Crew Privacy Policy

Effective 3 November 2026

Who this policy covers

This policy explains what Crew ("we", "us") does with your personal information when you use the Crew mobile app on iOS or Android, and when you read the pages published at getcrew.web.app. It applies to the app and to the servers behind it, and to nothing else — a link somebody sends you in a chat leads out of Crew to a service with its own policy.

Crew is published and run by an independent developer rather than a company. Under the EU and UK General Data Protection Regulation that developer is the controller of the personal data described here, and is reachable at the email address in "How to reach us" at the end of this policy. Write to that address for anything in this policy, to exercise any right described in it, or to ask for a postal address for correspondence.

We have not appointed a Data Protection Officer. Crew's processing does not meet the conditions in Article 37 of the GDPR that make one mandatory: we are not a public authority, we do not monitor people on a large scale, and we do not process special categories of data as a core activity. Requests go to the address above and are answered by the person who runs the service.

What we collect

Only what the app needs to do its job. Everything below is something you give us, something the people you use Crew with give us, or something the app has to record to work at all.

Account details

Your email address, the display name you choose and the handle you claim. If you sign in with Google, we receive your name and email address from Google instead of a password. If you sign in with Apple, we receive the name and email address you let Apple share — which may be a private relay address Apple forwards to you — and nothing else. Passwords are handled by Firebase Authentication and are never visible to us. Your email address is held by Firebase Authentication, not on your profile, and is never shown to anyone in the app. If you change your email address, we send a confirmation link to the new address, and nothing changes until you follow it.

Your profile

Your photo or chosen avatar and how you framed it, your birthday if you add one, the language the app is in, the currency new crews start in, and your settings — notifications, tones, muted and pinned chats, who may message you, your privacy choices, and the like. Your profile itself can be read only by you. What other people see is your card: your name and handle, your photo, and the day and month of your birthday — never the year. In Profile → Privacy you choose who sees your photo (everyone, your contacts and crews only, or nobody) and whether your birthday is shared at all.

Your address book — only when you ask

Crew reads your address book only when you tap Check my contacts in Find people and then agree on the screen that explains the upload, and only the email addresses in it. Those addresses are uploaded to our servers once, compared with the verified sign-in addresses of people who have turned on Find me from contacts, and dropped: they are not stored or logged, and no names, numbers or other details leave your phone. What comes back is the Crew card of each match. Crew no longer asks for or keeps phone numbers; earlier versions let you add a number so that people who had it could find you, and those numbers, and the directory they were kept in, are being deleted from our servers.

Crews and private chats

The name, emoji, picture and settings of each crew you are in, who is in it, who owns and administers it, and the invite code or link that lets somebody join. Anyone holding a crew's invite code can join that crew and read what is written in it from then on, so treat it as you would a door key. Private chats between two people, and the message requests that start them, are kept the same way.

Messages and what you send

What you write in a chat and what you send with it — photos, short videos, voice notes, documents, stickers, polls, invitations to a game, the preview card of a link, the Crew card of somebody you share, and anything you share into Crew from another app or forward from another chat — together with what you are replying to, reactions, pins, and messages you schedule for later, which are kept until they are sent or you cancel them. Deleting a message blanks it for everyone in the chat and deletes the file attached to it. If a chat has disappearing messages turned on, each message is deleted from our servers once its timer runs out.

Games

When you play chess or another game from the Games shelf, we record who is playing, each move, the score and how the game ended, and post a card and a result line in the chat. In card and tile games the hand dealt to you can be read only by you, and the shuffled deck and any hidden role are held by our servers, where nobody in the chat can read them; our servers, not the phones, check each move. Other people in the chat can watch a game, say who they think will win, and send cheers — which the players and the other watchers see — and write in the game's own chat. In Who said it?, our servers pick a few plain text messages the players themselves sent in that chat over the last weeks — never a deleted or disappearing one, one held back from somebody who blocked its author, or one from before a player cleared the chat — and show them, without the name, to the players in the same chat, who already had them. A game is part of the chat it was played in and is kept with it. Whether game sound is on, which games' rules you have already seen, and which stories you have sent a heart to are remembered on your phone only.

