CrewNexo Privacy Policy

Last updated: 18 October 2026 · Version: 0.8

CrewNexo helps airline crew manage their roster, share selected information with friends, and use crew conversations, meetups, jump seat requests and line offers. This policy covers the CrewNexo iOS and Android apps, including beta releases, the CrewNexo service and this privacy page. Available features depend on your app version and the features enabled for your account.

CrewNexo is independent of the airlines. Your use is voluntary; your employer does not operate CrewNexo or receive your private roster through an employer dashboard.

1. Who is responsible

The controller of your personal data is SilkIdea s.r.o., company number 07990073, registered office Kosova 1242/1c, Suchdol, 165 00 Praha 6, Czech Republic ("we", "us").

For privacy questions, support, or a request to exercise your rights, write to crewnexo@silkidea.com. You can also write to our registered office.

2. Information on your device and roster imports

Original roster PDFs are imported and parsed on your device. The apps do not upload the original PDF file to CrewNexo.
Parsed roster data is uploaded automatically after onboarding and when your roster changes. This is separate from sharing with friends. The upload contains the parsed roster, including your identity and staff number, duties, flights, times, stations, hotel details, remarks and other fields present in the parsed document. Our server removes other crew members' entries from flight crew lists and participants from ground activities before storing the roster. Those entries can therefore reach our server during transmission, even though they are removed before storage. Free-text remarks may still contain personal information.
Your airline password and sign-in sessions are used on your device to access the airline's own sign-in and roster services. A saved password is protected by iOS Keychain or encryption using Android Keystore. CrewNexo does not receive your airline password. The airline and its sign-in providers process your login under their own policies.
Calendar exports are written to the calendar you choose. Your calendar provider may sync them under its own settings and policy. Deleting your CrewNexo account does not remove those exported entries.
Photos selected for chat are resized and re-encoded on your device to remove embedded EXIF metadata, including GPS coordinates, before upload. Anything visible in the picture itself remains visible to its recipients.
Link previews and external sites may be fetched directly by your device. The destination can receive your IP address, the requested URL and ordinary connection information. Weather requests sent to our aviation weather service contain an airport code and connection information such as an IP address; they do not include your CrewNexo profile or full roster.

3. Information we process and why

Information	Purpose and normal visibility
Account and device identifiers, platform, device name, authentication token records and sign-in times	Create and secure your account and link your devices. These are not displayed to other users.
Work email, verification messages, current and previous staff numbers, airline and verification status	Verify and renew crew access, recognise your own roster and prevent duplicate identities. Email and staff numbers are not part of the friend plan view. Older beta builds may use a tester account without work-email verification.
First and last name, sharing name, crew code, role and profile picture	Identify you in the service. Your sharing name, crew code, role and picture can appear to friends, invitation recipients and other users in the features you use.
Home country, languages, primary language and feature preferences	Localise the app and select relevant event audiences, offers and notifications.
Gender and date of birth, if you provide them	Optional profile information. Sharing is off by default; you choose the audiences in your profile. You can remove the information or change its visibility.
Uploaded roster revisions and derived duties, flight participation and night-stop stations	Synchronise and combine your roster history, provide approved friend views, identify flights and relevant crew features, and support jump seat requests, line offers and presence matching. Importing a newer revision does not automatically delete older revisions.
Friend connections, invitations and sharing scopes	Enforce who can see your plan or availability and for which dates.
Event details, membership, invitations, messages, reactions, shared files and media, delivery/read information and read-receipt preferences	Provide conversations, groups and meetups. Event details can be visible to the audience selected for the event; conversation content is available to its authorised members, including members who join later where the feature permits access to history.
Jump seat requests, line offers, responses and confirmation records	Match relevant requests and offers and record what the participants agreed. Visibility follows the feature's audience and participation rules.
Notification tokens and iOS Live Activity duty timelines	Deliver notifications and update your duty display, including when the app is closed.
Content reports, support messages, request/error information and abuse-prevention records	Respond to support requests, review reported content, secure the service and troubleshoot problems. Connection information includes IP addresses; registration limits use a hash derived from the IP address.
Beta invitations, installation and usage information, crash reports and feedback made available by the testing platform	Administer the beta, investigate faults and improve CrewNexo. See section 7.

We receive information from you and your devices, from rosters you import, from users who invite you, communicate with you or report content, and from the beta distribution platforms.

