Privacy Policy

Last updated: 18 October 2026

This Privacy Policy explains how we process personal data when you visit our website crewnify.app and when you use the Crewnify app for iOS and Android.

1. Controller

Crewnify UG (haftungsbeschränkt)
Am Lehmhof 5
31683 Obernkirchen
Germany
Represented by the managing directors Dennis Talat and Julian Talat
Email: support@crewnify.app

We are not legally required to appoint a data protection officer. Please send any data protection request to the address above.

2. Legal bases

We process personal data on the following legal bases of the General Data Protection Regulation (GDPR):

Where we store information on your device or access information stored there, we do so only if this is strictly necessary for a service you requested (§ 25 (2) no. 2 TDDDG) or with your consent (§ 25 (1) TDDDG).

3. Website

3.1 Hosting and server logs

Our website is hosted on Firebase Hosting, a service of Google (see section 5). When you visit the website, your browser automatically transmits technical data such as your IP address, date and time of access, the requested page, the referring page, browser type and operating system. These data are needed to deliver the website and to keep it secure. Legal basis: Art. 6 (1)(f) GDPR. We do not combine these data with other data.

All fonts are hosted on our own server. Your browser does not connect to Google Fonts or other font services.

3.2 Cookie settings

We store your cookie choice in your browser's local storage so that we do not ask you again on every visit. Details are in our Cookie Policy.

3.3 Google Analytics

Only if you click "Accept all" or enable "Analytics" in the cookie settings, we use Google Analytics 4, a web analytics service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics uses cookies to analyse how our website is used, for example which pages are viewed, how long a visit lasts, which device and browser are used and from which region (derived from the IP address) the visit comes. According to Google, IP addresses are not stored in Google Analytics 4. Data may be transferred to Google LLC in the USA (see section 6). Event data are deleted after 2 months.

Legal basis: your consent (§ 25 (1) TDDDG, Art. 6 (1)(a) GDPR). You can withdraw your consent at any time with effect for the future via "Cookie settings" in the footer.

3.4 Contact, partner and advertising forms

When you use a form on our website, we process the data you enter: name, email address and message, and for partner and advertising requests also company, role, website, partner type, category, locations, budget and your description. The form is processed by a server function on Google Cloud in the USA (region us-central1), stored briefly in our database for sending and delivered by email via Brevo to our team mailboxes, which are hosted with Google Workspace. General enquiries go to support@crewnify.app, partner and advertising requests to partner@crewnify.app. You can also write to these addresses directly.

Legal basis: Art. 6 (1)(b) GDPR for partner and advertising requests (pre-contractual steps), otherwise Art. 6 (1)(f) GDPR (our interest in answering your message). We delete the data once your request has been dealt with, unless statutory retention periods apply (for example up to 6 years for business correspondence under § 257 HGB).

3.5 Newsletter

If you subscribe to our newsletter, we use your email address to inform you about the launch of the Crewnify app and about news from Crewnify. After signing up you receive an email asking you to confirm your subscription (double opt-in). Only after you confirm do we add you to the mailing list. We log the time of sign-up and confirmation to be able to prove your consent. The newsletter is sent via Brevo (see section 5). Brevo records whether a newsletter was delivered and opened and which links were clicked; we use this only to improve our newsletter.

You can also subscribe in the app with the newsletter switch in your profile. Because the email address of your account has already been confirmed, no separate confirmation email is sent there. You can switch it off again in your profile at any time.

Legal basis: your consent (Art. 6 (1)(a) GDPR). You can unsubscribe at any time via the link in every newsletter or by email to us. We then delete your email address from the mailing list.

3.6 Ambassador applications

Applications to become a Local Community Ambassador are collected with Google Forms. If you fill in the form, Google processes your entries for us, and we use them to review your application. Legal basis: Art. 6 (1)(b) GDPR. We delete applications as soon as they are no longer needed for this purpose.

3.7 Instagram

Our website links to our Instagram profile. This is a plain link: no data are transferred to Meta Platforms Ireland Limited until you click it.

4. Crewnify app

4.1 Account and profile

To use the app you need an account. We process your email address and your password, which Firebase Authentication stores only in hashed form, or the identifier of your Apple or Google account if you sign in with Apple or Google. We also process the profile information you provide, such as your name or display name, profile photo, airline, Local Community and any other information you choose to add. Legal basis: Art. 6 (1)(b) GDPR.

4.2 Crew verification

Crewnify is open to airline crew only. To confirm that you work as cabin crew or pilot, you upload verification photos. Before our team reviews them, the photos are checked automatically for signs of AI generation or manipulation by Sightengine, a service of Kozelo SAS, 16 bis rue d'Odessa, 75014 Paris, France. The decision to approve or reject a verification is always taken by a member of our team and not by an automated system. After the review we delete the verification photos and keep only the result and its date. Legal basis: Art. 6 (1)(b) GDPR (verified community) and Art. 6 (1)(f) GDPR (preventing fake accounts).

4.3 Community features

Recommendations, reviews, ratings, photos, posts, comments and meetups that you share are stored with your profile and are visible to other members as intended by the respective feature. Chat messages are visible only to the participants of the chat. Legal basis: Art. 6 (1)(b) GDPR.

If you add photos to a recommendation created by another member, these photos remain part of that recommendation after you delete your account, so that the recommendation stays complete for the community. You can ask us to remove such photos at any time.