Stories

A photo, or a few words on a coloured background, that you put up as a story; who you chose to show it to; and which of them have watched it. You choose the audience each time — all your contacts, only the people you pick, or all your contacts except the people you leave out — and nobody else can open it. A story disappears after 24 hours and is then deleted from our servers, with its picture, within about an hour. The audience you last chose is remembered on your phone, not on our servers. Replying to a story sends a private message to the person who posted it.

Plans and the crew's life together

The plans suggested in a crew — title, place, date and time, who proposed it, who is in, out or undecided — the reminders we send before one starts, a plan's bring list, whose turn it is, and an "on my way" note, which is a status you post and not your location. After a plan, whoever marks it done can tick who actually came; that attendance is what the reliability streak on a member's profile in that crew counts. Polls, bets (nothing is staked — a bet records only which side was right), quick check-ins, streaks and recaps are worked out from the crew's own activity and shown only inside that crew.

Money

What an expense was for, its amount and currency, who paid, how it is split, and any receipt photo attached; recurring expenses and trips; and the settlements you mark as sent and the other person confirms, with any photo you choose to attach as proof. You can put people who are not on Crew into a split as guests: we keep the name you type for them, so only add somebody who would be happy to be named. This is bookkeeping only. Crew moves no money, is not a payment service, and never asks for a card or a bank account. An earlier "How to pay me" option let people put bank details on their profile; it is switched off, and the details given are being deleted.

Guests from an invite link

Somebody who opens a crew's invite link without the app can join that crew as a guest by typing a name — no account, no email, no password. We keep that name on the crew's books, the answers they give to the crew's plans, and a link that is theirs alone, which we keep only as a scrambled fingerprint that cannot be turned back into the link. The crew's members see the name and the answers as they see any guest's, and the person who sent the invite is told they arrived. When the guest installs Crew and opens their link again, all of it moves to their own account and the guest is gone. A guest who wants to leave can ask any member to take them off the books.

Watching and listening together

When your crew watches a video or listens to music together, we record which video or song is playing, where it is up to, who is in the room, and the reactions sent there, so every phone stays in step. The room is part of the crew and is kept with it, like the crew's chat. You can also listen or watch on your own and let your contacts join you; that room is kept under your account instead of a crew. While you listen or watch, your contacts see the song or video title on your row, unless you turn that off in Profile → Privacy, where you also choose whether they can join you.

Contacts, requests, blocks and reports

Your contacts on Crew, and the message requests you send and receive. If you block somebody, we keep a copy of their name and picture as they appeared at that moment, so the blocked list can still be read. If you report somebody, we keep what you told us and a copy of the message it was about.

Notifications, presence and device

A push notification token for your device, the platform it runs on (iOS or Android), and the time you were last active. A copy of each notification is kept in the bell on Home for 30 days. To show the little signs a messenger shows, we also record whether you are online or busy, when you are typing in a chat, and when a message reached your phone and when you read it. Your online status and last seen are shown only to your contacts, and you can hide them in Profile → Online status — if you do, you stop seeing theirs too. That a message was delivered and read is shown to the people in that chat — unless you turn read receipts off in Profile → Privacy. Then when you read a chat is kept on your profile, where only you can see it, and you stop seeing when other people read yours.

Keeping the service safe

To stop spam and abuse, the app proves to our servers that it is the genuine Crew app on a real device — using Apple's App Attest and DeviceCheck on an iPhone and Google Play Integrity on Android — and we count how many times each account uses certain features in a day, such as searching for people, so that daily limits can be applied. Like any internet service, our providers see your device's IP address when the app connects; it appears in server logs, which are kept for 30 days, and is not stored with your account.

