Privacy Policy

1. Who we are

CrewBrief is operated by Max Eriksson (sole proprietor as of this version). Contact for any privacy matter: security@crewbrief.co.

2. What data we collect

2.1 Account data

• Email address
• Display name and personalization (e.g., your chosen bot name)
• Authentication credentials (passkey/WebAuthn public keys; we never store passwords)
• Device identifiers for per-device session tokens

2.2 Health data (only when you opt in to each category)

• Biometrics imported from Apple Health on iOS, or Health Connect on Android (HRV, RHR, VO2max, HRR, sleep, weight, body composition, steps)
• Bloodwork results uploaded by you (PDF lab reports parsed and structured)
• Body composition entries (manual, RENPHO screenshots, or Apple Health / Health Connect sync)
• Self-reported metrics (caffeine, hydration, alcohol, training sessions, mood)

2.2.1 How we handle health and fitness data

Health and fitness data is the most sensitive information CrewBrief holds, and it is treated accordingly:

• Read only what you grant. CrewBrief reads health data from Apple Health (iOS) or Health Connect (Android) only after you explicitly grant access, and only the specific data types listed above. You can revoke access at any time in Apple Health, in Health Connect, or in your device settings — CrewBrief keeps working, with the features that depend on that data honestly marked as unavailable.
• What we write back. With your permission, CrewBrief writes workouts you log in the app back to Apple Health or Health Connect so they count toward your activity rings/goals. We write nothing else.
• What it is used for. Health data is used solely to provide the features you asked for — recovery and fatigue scoring, sleep analysis, training guidance and nutrition targets. It is processed for your account only.
• We never sell it. Health and fitness data is never sold, never shared with data brokers, never used for advertising or marketing, and never used to build cross-app or cross-site profiles.
• We never share it with third parties other than the infrastructure providers that host and process data on our behalf under contract (see §4). No health data is shared with advertisers or analytics networks.
• Deletion. You can delete your health data with the rest of your account at any time (see §7). Deleting data in CrewBrief does not delete it from Apple Health or Health Connect, which remain the system of record on your device.
• Health data is not medical advice. CrewBrief is a wellness and operations tool, not a medical device, and does not diagnose or treat any condition.

2.3 Financial data (only when you connect or enter it)

• Bank, credit card, and investment account information you link via Plaid
• Transaction history, balances, account names
• Recurring expenses and budgets you set
• Manual entries for accounts and expenses

2.4 Operational data (pilots only)

• Flight schedules imported from your airline systems or entered manually
• Logbook entries (PDF or AIMS export)
• Credentials and certifications
• Layover locations

2.5 Communication data

• Messages exchanged with the in-app AI chat ("Bob/Joe")
• Telegram chat history (when you connect Telegram)

2.6 Technical data

• IP address (logged for access-log purposes only; not used for advertising)
• Browser type and version
• Timestamps of requests

3. Legal basis for processing

We process your data under the following bases (GDPR Articles 6 and 9):

• Consent for all health data, financial data, and optional features. You can withdraw consent at any time.
• Contract for providing the service you signed up for.
• Legitimate interest for fraud prevention and service security.

4. Where your data lives

As of this version, CrewBrief operates on servers located in Finland (European Union), hosted by Hetzner Online GmbH. Data is transferred to and from your device using TLS 1.3 encryption.

If you are located outside the EU/EEA, your data is transferred to the EU under the Standard Contractual Clauses (SCCs) approved by the European Commission. The SCCs provide GDPR-equivalent protection for the transfer.

Application-layer encryption (AES-256-GCM) protects uploaded documents and the most sensitive structured fields. Full-disk encryption on the database volume is planned for implementation before scaling beyond the initial pilot cohort.

5. Who we share data with

We share only to third parties that are necessary to provide the service:

We do not sell your data. We do not share data with advertising or marketing intermediaries. We do not use your data for credit decisioning, employment decisioning, or insurance underwriting.

6. Family / spouse sharing (opt-in)

If you connect a family or spouse account, you control granular sharing toggles per data category (location, schedule, tasks, nutrition, workouts, sleep, finance, health summary). Bloodwork data is never shared with linked accounts, regardless of toggle state, by default.

7. How long we keep your data

• Account data: until you delete your account.
• Health and financial data: until you delete it or your account.
• Access logs: 90 days.
• Backups: 30 days.
• AI chat history: 90 days, unless you save specific entries.

Full retention details: see CrewBrief's Data Retention and Deletion Policy.

8. Your rights

You can at any time:

• Access your data — full export available via in-app data export.
• Correct your data — edit fields directly in the dashboard.
• Delete your data — request account deletion via Settings → Account → Delete account. We complete deletion within 30 days, with backup purge within 60 days.
• Port your data — receive a copy in a machine-readable JSON format.
• Withdraw consent for specific data categories or AI features.
• Object to processing.
• Complain to a supervisory authority (your local data protection authority).

To exercise any right, email security@crewbrief.co. We respond within 30 days.

9. Cookies & tracking

We use minimal session cookies necessary for authentication (per-device tokens). We do not use advertising cookies, analytics trackers, or cross-site identifiers.

10. Children's privacy

CrewBrief is intended for adults (16+ in the EU, 13+ in the US under COPPA). We do not knowingly collect data from children below these ages. If we learn we have collected such data, we will delete it.

11. Security

We protect your data using the safeguards documented in our Information Security Policy: TLS in transit, AES-256-GCM application-layer encryption at rest for sensitive blobs, two-factor authentication on administrative systems, SSH-key-only access to production, principle of least privilege, and 72-hour breach notification.

A copy of our Information Security Policy is available on request.

12. Changes to this policy

We will notify you of material changes by email and via a dashboard notification at least 14 days before they take effect. Continued use after the effective date constitutes acceptance of the new version. Prior versions are retained for reference.

13. Contact

For any privacy question or to exercise your rights:

security@crewbrief.co
Max Eriksson, Founder
CrewBrief