(1)(f)) in showing you your own roster in full. We have weighed this against your colleagues' rights: the names are professional data that already appear on rosters inside the airline, they are coded and encrypted, only you can see them, and anyone can ask for removal.

Why we do not write to each colleague named on a roster: we get only a name from the roster, with no contact details. Finding and contacting each person would be impossible in most cases, would take disproportionate effort, and would mean collecting more data about them (Art 14(5)(b) GDPR). Instead we publish this information here and on our erasure page, and protect the names with the safeguards above.

14. Linking accounts between crew (opt-in only)

If you and another CrewMark user have flown together, CrewMark can recognise you in their archive, but only after you opt in. Every new account starts as Hidden.

You can choose one of three levels:

Hidden (default): never linked, never shown
Badge only: members you confirmed as having flown with see a “★ CrewMark member · N flights together” pill next to your name as it is printed on their own roster; nothing else from your account is shown
Badge and name: the same pill, plus your name as you set it in Crew identity when it differs from the printed one

Legal basis: your consent (Art 6(1)(a)). Switching back to Hidden removes your badge at once and stops new links, and you can delete existing links in Settings.

15. Encryption details (technical)

Master key. A 32-byte random secret held in our application server's environment: not in the database, not in source control, not logged.
Per-account keys. Derived with HKDF-SHA256 (info=b"roster-key-v1", salt = your account ID), 32 bytes.
Encryption. Fernet (AES-128-CBC with HMAC-SHA256 and a random IV for each value), which also detects tampering.
Pseudonyms. HMAC-SHA256 with a 32-byte salt per account, stored in our database. The same colleague gets the same code within your archive.
Key separation. The pseudonym salt and the encryption key come from separate HKDF derivations, so leaking one does not reveal the other.

What encryption does and does not do: it protects snapshots if the database or a backup is copied without the key. Our server holds the key, so it can decrypt a snapshot when the app needs to show it to you.

Privacy policy