Photos, camera and microphone

Only the photos and videos you pick or take, and only when you pick them. When you open the camera in a chat, your recent photos are shown from your phone so you can choose one; only what you send is uploaded. The microphone is used only while you record a voice note or a video — from the moment you start recording until you send or cancel it. The camera is also used to scan a crew's invite code or somebody's Crew code; the scan is read on your phone. Photos are saved to your gallery only when you ask, or when you turn on auto-save.

App lock and locked chats

If you turn on App lock or lock a chat, your phone checks that it is you with Face ID, Touch ID, your fingerprint or your phone passcode. That check happens entirely on your phone: we never receive your face, your fingerprint or your passcode, nor learn whether a check passed. Which chats you have locked, and the secret code that finds them, stay on your phone too — the code only as a one-way scrambled form (a hash) — and never reach our servers. A locked chat is still an ordinary chat for everyone else in it, and its notifications are not hidden by the lock.

Calendar

Only if you allow it. Crew adds a plan to your phone's calendar when you ask it to, and when a crew asks who is free it can look at that one time slot to tell you whether you are busy. The look happens on your phone; nothing from your calendar is sent to us or to your crew.

Tapping phones — approximate location

Only if you use Tap phones to connect with somebody standing next to you, and only if you allow location. While that screen is open, your phone's motion sensor feels for the tap on the phone itself. At the moment of a tap, the app sends our servers the time and your approximate location, so that your phone is matched with the one you tapped and not with a stranger tapping at the same second somewhere else. It is used for nothing else, is never shown to anyone, and is deleted automatically, normally within a day.

Support messages

If you email support from inside the app, the draft includes the app version, your device platform, your account id and how many crews you are in, so we can reproduce what you are seeing. You can delete any of that from the draft before sending it. If you use Send feedback or Report a safety concern inside the app instead, what you write is stored with your account id, the app version and your device platform; only the team that runs Crew can read it.

Apart from tapping phones, we do not collect your location. We do not use advertising identifiers, and we do not track you across other companies' apps or websites. Crew contains no third-party advertising or analytics SDKs, and asks for no permission it does not use in front of you.

We do not ask for sensitive information — about health, religion, beliefs, sexuality or the like — and we do not look for it. If you choose to write about such things in a chat, it is stored as part of that chat like anything else, and seen only by the people in it.

Why we use it, and on what legal basis

Under Article 6 of the GDPR every use of your personal data has to rest on a legal basis. These are ours, purpose by purpose.

To run the app — performance of a contract, Article 6(1)(b)

Signing you in, connecting you with the people you choose, putting you in crews, and storing and syncing the messages, plans and expenses you create so they are there on every device you use. Without this there is no service to provide, and asking for consent to it would be a pretence.

To notify you — consent, Article 6(1)(a)

Sending the push notifications you switched on: a message (your turn in a game comes with these) or a message request, a plan proposed or a reminder before one starts, an expense or a settlement waiting on you. Each category can be switched off on its own in Profile → Notifications, and all of them at once in your phone's settings. Withdrawing this changes nothing else about your account.

Photos, camera, microphone, calendar, location and Apple Music — consent, Article 6(1)(a)

Asked for by your phone, at the moment it is needed, and withdrawable in your phone's settings at any time. Refusing any of them leaves the rest of the app working.

What other people record about you — legitimate interests, Article 6(1)(f)

When the people you use Crew with mention you — add you to a split as a guest, share your Crew card, tick that you came to a plan, remember your birthday — that rests on their interest, and ours, in letting a group of friends keep its own record together. It goes no further than the crew it is recorded in, and you can object to it — see "Your rights".

To keep accounts and crews safe — legitimate interests, Article 6(1)(f)

Checking that requests come from the genuine app, applying daily limits, preventing abuse, acting on the reports people file, enforcing our Terms of Use, and keeping the service standing up. Our interest is in an app where a group of friends is not exposed to strangers, spam or harassment; we have weighed it against your interests and it goes no further than the checks, reports and account records needed to act. You can object to this at any time — see "Your rights".

To answer you — performance of a contract and legitimate interests, Articles 6(1)(b) and (f)

Reading and replying to the support messages you send us, and fixing what they report.

