Privacy Policy

1. Data Collection

CrewSync collects only the information strictly necessary for the app to function.

1.1 Data provided by the user

• Flight rosters and related information, imported from the airline's official PDF, via CrewLink/IADP (GOL), via IADP (ABX Air), via iFlight Crew (LATAM), via CAE Crew Access (AZUL), or entered manually.
• Optional profile information (name, photo, position).
• Connections added by the user (friends, family or other crew members), always with the other party's explicit consent.

1.1.1 Being found by name (on by default, one tap to turn off)

Besides the CrewSync ID, the app lets a crew member be found by display name in the search on the Connections screen. Since September 2026 this feature ships turned on for crew accounts. The reason is practical: while it depended on manual activation, almost nobody turned it on, and a search with nobody to find is of no use to the person searching.

The legal basis is no longer consent; it is now legitimate interest (LGPD, art. 7, IX): letting colleagues in the same profession find each other inside an app built for crew, with the minimum data needed for that and with no exposure to people who are not crew. You have the right to object (LGPD, art. 18, § 2), and exercising it takes one tap.

So that nobody appears in the search without knowing, the app tells you: on entering Connections you see a notice saying that you are appearing, what appears, and with the off switch in the same place. The notice is shown once and your choice is stored with the account. You can also turn it on and off whenever you want under Settings → Privacy. Turning it off removes your name from the search index immediately.

With the feature on, a search shows only your display name, profile photo and airline. It deliberately does not show your CrewSync ID, your base, your roster or any other data. A connection request still requires your acceptance, as always.

Server-side rules prevent directory scraping: the search requires at least three characters, matches only the beginning of words in the name, returns a limited number of results per query and enforces an hourly query limit. Only crew accounts can search and be found; visitor accounts are not part of this directory. People who are already your connection, and anyone you blocked (or who blocked you) in the crew chat, do not appear in the search.

1.2 CrewSync account (email + password)

Sign-in to your CrewSync account uses your personal email and a password created by you, directly in the app. Authentication is processed by Firebase Authentication (a Google Cloud service dedicated solely to validating the login), with traffic protected by Cloudflare. The password is stored encrypted by the authentication provider, never in plain text, and CrewSync has no direct access to it.

Sign-in is used to:

• Securely store your flight rosters in the cloud.
• Sync data across devices (iPhone, iPad, Apple Watch and Android).
• Enable the CrewSync ID, a public key used to share your roster with friends or family upon explicit authorization.

You may, at any time, sign out or permanently delete your account — on iOS, in Settings → Preferences → Danger zone; on Android, in Settings → Advanced options. Deletion removes all your cloud data as well as your account record on the authentication server.

1.3 Optional official integrations (CrewLink/IADP — GOL, IADP — ABX Air, iFlight Crew — LATAM, CAE Crew Access — AZUL)

1.4 Garmin watches app (Connect IQ)

1.5 Aircraft position (radar and aircraft track)

When you use the aircraft track on the Home screen or the aircraft lookup by registration, the app sends the CrewSync server only the aircraft registration and the reference airport. The server fetches the position from public, collaborative ADS-B networks (such as adsb.lol, data under the ODbL 1.0 license) and, when those networks do not cover the region, from the official Flightradar24 API. The flight route comes from public aviation databases. In every case the server sends the sources only the aircraft registration, never the crew member’s personal data.

Aircraft positions are public data, broadcast by the aircraft themselves. These lookups contain no personal data and are not associated with your profile.

1.6 Your profile photo in the crew list

When you look up the crew for a flight, the app shows the list provided by your airline (each crew member's name, staff number, base and seniority). For colleagues who also use CrewSync, their profile photo appears in place of the circle with the role initials.

How it works: the app sends CrewSync's server the staff numbers already present in the airline's list and receives back only the photos of those who are CrewSync users and left this feature enabled. Matching is done by staff number within your own airline — the same staff number at different airlines belongs to different people, and the server never responds with data from another airline. The response contains only the photo, the account identifier and the nickname chosen in the community; name, base and seniority are not returned by the server, because the app already received them from the airline itself.

This feature is enabled by default. You can turn it off at any time in Settings → Privacy (on Android) or Settings → Preferences → Privacy (on iPhone), under “My photo in the crew list”. Once off, your photo immediately stops appearing to colleagues, and you keep seeing the photo of those who left the feature on. The legal basis is your consent, revocable through that same switch; the alternative is the circle with the role initials, as it always was.

The photo is only visible to crew members rostered on the same flight as you, at the same airline, who also use CrewSync. It is not published on any open page, is not indexed by search engines and is not used for advertising. Even so, it is worth knowing: anyone who sees the photo on screen can capture it, as in any app. If you would rather not take that risk, turn the feature off or remove the photo from your profile.

