Privacy policy

Who is responsible

David Lee, trading as Crewroom, 21 Kinnear Drive, EH19 3SQ, United Kingdom, is the controller of the personal data described here. Contact us about anything on this page at support@crewroom.flights.

What we collect, and why

• Your account. Your email address, your password stored as a hash we cannot reverse, whether you have verified your email, and — only if you turn it on — your two-factor authentication secret and recovery codes. We need these to give you an account at all.
• What you tell us about your setup. The platform you fly on, and your SimBrief pilot ID if you choose to link one.
• Your careers. The pilots you create, their employment, ratings, duties and logbook entries, and the flight traces the Companion App uploads from your simulator session when you fly a duty. This is the service.
• Your subscription. We do not see or store your card details. Stripe handles the payment and tells us only what we need to keep your subscription working: an identifier for you in Stripe, the status and dates of your subscription, and the type and last four digits of the card it renews on.
• Technical records. Server and error logs, which include IP addresses, kept so we can keep the service running and secure. Our network provider also tells us which country a request came from; we use it for one thing only, which is choosing the currency a price is displayed in.

We rely on our contract with you for everything needed to run your account and your careers, and on our legitimate interest in a secure, working service for the technical records. Where the law requires consent — for anything optional you switch on — we ask for it and you can withdraw it.

Cookies and tracking

Crewroom sets a session cookie to keep you signed in and a token that protects forms from cross-site abuse. Both are strictly necessary and neither follows you anywhere. Our network provider, Cloudflare, sets a short-lived cookie named __cf_bm that tells its bot protection one browser from another; it identifies the browser, not you, and expires within half an hour.

We use PostHog to see how Crewroom is used. It runs on every page and records page views, clicks and other interactions, the product events we send it (which pages you reach, whether the Companion App you downloaded was installed and paired), and replays of your session — what was on screen and where you clicked, with anything you type masked. While you are signed in this is tied to your account's numeric id, and to nothing else about you: not your email address, not your name. PostHog stores it for us on servers in the European Union, and no one else receives it. This is product analytics — it exists so we can see which pages fail people and fix them — and it is not advertising. We do not build profiles for marketing and do not follow you to other sites.

There is no advertising in Crewroom, and no third-party tracking beyond what this section names. We do not sell personal data, and we never will.

Who else processes your data

• Stripe processes every payment on our behalf and handles your card details under their own privacy policy.
• SimBrief receives your SimBrief pilot ID, and only if you link one, so we can fetch the flight plans you ask for.
• PostHog stores the product analytics described above, in the European Union, under their own privacy policy.
• Sentry receives a report when something in Crewroom breaks — the error, the page it happened on and the technical details needed to fix it, which can include your IP address and account id.
• Our hosting and email providers process data on our instructions to run the service and deliver account emails.

Some of these providers operate outside the country you live in. Where data is transferred internationally, it is covered by the safeguards the law requires, such as standard contractual clauses.

How long we keep it

Your account and career data stay while your account exists. Delete your account and we delete them. Records of payments are kept for as long as tax and accounting law requires — usually six years — because we are not free to delete those on request. Technical logs are kept for a short period and then discarded.

Your rights

You can ask for a copy of your data, ask us to correct or delete it, object to or restrict how we use it, or ask for it in a portable form. Email support@crewroom.flights and we will answer within a month. You can also delete individual pilots, or your whole account, from your settings without asking anyone.

If you think we have handled your data badly, please tell us first — but you have the right to complain to your data protection authority, and in the UK that is the Information Commissioner's Office.

Children

Crewroom is not directed at children, and we do not knowingly collect data from anyone under 16. If you believe a child has given us their data, contact support@crewroom.flights and we will delete it.

Changes to this policy

The current version always lives here with the date it last changed. We will tell account holders by email before a material change takes effect.