To meet legal obligations — Article 6(1)(c)

Keeping records we are required to keep, answering lawful requests from authorities, and meeting the child safety reporting duties described in our Child Safety Standards.

The device checks and daily limits described above are automatic, but all they ever do is pause an action; they have no legal or similarly significant effect on you. We do not make decisions about you by automated means within the meaning of Article 22, and we do not profile you.

We do not use your messages, photos, plans or expenses to train machine learning models, our own or anybody else's.

Who can see it

The people in your chats

Everyone in a crew or a private chat can read what is written in it, see its plans and its books, and see your card. Unless you turn read receipts off, they can see when you have read a message; in a crew, they can see your attendance record there. That is the purpose of the app. Nobody outside that chat can see any of it.

People who look you up

Somebody who types your exact handle or your exact email address, scans your Crew code, or taps phones with you can see your name and handle — and your photo, if you show it to everyone — and send you a message request. They are not shown your email address, and they see nothing else until you accept. If you turn on Find me from contacts in Profile → Privacy — it is off until you do — somebody who has your verified email address in their contacts and checks them sees the same card. In Profile → Privacy you can turn off being found by email; in Profile → Who can message you, you can take messages from your contacts only; and you can block anybody.

Your contacts

Somebody you have accepted as a contact sees your card as you have chosen to share it, the stories you choose to show them, and — unless you hide them — whether you are online, when you were last seen, and what you are listening to or watching. They see nothing else until you are in a chat together. Your email address is never shown to anyone.

Google (Firebase)

Crew runs on Google's Firebase platform — Authentication, Firestore, Cloud Storage, Cloud Functions, Cloud Messaging and App Check. Google acts as our processor under Article 28: it processes this data on our documented instructions, under Google's Cloud Data Processing Addendum, and does not use it for its own purposes.

Delivering notifications

Notifications reach an iPhone through Apple Push Notification service and an Android phone through Firebase Cloud Messaging. A notification carries what it shows on your lock screen — usually the sender's name and the first words of a message — so Apple or Google carry that text on its way to you, as they do for every app.

Device checks

Apple (App Attest and DeviceCheck) and Google (Play Integrity) are asked to confirm that the app on your device is the genuine Crew app. They do not receive your messages or your account details.

Google Sign-In and Sign in with Apple

Only if you choose one of them, and only to verify who you are at sign-in.

Websites you link to

When you paste a link into the composer, your own phone fetches that page once to build the preview card — the way other messengers do it. Everyone else in the chat reads the card from the message and never opens the page, but the card's picture — like a video thumbnail or an album cover elsewhere in the app — is loaded from the site that hosts it, so that site sees a request from each phone that shows it, as it would if the link were opened.

YouTube, when you watch together

A watch party plays the video in YouTube's own embedded player, using YouTube API Services. You choose what to watch by pasting a link or picking one of Crew's suggestions; Crew does not search or browse YouTube. The player runs on your phone and talk to YouTube directly, so YouTube's Terms of Service (youtube.com/t/terms) and Google's Privacy Policy (policies.google.com/privacy) apply to what YouTube sees. We send YouTube nothing about you or your crew.

Apple, when you listen together

Finding songs, the charts and the short previews come from Apple's public music catalogue, asked for by your phone with nothing but the search words and your country. On an iPhone with an Apple Music subscription, whole songs play through Apple Music on your own account, with your permission; we never see your Apple ID or your library.

Exchange rates

To convert an expense from another currency, your phone and our servers read the day's rates from a public rates feed (open.er-api.com). The request carries no information about you or your expenses.

Law enforcement and child safety bodies

We disclose information where the law compels us to, and no further than it compels. Reports of child sexual abuse and exploitation are handled as set out in our Child Safety Standards, which includes reporting to the competent authorities.

We do not sell your personal information, we do not share it for cross-context behavioural advertising, and we do not pass it to data brokers. There is nobody else in this list.