1.7 Health data: Sleep Log (Well-Being)

1.8 Meu RH (GOL): pay envelope

For GOL crew, the app can display your pay envelope by querying the company’s Meu RH portal with the same official sign-in as IADP: your password never passes through CrewSync. Values are shown live, exactly as the portal answered, and exist only in the device’s memory while the screen is open: no copy is saved, nothing is sent to CrewSync servers, and nothing enters statistics, chat or diagnostics. If you download the envelope PDF, the file goes straight to the folder you choose, like any other download of yours, and the app keeps no copy.

2. Use of Data

Data is used only to:

• Organize and display flight rosters.
• Calculate duty periods and rest periods.
• Operate the Connections feature (crew and visitors).
• Show your profile photo to colleagues rostered on the same flight, when that feature is enabled (item 1.6).
• Generate anonymous, aggregated community statistics.
• Display aircraft position (aircraft track and lookup by registration), from public ADS-B data.
• Locally calculate salary and per diem estimates. Salary calculation data is processed entirely on the device and is not sent to CrewSync servers.
• Locally display the Sleep Log and physical activity (Well-Being), entirely on the device, with nothing sent to CrewSync servers. On iPhone the data may come from Apple Health; on Android it is logged by hand (item 1.7).

CrewSync does not sell, rent or share personal data with third parties for advertising purposes.

3. Community Statistics

When you sign in, the operational data of your roster (aggregated totals of hours flown, number of legs, destinations, etc.) is sent to the global community statistics. All signed-in users contribute; viewing rankings and averages is exclusive to premium subscribers. The statistics are fully anonymous, based on aggregated data, and make individual identification impossible. You may delete your cloud data or sign out at any time.

4. Sharing and Disclosure

CrewSync does not sell, rent, share or disclose your personal data to third parties for advertising purposes. The app uses cloud infrastructure services (Firebase Authentication for authentication; Cloudflare D1 + R2 for roster and photo backups; Cloudflare Workers for network protection) — these providers process data on our behalf, under confidentiality agreements and in compliance with applicable data protection law (including Brazil's LGPD).

5. Your Choices and Controls

• Review and edit your profile information in Settings → Edit profile.
• Delete specific rosters or your entire cloud backup.
• Sign out while keeping local data.
• Permanently delete your account, removing your cloud data and ending the authentication record.
• Enable or not the optional official integrations (CrewLink/IADP, iFlight Crew or CAE Crew Access) and end that session at any time.
• Enable or disable showing your profile photo in the crew list, in Settings → Privacy (Android) or Settings → Preferences → Privacy (iPhone) — item 1.6.
• On iPhone, revoke at any time the permission to read sleep and physical activity in Apple Health. On Android there is no health permission to revoke, because the app reads none. On any device, the Sleep Log is deleted via the app’s local data cleanup (item 1.7).

6. Data Security

CrewSync follows a zero-trust security approach:

• Does not collect or store passwords for corporate systems — authentication happens on the airline's own official portal, inside a secure embedded browser.
• Does not access airlines' internal systems without the crew member's explicit consent.
• Stores session tokens only on the device, never on our own servers.
• Uses secure storage and trusted cloud services with encryption in transit (TLS 1.2+) and at rest.
• App integrity verification (Play Integrity on Android and App Attest on iOS): the device sends an anonymous cryptographic attestation proving the request comes from the official app, without identifying the user or the device.

7. User Rights

In line with applicable data protection law (including Brazil's LGPD), you have the right to access your data, correct or update information, delete stored data, and permanently delete your account. All these options are available directly in the app — on iOS, under Settings → Preferences → Danger zone; on Android, under Settings → Advanced options.

8. Data Retention and Deletion

Data is kept only while the account is active or until you request deletion. When you delete your account, the records are removed from the database and the images are removed from storage immediately, with no recovery window. The database (Cloudflare D1) keeps, as a platform feature, an automatic point-in-time recovery window of up to 30 days, used only to restore service after a failure; past that window, the previous state is no longer recoverable.

Deleting your account permanently and irreversibly removes the personal data and schedule associated with it; it cannot be recovered afterward. The user is solely responsible for the decision to delete the account and should make copies beforehand if they wish to preserve their data.

The full step by step, including for those who already uninstalled the app, plus what is deleted and what is retained, is in Delete account and data.

9. App Store Compliance

CrewSync follows the Apple App Store and Google Play guidelines, including minimal and transparent data collection declared in the privacy manifests (Apple App Privacy and Google Data Safety). The app does not use advertising identifiers and does not track you outside CrewSync, and it offers sign-out and account deletion within the app.

10. Changes to this Policy

This Policy may be updated at any time without prior notice; the version published on this page always prevails. Relevant changes may be communicated within the app.

11. Contact

Data protection officer (LGPD, art. 41): contact@appcomin.com. Use it for any request about your personal data: access, correction, deletion, portability, and information about who it is shared with.