Privacy notice
CrewDeviate is operated by Far Horizon Group LLC. For privacy questions or requests, email [email protected].
Flight searches
When you search, the app sends the origin and destination airports, departure date, whether to include the following day, and your selected arrival or departure time to our schedule service. We use these details to find and order flight options. Your CrewSuite username, roster, password, airline selections and private connection buffers are not included in the schedule-search request. Airline selections and buffers are applied on your device.
Our server requests airport schedules and time windows from AeroDataBox through our service account. Those provider requests do not include your CrewSuite credentials or roster. We temporarily cache normalized schedules and search parameters to reuse recent results and reduce repeated requests. On iPhone and iPad, search requests also carry signed Apple purchase information to verify access. On Android, they carry the Google Play integrity information described under Android search access. Cached search parameters remain readable and search operations can be linked to a pseudonymous access identity; we do not describe these requests as anonymous.
Subscriptions and complimentary searches
On iPhone and iPad, Apple processes subscription purchases and payments. CrewDeviate does not receive your payment-card details or Apple Account password. The app sends signed Apple app-purchase information and, when applicable, signed subscription transaction information to our service. We verify these records with Apple to determine subscription access. No CrewSuite account is required for subscriptions. The Android app does not currently offer subscriptions or make purchases through Google Play.
On iPhone and iPad, we derive a keyed pseudonymous identifier from Apple’s app-purchase identity and environment. We retain that identifier, its lifetime count of successful complimentary searches, and minimal search-operation records to enforce the four-search allowance and avoid counting a retried search twice. Reinstalling the app does not reset the allowance. Operation records contain random identifiers, keyed request fingerprints, completion state and times, and for up to seven days the result returned; they are linkable to that pseudonymous identity. We retain these limited records for the service’s operation, separately from expiring flight results. Signed Apple proofs are processed for verification and are not written to application logs.
On iPhone and iPad, subscription status is checked with Apple and may be cached for up to sixty seconds, never beyond the verified access deadline. On every platform, an unfinished search is retained locally with its operation identifier and public route/date request until it can be reconciled; this file is excluded from device backup and, on Android, from device-to-device transfer. We use this purchase and usage information for app functionality, access control and fraud prevention, not advertising.
Android search access
The Android app uses Google Play Integrity, a Google service, to show that it may use live search. When you open or return to the app (no more than about once every 15 minutes), and with each search, the app asks Google Play for a single-use integrity token and sends it to our schedule service. The token is signed by Google. It reports the app's package name, version and signing certificate and whether Google Play recognizes that app, the app's Google Play license status (whether it was installed or updated from Google Play), whether the device passes Google's integrity check, the time of the request, and a code that ties the token to that one request. It does not include your name or a Google Account identifier. Our server sends the token to Google to decode it and checks the result. When the app starts, it also prepares the integrity service in advance.
Each of these requests also carries an install identifier: a random identifier the app creates on first use and keeps in its private storage. It is not a Google Account identifier, advertising identifier, hardware identifier or location. It is excluded from Android backup and device-to-device transfer, so reinstalling the app, clearing its storage or moving to a new device creates a new one.
We use the integrity token and install identifier only to verify that the app was installed from Google Play, to count the four complimentary searches and to prevent abuse. Neither is written to our logs or stored as received. We keep a keyed pseudonymous identifier derived from the install identifier (computed with a secret server key; the install identifier itself is not kept), the time it was last used, its count of successful complimentary searches and the search-operation records described above. Opening the app and searching both count as activity. We keep a one-way hash of each token so it cannot be used twice; it is normally deleted within about an hour. After 90 days without activity, the count and last-used time are deleted unless a search is still being completed. Search-operation records, which contain the keyed identifier, are kept as described above. To limit repeated verification attempts, our server counts recent attempts by IP address in memory; those counts are not written to storage.
Google processes the integrity check under its own terms; see the Google Play Integrity API terms. We do not use this information for advertising.