How it is protected

Everything in transit is encrypted with TLS, and everything at rest is encrypted by Google Cloud with keys it manages. Every read and write is checked against security rules enforced on the server: a chat's messages, plans and money can be read only by the people in it, and your profile only by you — so an altered app on somebody's phone cannot reach past them.

Access to production data is limited to the person who runs the service, protected by two-factor authentication, and used only to operate the app or to answer a request you have made.

Crew does not offer end-to-end encryption, and we will not describe it as if it did: we hold the keys, which is what makes it possible to serve your history to a new phone and to act on an abuse report. Treat a chat as private between its members, not as a channel we are technically unable to read.

No system is perfect. If a breach ever affects your personal data we will notify the competent supervisory authority within 72 hours as Article 33 requires, and tell you directly where Article 34 requires that too — and, where another country's law applies to you, we will notify its regulator and you as that law requires.

Where it is stored, and transfers out of Europe

Our servers are run by Google Cloud in the United States. If you live anywhere else, your data is transferred there so that the app can work.

Where personal data leaves the European Economic Area, the United Kingdom or Switzerland, the transfer relies on the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum) as incorporated into Google's Cloud Data Processing Addendum, together with the technical measures described above. Google LLC is also certified under the EU–US Data Privacy Framework. You may ask us for details of the safeguards that apply to your data by writing to the address below.

Where the law of another country — for example Saudi Arabia's Personal Data Protection Law or the United Arab Emirates' Personal Data Protection Law — governs a transfer out of it, we rely on the same contractual and technical safeguards, and on the transfer being necessary to give you the service you signed up for.

How long we keep it, and how to delete it

We keep your account and what you have written for as long as your account exists. Beyond that:

Your account

Deleted when you delete it, from Profile → Your Profile → Delete Account inside the app — or, if you no longer have the app, by emailing us from the address your account signs in with. Step-by-step instructions for both, and for deleting only some of your data, are at getcrew.web.app/delete-account. Deletion takes you out of every crew and private chat, hands on any crew you own, releases your handle for somebody else to claim, and removes your profile, your photo, your contacts, your blocks, your notification history, your stickers, your stories, your scheduled messages and your device token. It cannot be undone.

What you wrote in a chat

Your messages are blanked everywhere — the words, photos, videos, voice notes, documents, contact cards and link cards — and the files attached to them are deleted. Quotes of your messages inside other people's replies are blanked too. What remains is a line saying a message was deleted, so the conversation keeps its shape for the people still in it.

Plans, polls and games

Plans, polls, votes, attendance and the games played in a chat belong to the crew's shared record and stay with it. Your name is no longer attached to them.

Money you were part of

Expenses and settlements are kept, with their receipt photos. An expense somebody paid for is a fact the rest of the crew still owes each other over, and erasing it would rewrite what other people are owed. Your name is no longer attached to it — what remains is an id that nobody's member list resolves any more.

Short-lived records

Disappearing messages go when their timer runs out, and stories 24 hours after they go up. Notifications stay in the bell for 30 days. Whether you are online or typing is overwritten as it changes. A tap between two phones, and the approximate location sent with it, is deleted automatically, normally within a day.

Safety records

Reports you filed or that were filed about you are kept for two years, so that a pattern of behaviour is still visible to whoever moderates, and are then deleted automatically. Deleting an account is not a way to withdraw a report.

Support email

Kept for up to two years in the support mailbox so we can follow a conversation up, then deleted. Messages sent with Send feedback or Report a safety concern are kept for two years too, then deleted automatically.

Server logs

Operational logs from the servers are kept for up to 30 days and then discarded automatically.

Google's own deletion

When something is deleted, Google Cloud removes it from its systems, backups included, on its standard deletion schedule, which can take up to about six months to complete. Nothing waiting to be removed is used for anything in the meantime.

If you want everything associated with you erased outright, including the records above where the law allows it, write to us and we will do it and tell you what we could not remove and why.

Your rights

If the EU or UK GDPR applies to you, you have all of the following rights. Most of them you can exercise yourself, in the app, without asking us.

