Privacy Policy

1. Who we are

CrewBrief is operated by Max Eriksson (sole proprietor as of this version). Contact for any privacy matter: security@crewbrief.co.

2. What data we collect

2.1 Account data

• Email address
• Display name and personalization (e.g., your chosen bot name)
• Authentication credentials (passkey/WebAuthn public keys; we never store passwords)
• Device identifiers for per-device session tokens

2.2 Health data (only when you opt in to each category)

• Biometrics imported from Apple Health (HRV, RHR, VO2max, HRR, sleep, weight, body composition, steps)
• Bloodwork results uploaded by you (PDF lab reports parsed and structured)
• Body composition entries (manual, RENPHO screenshots, or Apple Health sync)
• Self-reported metrics (caffeine, hydration, alcohol, training sessions, mood)

2.3 Financial data (only when you connect or enter it)

• Bank, credit card, and investment account information you link via Plaid
• Transaction history, balances, account names
• Recurring expenses and budgets you set
• Manual entries for accounts and expenses

2.4 Operational data (pilots only)

• Flight schedules imported from your airline systems or entered manually
• Logbook entries (PDF or AIMS export)
• Credentials and certifications
• Layover locations

2.5 Communication data

• Messages exchanged with the in-app AI chat ("Bob/Joe")
• Telegram chat history (when you connect Telegram)

2.6 Technical data

• IP address (logged for access-log purposes only; not used for advertising)
• Browser type and version
• Timestamps of requests

3. Legal basis for processing

We process your data under the following bases (GDPR Articles 6 and 9):

• Consent for all health data, financial data, and optional features. You can withdraw consent at any time.
• Contract for providing the service you signed up for.
• Legitimate interest for fraud prevention and service security.

4. Where your data lives

As of this version, CrewBrief operates on servers located in Finland (European Union), hosted by Hetzner Online GmbH. Data is transferred to and from your device using TLS 1.3 encryption.

If you are located outside the EU/EEA, your data is transferred to the EU under the Standard Contractual Clauses (SCCs) approved by the European Commission. The SCCs provide GDPR-equivalent protection for the transfer.

Application-layer encryption (AES-256-GCM) protects uploaded documents and the most sensitive structured fields. Full-disk encryption on the database volume is planned for implementation before scaling beyond the initial pilot cohort.

5. Who we share data with

We share only to third parties that are necessary to provide the service:

We do not sell your data. We do not share data with advertising or marketing intermediaries. We do not use your data for credit decisioning, employment decisioning, or insurance underwriting.

6. Family / spouse sharing (opt-in)

If you connect a family or spouse account, you control granular sharing toggles per data category (location, schedule, tasks, nutrition, workouts, sleep, finance, health summary). Bloodwork data is never shared with linked accounts, regardless of toggle state, by default.

7. How long we keep your data

• Account data: until you delete your account.
• Health and financial data: until you delete it or your account.
• Access logs: 90 days.
• Backups: 30 days.
• AI chat history: 90 days, unless you save specific entries.

Full retention details: see CrewBrief's Data Retention and Deletion Policy.

8. Your rights

You can at any time:

• Access your data — full export available via in-app data export.
• Correct your data — edit fields directly in the dashboard.
• Delete your data — request account deletion via Settings → Account → Delete account. We complete deletion within 30 days, with backup purge within 60 days.
• Port your data — receive a copy in a machine-readable JSON format.
• Withdraw consent for specific data categories or AI features.
• Object to processing.
• Complain to a supervisory authority (your local data protection authority).

To exercise any right, email security@crewbrief.co. We respond within 30 days.

9. Cookies & tracking

We use minimal session cookies necessary for authentication (per-device tokens). We do not use advertising cookies, analytics trackers, or cross-site identifiers.

10. Children's privacy

CrewBrief is intended for adults (16+ in the EU, 13+ in the US under COPPA). We do not knowingly collect data from children below these ages. If we learn we have collected such data, we will delete it.

11. Security

We protect your data using the safeguards documented in our Information Security Policy: TLS in transit, AES-256-GCM application-layer encryption at rest for sensitive blobs, two-factor authentication on administrative systems, SSH-key-only access to production, principle of least privilege, and 72-hour breach notification.

A copy of our Information Security Policy is available on request.

12. Changes to this policy

We will notify you of material changes by email and via a dashboard notification at least 14 days before they take effect. Continued use after the effective date constitutes acceptance of the new version. Prior versions are retained for reference.

13. Contact

For any privacy question or to exercise your rights:

security@crewbrief.co
Max Eriksson, Founder
CrewBrief