Service providers and diagnostics
Cloudflare delivers and protects traffic, and Hetzner hosts our schedule server. Network requests expose technical information such as IP addresses and request metadata to these services. They may process and retain technical or security records under their applicable policies. Our schedule host records response status and timing in its access log, without the client IP address, URL or request body in that log. Those status logs rotate daily with fourteen rotated files retained. Aggregate provider-usage counters remain for service budgeting and reliability.
AeroDataBox may retain the API request and our server IP and service-account information for access management, operation and monitoring. This is our server's provider connection, not a direct connection from your device. Provider practices are described in the AeroDataBox privacy policy, Cloudflare privacy policy and Hetzner privacy policy. Their retention periods are separate from our active schedule-cache expiry.
Information on your device
The app stores your selected airline mode, home airports, timing preferences and airline selections locally. Saving an option keeps a local route/date entry and temporarily cached flight details. CrewDeviate does not upload these saved entries to an account or provide its own synchronization service. Ordinary device backups may include preferences and saved entries; provider-cache files are marked to be excluded from backup. On Android, Android backup and device-to-device transfer may include preferences and saved entries; provider-cache files and the search-access files (including the install identifier and any unfinished-search record) are excluded.
Searching does not request your device location, contacts, photos, microphone or health data. Airport entries describe the travel you are searching for, not a device-location reading.
Optional CrewSuite connection for UPS
This connection is available in the iPhone and iPad app. The Android app does not include it; its UPS features are limited to the rule checks. General flight search needs no CrewSuite account. If you choose UPS and connect an existing CrewSuite account, CrewDeviate sends your username or GEMS ID to the CrewSuite service to locate the account. Your password is used on-device to derive authentication and decryption material. This client sends a derived authentication proof rather than the raw password.
To remember the connection, the app stores your username, authentication proof and decryption key in its private device Keychain. This record is not shared with other apps or synchronized by CrewDeviate. The app downloads your existing encrypted roster and decrypts it locally. The imported roster and session token remain in app memory. The bridge does not create an account or write roster changes back to the service.
The existing CrewSuite service holds account identifiers, encrypted data and operational metadata for authentication and account administration. See the CrewSuite account privacy information for its account practices. For account-data or deletion requests, contact [email protected]. Identity may need to be verified; deleting a shared account affects other CrewSuite products using it. The steps and exactly what is deleted are on the CrewSuite account deletion page.
Retention and your choices
Our active server schedule-cache records expire no later than six days and twenty-three hours after acquisition. An hourly cleanup normally removes them within seven days. Expired records are not reused. This limit describes the active schedule cache; it does not describe aggregate counters, support correspondence, account records or service-provider security records.
On your device, flight details stop being usable at their recorded expiry and are removed when the app runs its cleanup checks. Basic saved route/date entries and preferences remain after those details expire. Settings lets you change preferences. This version does not provide individual saved-entry deletion. Deleting the app removes its app-container files; offloading or restoring a device backup can retain or restore some information. On Android, uninstalling the app removes its files, and restoring an Android backup can restore preferences and saved entries.
On iPhone and iPad, use Disconnect in the CrewSuite connection screen to remove this app's remembered connection and clear its imported roster from the active session. If cleanup fails, use the retry control. Disconnect before deleting the app if you want to remove its saved Keychain connection. Disconnecting does not delete your upstream CrewSuite account, upstream roster or independent saved flight options.
Contact us to ask about access, correction or deletion of information we hold about you. We may need to verify your identity and may retain limited information when needed for security, account administration or legal obligations. Shared schedule-cache records are separate from the pseudonymous access identifiers. Search-operation records may link a completed search to such an identifier; we do not receive the name or email of your Apple Account or Google Account.
External websites and support
Airline and travel-search links open your browser or another app. A travel-search link may include the route and date. The destination service handles that visit under its own practices. If you email support, we receive your address and whatever message or attachments you choose to send. Correspondence is handled through email providers and retained as needed to respond and maintain ordinary business records. Do not send passwords, authentication material or full rosters.
Advertising and updates
The current iPhone, iPad and Android apps have no advertisements or advertising SDK and do not request an advertising identifier. We do not use CrewDeviate information for cross-app advertising tracking. We will update this notice when these practices change and identify its revision date above.