We do not sell personal data, display advertisements, use advertising identifiers or track you across unrelated apps and websites. CrewNexo does not use your device's GPS location. Presence matching uses roster stations and dates; these can still reveal where you are expected to be.

4. Sharing and access

Friends: you approve the sharing scope and date range. A Plan view includes selected duty and flight information and night-stop stations; it excludes crew lists, hotel details and roster notes. Availability shows a reduced view. Friend only does not share your days. These limits concern what your friend receives, not what the server processes for your account.

Crew and events: flight participation, event audiences and the relevant feature rules determine who can find or interact with you. Disabling friend sharing does not by itself remove you from conversations, requests or events you have joined. Do not post roster screenshots or information about colleagues unless you are entitled to share it. Recipients can save, screenshot or forward content; revoking access cannot recall copies they have already made.

Service access: authorised people operating CrewNexo may access data where necessary for support, maintenance, security, content-report review or legal obligations. We may disclose necessary information to professional advisers or competent authorities where legally required or necessary to establish, exercise or defend legal claims.

5. Providers, locations and security

Our application server and database are hosted by Hetzner Online GmbH in Germany. Encrypted chat pictures are stored in Hetzner Object Storage in Falkenstein, Germany. Restricted recovery copies may also be held by the operator in the EU. Verification and support email use the SilkIdea mail service hosted through onice.io; email also passes through your own mail provider.

Apple Push Notification service (APNs) and Google Firebase Cloud Messaging (FCM) deliver notifications. Notification payloads can contain a conversation title, sender information and a short message preview. APNs also carries duty information for iOS Live Activities. These providers therefore process more than a device token. Use your notification and lock-screen settings to control what is shown on your device.

Apple, Google and their service providers may process data outside the European Economic Area, including in the United States. Their published transfer arrangements include EU standard contractual clauses and, for eligible Google transfers, the EU–US Data Privacy Framework. Details and ways to obtain information about the safeguards are in the Apple Privacy Policy, Firebase privacy information and Firebase data processing terms. Contact us for information about transfers concerning your CrewNexo data. Hosting the main database in Germany does not mean all processing stays in the EU.

Traffic between the apps and CrewNexo uses HTTPS/TLS. Stored message text is encrypted on the server with a separate key for each conversation. Chat pictures are encrypted on your device with AES-256-GCM before upload; the object store holds encrypted files.

Parsed roster content and the stored details derived from it for flight participation and stays are encrypted at rest using AES-256-GCM. Matching flights, places and duty days uses keyed lookup fingerprints rather than storing those lookup values as plain text in the matching indexes. Selected account/profile fields, including names, email addresses, date of birth and profile pictures, are also encrypted at rest.

Encryption does not cover every database field. Some identifiers and operational metadata, such as account IDs, roster date ranges, staff numbers, crew codes and account preferences, remain readable in the database. The service decrypts the protected content when needed to provide the features you use.

These protections are not irreversible anonymisation. Rosters remain linked to your account, and the service can process their contents. Removing other people's crew-list entries before storage reduces the information we retain about them, but does not make your own roster anonymous.

This is not end-to-end encryption: the CrewNexo service holds or can retrieve the keys needed to deliver messages and pictures. Encryption does not prevent authorised service access. Access controls and restricted operational access provide additional protection.

6. Legal bases and required information

Providing the service — GDPR Article 6(1)(b): account access, roster processing and synchronisation, sharing you request, conversations, events, offers and related notifications. Without the information required for a particular feature, we cannot provide that feature. You do not have to use the social features.
Your consent — Article 6(1)(a): optional gender and date-of-birth information and its optional disclosure. Remove the fields or turn off their sharing in your profile, or contact us to withdraw consent. Withdrawal does not affect processing that was lawful before withdrawal.
Legitimate interests — Article 6(1)(f): securing the service, preventing abuse, handling reports and support, administering the beta and diagnosing faults. Our interests are a safe, functioning service and improving the beta. You can object on grounds relating to your situation.
Legal obligations — Article 6(1)(c): where we must respond to a valid legal requirement or fulfil data-protection obligations.

CrewNexo does not make solely automated decisions that produce legal or similarly significant effects on you. Matching or eligibility suggestions do not constitute an airline's approval of a roster change or jump seat.

7. Beta testing data

For TestFlight, Apple automatically provides us with crash and usage information and may provide your tester name, invitation email, device and operating-system details, installation information and feedback. Feedback can include screenshots you choose to send. We use this information to administer testing, investigate issues and improve CrewNexo. See TestFlight & Privacy for Apple's collection and retention, including which information is collected automatically.

