Privacy & Security Policy

The CrewSuite Family

This policy covers CrewCalc (web, iOS, and Android) and CrewBook (iOS and the current Android version). Sections that name CrewCalc apply to CrewCalc. CrewBook's iOS and Android behavior is described separately because the two versions do not yet have the same cloud features.

Every mention of CrewBook below means the CrewSuite-connected edition, distributed as CrewBook IPA, which can sign in to a CrewSuite account and exchange flight records with CrewCalc. CrewBook by FHG is a separate, standalone build with no CrewSuite account, no CrewSuite cloud backup, and no CrewCalc exchange; nothing in this policy describes it, and its privacy policy is published at farhorizongroup.com/apps/crewbook/privacy.

CrewBook on iOS

• Your logbook, military record, medical and certificate records, aircraft and people directories, attachments, and settings are stored in CrewBook's app storage on your device.
• Files you choose to import, including LogTen and ForeFlight exports, military JSON, and IFRR PDFs, are read and parsed on the device. IFRR image recognition uses Apple's on-device Vision framework.
• If CrewCalc is installed on the same Apple device, the apps can exchange flight (OOOI) records through Apple's private App Group container. This App Group exchange stays on that device.
• At launch, CrewBook writes backup files in its local Documents folder. When iCloud Drive is available for CrewBook, it also automatically copies the plaintext full JSON backup to CrewBook's iCloud Drive folder. Original attachment files are stored locally and are also mirrored to that iCloud Drive folder on a best-effort basis. These iCloud Drive files are not wrapped in CrewBook's CrewSuite encryption envelope and are handled under your Apple/iCloud settings.
• Reports, exports, and manual backup files are shared only when you choose a destination or use the system share sheet. A copy saved to a cloud-backed Files location may be uploaded by that storage provider.
• CrewSuite Cloud is optional. You can create or sign in to the same CrewSuite account used by CrewCalc. Account requests send the username, salt and key-derivation settings, a password-derived authentication verifier, and an optional GEMS number to the CrewSuite server. The password itself is not stored or sent.
• While signed in, CrewBook encrypts its full JSON backup on the device with AES-GCM and a password-derived key, then uploads the encrypted envelope to CrewSuite Cloud. Launch-time upload is automatic and best-effort. The server stores ciphertext plus operational metadata such as the blob name, version, size, modification time, request time, and network address; it cannot decrypt the backup without the password-derived key. Attachment file bytes are not included in this encrypted backup.
• CrewSuite Cloud is backup and restore, not live record-by-record sync. Restoring a backup requires confirmation and replaces the local CrewBook records covered by that backup.

CrewBook on Android

• CrewBook on Android stores its database in the app's private storage on the device. It offers CrewSuite sign-in with an existing CrewSuite account; the password is used on the device to derive keys and is not stored or sent. Account creation is not offered on Android — create the account in CrewCalc or in CrewBook on iOS or macOS.
• While signed in, CrewBook Android encrypts its backup on the device and uploads the encrypted envelope to CrewSuite Cloud, in the same way as CrewBook on iOS and macOS described above. The server stores ciphertext plus the same operational metadata; it cannot decrypt the backup without the password-derived key.
• Android does not use Apple's App Group OOOI exchange. While signed in, CrewBook on Android can exchange flight (OOOI) records with CrewCalc through encrypted data stored with your CrewSuite account; without an account, it receives data through a CrewBook backup restore or supported LogTen and ForeFlight file imports.
• CrewBook Android lets you manually store FAA medical certificate records, including examination date, certificate class, whether an ECG was included, and an optional examiner note. This feature is for recordkeeping only: CrewBook is not a medical device and does not diagnose, treat, cure, or prevent any medical condition. Consult a qualified healthcare professional for medical advice, diagnosis, or treatment.
• The app does not use Health Connect, body sensors, health permissions, or a health SDK. FAA medical data is stored and processed only in CrewBook's private on-device database and is not transmitted to CrewSuite or collected by the developer.
• Restoring a compatible iOS or Android CrewBook backup imports its FAA medical rows and medical-owned attachment metadata. Android backup JSON includes those medical rows and metadata so they can be restored on iOS or Android. Attachment metadata can include the related record identifier, filename, label, and creation date; the attachment file bytes are not included in or restored from the JSON backup.
• Imports are read on the device through Android's system document picker. CrewBook reads only the file you select.
• Reports and exports are created only when you choose a destination through Android's system file picker. Available plaintext files include logbook, experience, FAA/IACRA-summary, and military PDFs; LogTen-compatible tab-separated data; military JSON; and a CrewBook JSON backup. Depending on the export, these files may include your pilot name, flight dates, routes, aircraft, crew names, remarks, totals, military records and notes, certificates, FAA medical records, settings, and supported attachment metadata. Attachment file bytes are not included in the Android backup.
• If you choose a cloud storage provider as the destination, that provider may upload the exported file; CrewBook does not upload it to CrewSuite. Exported files remain at the destination after you close or uninstall CrewBook and must be deleted there when you no longer want them.
• Android OS-managed cloud backup and device-transfer backup are disabled for CrewBook. To move or preserve Android data, create a CrewBook backup and keep it in a location you control.
• FAA medical records and other local data remain until you delete them in CrewBook, replace the database through a confirmed restore, clear the app's storage, or uninstall CrewBook. Uninstalling removes the private local database. Reports, tab-separated exports, military JSON, and backup files you exported remain wherever you saved them and must be deleted separately.

