Privacy Policy
This explains what Crewbound collects, why, and what you can do about it. We've tried to write it in plain English. If anything is unclear, email hello@crewboundapp.com.
Who we are
Crewbound (“we”, “us”) is a trip-planning app for groups of friends. We are the controller of your personal data under UK data protection law. [Operator's legal name and address to be added before launch.] Contact: hello@crewboundapp.com.
What we collect
What you give us
- Account: your email address (to sign you in with a one-time code), the name you choose and your avatar colour.
- Trips: trip names, dates, the places suggested and voted for, itinerary items, packing lists, and who is on the trip.
- Your availability: the days you mark as free, maybe or busy.
- Money records: expenses you add, how they're split, payments you mark as made or received, and deposit settings on trips that use them. We record who owes whom. We don't take or hold payments in the app at the moment, and we never see your card or bank details.
- Private budget: a number you can enter for yourself. Nobody else on the trip, including the organiser, can see it.
- Documents: names, booking references and, if you add one, a file (PDF, JPG or PNG). New documents are visible only to you until you choose to share them with the trip.
- Photos you add to a trip's memories, once that feature is switched on.
- Messages to us: if you email support, we keep the conversation.
What happens automatically
- Basic technical data needed to run the service and keep it secure, such as when you signed in and error reports.
- If you turn on notifications, a device token so we can send them. We only ask when the feature exists.
We don't use advertising trackers, we don't sell your data, and we don't build advertising profiles.
Why we use it
- To provide Crewbound: sign you in, run your trips, and show your group what it needs to see. (Contract.)
- To keep it safe and working: prevent abuse, fix problems and improve the app. (Legitimate interests.)
- To send notifications: only if you switch them on, and you can switch them off at any time. (Consent.)
- To meet legal duties, such as responding to a valid legal request.
Who can see what
- People on a trip can see its plans, votes and the expenses for that trip, and your name and colour.
- Your private budget is only ever shown to you.
- A document marked Only You is only visible to you.
- People who aren't on a trip can't see it. Anyone with an invite link can see a short preview of the trip before joining, so only share links with people you want on the trip.
Who we share data with
We use a small number of companies to run Crewbound. They only handle data on our instructions:
- Supabase, which hosts our database, sign-in and file storage. [Region to be confirmed before launch.]
- Resend, which delivers the sign-in emails.
- Cloudflare, which hosts this website and forwards support email.
- Apple, for the App Store and, when notifications exist, delivering them to your phone.
Some of these companies are based outside the UK. Where data leaves the UK, we rely on approved safeguards such as the UK's international data transfer arrangements.
How long we keep it
- Your account and trips: until you delete your account or ask us to, or the trip is removed.
- Files you upload to documents: deleted 90 days after the trip ends. The document's name and booking reference stay, marked “File removed”.
- Money records: kept while the trip exists, because other people on the trip rely on them. If a trip is cancelled, its money history is kept.
- Support emails: kept for as long as needed to help you, then deleted.
Your rights
Under UK law you can ask us to access, correct, delete, restrict or export your data, and to object to how we use it. To use any of these, email hello@crewboundapp.com from the address you sign in with. We aim to reply within a month.
To delete your account, email us from your sign-in address and we'll remove your account and personal details. Records that other people on a trip rely on, such as a shared expense, may stay in the trip with your name replaced by “Someone”.
If you're unhappy with how we've handled your data, you can complain to the Information Commissioner's Office at ico.org.uk. We'd appreciate the chance to put it right first.
Children
Crewbound isn't for anyone under 13, and we don't knowingly collect their data. If you think a child has signed up, tell us and we'll delete the account.
Security
Data is encrypted in transit, access is limited by who is on each trip, and sign-in uses one-time codes rather than passwords. No service is perfectly secure, so please tell us at once if you think your account has been misused.
Changes
If we change this policy in a way that matters, we'll tell you in the app or by email before it takes effect. The date at the top shows the latest version.