If you test through Google Play, Google processes your testing participation and may make crash, diagnostic and feedback information available to us according to your Google settings and its Privacy Policy. The use of FCM for Android notifications is separate from advertising or cross-app tracking.

Avoid including passwords, full rosters or unnecessary information about other people in screenshots or feedback.

8. Retention and deletion

Account, profile, uploaded roster history and account settings: kept while your account exists, unless you remove or correct particular information earlier. A new roster does not erase your old revisions. Account deletion removes the account, profile, devices, roster revisions and sharing connections from the live database when the deletion request succeeds.
Direct chats and friend groups — storage: each message and its associated files, attachments and media are retained on the server for six calendar months after the message was sent, then removed by scheduled cleanup. This covers pictures and other media formats where supported. The conversation itself, its membership and settings can remain.
Other event chats — storage: messages and their associated files, attachments and media are removed by scheduled cleanup six calendar months after the event ends, using its start time if no end is recorded. The retention period is tied to the event, so content may remain stored for more than six months from its individual sending date when an event continues for a long time. An upload that is never attached to a message is removed after one day, on the next successful cleanup. Deleting an account does not restart these storage periods; earlier deletion can apply to a valid erasure request, user-deleted content, moderation or a legal requirement.
Other event, request, offer and confirmation records: the chat-content cleanup does not automatically delete these records. We retain them while needed to operate the feature, show participation or agreement history, resolve a report or dispute, or establish, exercise or defend legal claims. We delete or de-identify information once those purposes no longer require it; some account-linked records are removed by account deletion.
Security records, technical logs and verification/support correspondence: kept only while needed to check verification, diagnose the issue, prevent abuse or resolve the relevant report, request or legal claim. The beta does not apply one automatic deletion period to all of these records. Routine rate-limit records use short cleanup windows, normally about one day.
Beta feedback and diagnostics we retain: kept while needed to investigate the reported issue and validate the fix or administer your participation, then deleted or de-identified unless a legal obligation or claim requires retention. Apple's and Google's own retention is described in their policies.
Backups: automatic server backups use a 14-day retention threshold and are removed by the scheduled daily cleanup after that threshold is exceeded. Separate recovery exports are managed manually and kept only while needed for recovery, then replaced or deleted. Deleted data may remain in these restricted copies until their removal; they are not used as an active account. If a backup is restored, applicable deletion requests must be reapplied.
Offline copies of friends' plans: removed at the next successful sync after access ends, or when the app next checks a cached copy older than 31 days. Revocation cannot instantly erase an offline device or independent screenshots and exports.

Deleting your account does not automatically delete messages or pictures already sent to other members: they remain subject to the chat periods above. The service removes the link to your deleted profile and no longer supplies your profile name as the author; the content may still identify you. Ask us if particular content also needs erasure. Local PDFs, calendar exports and copies held by recipients are separate from your server account. Removing the app alone does not delete your account.

9. Your choices and rights

Use More › Account › Delete account in the app and confirm the deletion, or email crewnexo@silkidea.com to request deletion without the app. You can contact us even if you no longer have access to your original work email or your beta account did not have a verified email. Include your account email or another account identifier if you know it; do not send passwords or roster PDFs. We may need proportionate information to verify that the account is yours. Verified deletion requests are carried out without undue delay, subject to the retention and legal exceptions described above. See Delete your account for the steps and the effect on your data.

You can also stop friend sharing, change optional profile visibility, leave supported conversations and control notifications in the app or device settings.

Under the GDPR, where applicable, you can request access to your data, correction, erasure, restriction of processing and a portable copy of data you provided. You can withdraw consent and object to processing based on legitimate interests. These rights are subject to the conditions and exceptions in the GDPR, including other people's rights. We normally respond within one month; if a lawful extension is needed, we will explain it within that month.

You may complain to the Czech supervisory authority, Úřad pro ochranu osobních údajů, through uoou.gov.cz, or to the supervisory authority where you habitually live, work or believe a violation occurred.

10. Children and changes

CrewNexo is intended for working airline crew and is not directed at children under 16. If you believe a child has provided personal data, contact us.

We will update this page and its effective date when the policy changes. We will bring material changes to testers' attention through the app or an appropriate direct notice. Where a new use requires consent, we will request it before that use begins.