Access — Article 15

Ask for a copy of the personal data we hold about you and what we do with it. Write to us and we will send it.

Rectification — Article 16

Correct anything wrong. Your profile is editable in the app at any time, in Profile → Your Profile.

Erasure — Article 17

Delete your account from Profile → Your Profile → Delete Account, or write to us; how to do either, and how to delete only some of your data, is at getcrew.web.app/delete-account. What survives deletion, and why, is set out under "How long we keep it" above.

Restriction — Article 18

Ask us to stop using your data while a dispute about it is sorted out.

Objection — Article 21

Object to anything we do on the basis of legitimate interests — including what other people have recorded about you in a crew. We will stop unless we can show compelling grounds that override your interests.

Portability — Article 20

Ask for the data you gave us in a machine-readable form, or ask us to send it to somebody else where that is technically feasible.

Withdraw consent — Article 7(3)

Notifications, photos, camera, microphone, calendar, location and Apple Music access can each be withdrawn in your phone's settings, at any time, without affecting the rest of the app and without affecting anything done before you withdrew.

Complain — Article 77

Complain to the data protection authority where you live, work, or where you think something went wrong. In the EU the list is published by the European Data Protection Board at edpb.europa.eu; in the UK it is the Information Commissioner's Office at ico.org.uk. We would rather you came to us first, but this right does not depend on that.

Write to the address below to exercise any of these. We answer within one month, as Article 12(3) requires, and free of charge. If a request is unusually complex we may take up to two further months, and we will tell you inside the first month if that happens. We may ask you to confirm the email address your account signs in with, so that we are not handing your data to somebody else.

Wherever you live — including under Saudi Arabia's Personal Data Protection Law, the United Arab Emirates' Personal Data Protection Law, Brazil's LGPD and similar laws — you can ask us for access to your data, a copy of it, its correction or deletion, and you can withdraw any consent you gave. We answer every request as we would under the GDPR, whatever law you rely on, and you can complain to the data protection authority where you live — in Saudi Arabia, the Saudi Data & AI Authority (SDAIA).

If you are in California, you also have the right to know, delete and correct your personal information, and the right not to be discriminated against for exercising it. We do not sell or share your personal information, and we do not use sensitive personal information to infer anything about you.

The website

The pages at getcrew.web.app — this policy, our Terms of Use, our support page, our child safety standards and our account deletion page — are plain static documents. They set no cookies, run no analytics, embed no fonts, images or scripts from anywhere else, and make no request off the page. There is no consent banner because there is nothing to consent to. Our host records ordinary server logs, including IP addresses, for security and reliability, and discards them on Google's own schedule.

The invite pages — the links Crew shares, at getcrew.web.app/j/… and getcrew.web.app/g/… — are drawn by our servers when they are opened, so that they can show a crew's name, its plans and a guest's balance. They too set no cookies, run no analytics and load nothing from anywhere else; their one line of script shows times in your own time zone. So that nobody can fill a crew with made-up guests, we count how many guests and answers come from each IP address in a day. The count is kept under a scrambled fingerprint of the address and the day, never the address itself, and is deleted the next day.

Children

Crew is not intended for children. You must be at least 16 years old to hold an account in the European Economic Area and the United Kingdom, and at least 13 years old elsewhere, or older where your local law sets a higher minimum age for consent to online services.

We do not knowingly collect personal information from anyone below that age; if we learn we have, we close the account and delete its data. If you believe a child has created an account, write to us and we will act on it. Our full child safety standards, including how to report child sexual abuse and exploitation, are published at getcrew.web.app/child-safety.

Changes to this policy

If we change this policy we will update the effective date at the top and publish the new version at the address below. If a change materially affects how we handle your information, we will tell you in the app — before it takes effect, where the change is to your disadvantage — so that you can decide what to do about it. Previous versions are available on request.

How to reach us

Questions about this policy, requests about your data, or anything else: email us and a person will read it. We answer data protection requests within one month, and ordinary support within a few days.