4.4 Location

Only if you allow location access in your device settings, the app uses the location of your device to show recommendations near you on the map and to provide other location-based features. We do not create movement profiles. You can withdraw the permission at any time in your device settings. Legal basis: Art. 6 (1)(a) and (b) GDPR, § 25 (1) TDDDG.

4.5 Search

To make members, airlines and airports searchable in the app, we transfer the data needed for the search, for example the display name, airline and profile photo of members, to our search provider Algolia SAS, Paris, France. Legal basis: Art. 6 (1)(b) GDPR.

4.6 Premium subscriptions and in-app purchases

Premium subscriptions are sold and paid through the Apple App Store or Google Play. Apple and Google process your payment data as independent controllers; we do not receive your payment details. To manage subscription status we use RevenueCat, Inc., USA, which receives an app user ID, purchase and subscription information and technical device data from the app and the app stores. Legal basis: Art. 6 (1)(b) GDPR.

4.7 Crew Miles and Miles Shop

We process your Crew Miles balance and a history of the Miles you earn and redeem, so that you can trace your transactions and to prevent abuse of the reward system. Miles Shop vouchers are redeemed directly with the partner. We do not pass your data on to Miles Shop partners; when you redeem a voucher, the partner processes your data as an independent controller under its own privacy policy. Legal basis: Art. 6 (1)(b) and (f) GDPR.

4.8 Notifications and emails

If you allow push notifications, we send them via Firebase Cloud Messaging, for example about messages, meetups or your verification. For this a device token is processed. You can turn notifications off at any time in your device settings. Service emails, for example about your verification, are sent via Brevo. Legal basis: Art. 6 (1)(a) and (b) GDPR.

4.9 Maps and places

The map and the place search in the app use Google Maps Platform. When you use these features, your IP address, the map area you are viewing and your search terms are transmitted to Google. Legal basis: Art. 6 (1)(b) and (f) GDPR.

4.10 Feedback and support

If you send feedback from the app, we receive your message, any screenshots you attach, your display name, email address and airline, and forward them by email to support@crewnify.app so that we can answer you. Legal basis: Art. 6 (1)(b) and (f) GDPR.

4.11 Analytics, crash reports and performance

Only if you consent in the app, we use Google Analytics for Firebase to understand how the app is used, for example which screens and features are used, device type, app version and approximate region. Legal basis: your consent (§ 25 (1) TDDDG, Art. 6 (1)(a) GDPR), which you can withdraw at any time in the app settings.

We use Firebase Crashlytics to detect and fix crashes. A crash report contains technical information about your device, the app version and the course of the error. Legal basis: our legitimate interest in a stable and secure app (Art. 6 (1)(f) GDPR).

We use Firebase Performance Monitoring to measure the technical performance of the app, for example how long the app takes to start, how smoothly screens load and how long network requests take. It processes technical information about your device, the app version and your approximate country, but not the content of what you do in the app. Legal basis: our legitimate interest in a fast and reliable app (Art. 6 (1)(f) GDPR).

4.12 Security

To protect our systems against abuse we use Firebase App Check, which uses Apple App Attest or Google Play Integrity to check that requests come from a genuine copy of our app. Legal basis: Art. 6 (1)(f) GDPR.

4.13 Deleting your account

You can delete your account in the app at any time. We then delete your profile and the personal data linked to your account, except for photos added to other members' recommendations (see 4.3) and data we have to keep for legal reasons. Please cancel an active subscription separately in the App Store or Google Play.

5. Service providers

We use the following service providers, which process personal data on our behalf under data processing agreements (Art. 28 GDPR):

Apple and Google as operators of the app stores, Meta (Instagram) and Miles Shop partners act as independent controllers.

6. Transfers to third countries

Some providers process data in the USA or in other countries outside the EU and the European Economic Area. For transfers to the USA we rely on the adequacy decision of the European Commission for the EU-US Data Privacy Framework (Art. 45 GDPR), where the recipient is certified under it (for example Google LLC), and otherwise on the EU Standard Contractual Clauses (Art. 46 (2)(c) GDPR). You can ask us for a copy of these safeguards.

7. Retention

We store personal data only as long as necessary for the purposes described in this policy. Account data are stored until you delete your account. Where statutory retention periods apply, for example 6 or 10 years under § 257 HGB and § 147 AO for business records, we restrict processing until these periods end and then delete the data.

8. Your rights

You have the right to:

To exercise your rights, write to support@crewnify.app. You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the State Commissioner for Data Protection of Lower Saxony (Der Landesbeauftragte für den Datenschutz Niedersachsen), Prinzenstraße 5, 30159 Hannover, Germany.

9. Right to object

Where we process your personal data on the basis of legitimate interests (Art. 6 (1)(f) GDPR), you have the right to object at any time on grounds relating to your particular situation (Art. 21 (1) GDPR). We will then stop the processing unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. If we process data for direct marketing, you can object to this at any time without giving reasons (Art. 21 (2) GDPR).

10. Is providing data required?

You do not have to provide personal data to visit our website. To create an account and use the app, we need your email address, the profile information marked as required and a successful crew verification; without them we cannot provide the app. All other information is voluntary.

11. Automated decision-making

We do not make decisions based solely on automated processing that have legal or similarly significant effects for you (Art. 22 GDPR). The automated check of verification photos supports our team; the decision is always taken by a person.

12. Age

Crewnify is intended for adults. You must be at least 18 years old to use the app.

13. Changes to this Privacy Policy

We update this Privacy Policy when our services or the legal requirements change. The current version is always available on this page. We will inform you about significant changes in the app.