CrewBook Analytics & Advertising

CrewBook on iOS and Android does not include analytics, advertising, or cross-app tracking SDKs, and CrewSuite does not sell CrewBook data. Network activity on iOS is limited to the optional account and encrypted CrewSuite backup behavior described above, plus Apple's handling of iCloud Drive.

What CrewCalc Handles

• Financial data you enter or import, including paychecks, pay rates, tax figures, annual statements, and deduction assumptions.
• Military pay and retirement data, including LES-derived values, service dates, points, grade, and retirement assumptions.
• Trip, fatigue, OOOI, accrual, retirement, Snapshot/bid-pack, and seniority information you choose to enter, import, or sync.
• Documents, PDFs, photos, screenshots, or pasted text that you explicitly choose to import or analyze.

CrewCalc Encrypted Sync

• CrewCalc stores your username and encrypted blobs for settings, ledger, annual records, military records, bidding/Snapshot state, retirement facts, trip data, accrual records, OOOI records, seniority preferences, and optional sleep records.
• Your password is not stored. It derives separate authentication and encryption keys in the browser or app.
• User vault data is encrypted before upload. The server stores encrypted blobs that it cannot decrypt without the password-derived encryption key.
• If you lose your password, CrewCalc cannot recover or decrypt your saved encrypted data.

CrewSuite Account Administration

• For CrewCalc accounts and optional CrewBook iOS accounts, admins can see account usernames, an account-linked GEMS number when one was supplied, blob app/name, blob sizes, versions, and modified times.
• Admins may delete or download encrypted blobs for support, account, or maintenance purposes.
• Admins cannot read encrypted CrewCalc data or encrypted CrewBook backups without the user's password-derived encryption key.

CrewCalc Documents & Uploads

• Text-backed PDFs, pasted text, and supported images are parsed locally where the platform supports it.
• Image-only PDFs may ask for explicit server OCR consent. If you approve, that document is uploaded in plaintext for OCR processing for that upload.
• Snapshot and bid-pack PDFs are uploaded to the CrewCalc server for parsing into Snapshot datasets.
• Raw bid-pack PDFs are not stored inside the encrypted user vault unless a future attachment workflow is added.
• HEIC/image conversion may use local conversion where available; any server conversion is limited to the selected file and should be treated as plaintext processing for that action.

CrewCalc Local App Data

• iOS and Android store app data locally on the device. Mobile sync, where enabled, uses the same encrypted vault model as the web app.
• File and photo access happens only when you pick a file, image, or document to import.
• CrewCalc does not use advertising SDKs and does not sell user data.
• CrewCalc does not collect web history, contacts, messages, or device advertising identifiers. Optional crash and diagnostic reports are described below.

Seniority & Reference Data

• Seniority and Snapshot datasets may be maintained as shared reference data for app features.
• CrewCalc stores personal seniority preferences inside encrypted settings. If you provide a GEMS number to create, claim, or find a shared CrewSuite account, the server receives it and may retain its association with that account.
• Raw GEMS numbers are not intended to be published in public seniority reference datasets.

Retention & Deletion

• Local app data remains until you delete it in the app or uninstall the app. Uninstalling does not remove files you exported, iCloud Drive files, or an optional CrewSuite server backup.
• On CrewBook iOS, Sign Out removes the stored account credentials from that device and keeps the local logbook. It does not delete the shared CrewSuite account or its server backup.
• You can delete a shared CrewSuite account and its stored CrewCalc and CrewBook encrypted blobs yourself from CrewCalc on iOS or Android, or by emailing [email protected]. CrewBook does not provide account deletion inside CrewBook. The steps and exactly what is deleted are on the account deletion page. Account deletion affects every CrewSuite product using that account.
• Account deletion does not remove local, exported, or iCloud Drive copies. Delete those copies separately through the app, Files, iCloud Drive, or the storage provider where you saved them.
• CrewBook Android signs in with the shared CrewSuite account; deleting that account removes its encrypted server backup. Uninstalling removes the app's private data; exported reports and data files remain at the destination you selected.
• Limited operational and security logs may be retained after account deletion when reasonably necessary to protect the service, investigate abuse, or meet legal obligations.

CrewCalc on Android: accounts, sleep, diagnostics and purchases

CrewCalc on Android requires a CrewSuite account. Account requests send your username, an account-linked GEMS employee number, authentication proofs and session information over HTTPS. Your password and vault encryption key are not sent. The service also receives account usage counts, synchronization metadata and ordinary network and security records, including IP addresses. These support account access, synchronization, subscription limits and service security.

Sleep is optional. CrewCalc Android 0.4.1 (6) does not request Health Connect permissions or read or write Health Connect data. Earlier Android versions offered a read-only sleep import. Updating preserves sleep already saved in CrewCalc, its source information, and your saved source choices; those saved records can still support the sleep and fatigue features according to those choices. Manual sleep entry and sleep screenshot import remain available.

Saved sleep stays in the app's private storage unless you enable Sync sleep to my CrewSuite account, which is off by default, or separately choose to send a full diagnostic report as described below. Account sync encrypts sleep records, source information and correction history on your device before sending them to CrewSuite for compatible devices signed in to the same account. The server cannot decrypt the synchronized vault data. Turning sync off stops that device's sleep synchronization and does not delete earlier server or other-device copies. Account deletion removes encrypted server data, including sleep. It does not erase other devices' local data or previously exported copies.

For older versions that access Health Connect, revoke Sleep in Android's Settings → Security & privacy → Health Connect → App permissions → CrewCalc. The update itself does not delete records from Health Connect or previously saved CrewCalc history.

Crash and diagnostic reports require a choice for each report. CrewCalc records crash evidence locally. After a detected crash, you may decline to send anything, send crash details with app and device information, or send a full report. A full report also includes a readable diagnostic copy of saved CrewCalc data, including pay, schedule, trip, retirement and sleep information; saved notes; imported-file names; and information about the apps that supplied sleep records. The report removes credential fields, account-username and GEMS fields, and retained source-document text. Parsed records remain, and an account fingerprint can help match reports from the same account; the report is not anonymous.

Consented reports are sent over HTTPS to Far Horizon Group's support service at contrails.farhorizongroup.com to investigate and fix CrewCalc problems. This is separate from encrypted vault sync: support can read a full report. Pending reports are encrypted on the device and can retry the same consented content while CrewCalc can run and storage is unlocked. They expire seven days after consent and are removed when the app can next run and unlock storage. You can retry or delete pending reports in Settings → Diagnostics. The seven-day period applies to the pending local copy. Delivered reports are deleted after the support service's bounded retention period, which defaults to 90 days. Deleting the CrewSuite account does not automatically delete reports sent to this accountless support service.

Google Play purchases. When you use a Google Play subscription, CrewCalc sends purchase and restoration information, including a purchase token, to the CrewSuite server for verification. The service processes product, plan, purchase-status, renewal and entitlement information and associates the purchase with your CrewSuite account. A pseudonymous account identifier is supplied to Google Play to bind the purchase to that account. Google handles your payment method; CrewCalc does not receive your payment-card details. Subscription transaction records may remain after account deletion to support restoration and prevent reuse of a purchase across unrelated accounts. Deleting CrewSuite does not cancel a store subscription; manage or cancel it in Google Play.

Android imports use on-device text extraction; original PDFs and images are not uploaded by these import flows. Calendar access is used to create and maintain CrewCalc events in the calendar you select. A calendar or file-storage provider you choose may synchronize those events or exported files under its own settings. CrewCalc has no advertising or third-party analytics SDK. Optional diagnostic reports are used for troubleshooting, which Google Play includes under its Analytics purpose.

Contact

For privacy or security questions, contact [email protected].