CrewRoster is built so that your data stays yours. Your roster, flights, layovers and duty history are stored on your device, and — only if you switch it on — in your own iCloud account. We operate no accounts, no analytics trackers and no advertising, and we cannot see your schedule.
The app makes one outbound connection of its own: a periodic check for an updated airport time-zone table, described below. It sends nothing about you, and nothing in the app depends on it.
Rosters you paste, import as PDF or capture as a screenshot are parsed entirely on your iPhone — including text recognition (OCR), which uses Apple's on-device Vision framework. The parsed duties, flights, hotels and the original roster text are stored in the app's local database on your device and, if you use home-screen widgets or Live Activities, in the app's shared container on the same device. They are never transmitted to us or to any server we operate.
CrewRoster can keep your roster in step across your own devices using your iCloud account. This is off unless you turn it on in Settings.
When it is on, your roster data is stored in a private CloudKit database inside your personal iCloud account, in the same way Notes or Reminders store their data. It is not sent to Mobile Alchemy, and we have no ability to read it — a private CloudKit database is accessible only to the signed-in Apple Account that owns it. We receive no copy, no key and no index.
Apple's handling of iCloud data is governed by Apple's Privacy Policy. Turning sync off stops further uploads; to remove data already in iCloud, sign in to iCloud.com or delete the app's iCloud data from Settings → your name → iCloud on your device.
The roster database is stored with iOS Data Protection set to complete until first user authentication. In practice: the file is encrypted at rest, and its key is unavailable until you have unlocked the device at least once after powering it on. A phone that is off or has not been unlocked since boot does not give up your schedule.
We deliberately do not use the strictest class, which would lock the file whenever the screen is locked. That would break the lock-screen widget and the next-report countdown — the two things you are most likely to read while the phone is locked — and would stop report reminders being scheduled in the background. The ceiling here is set by the features, and we would rather say so than imply more than we do.
Calendar files you export get the same protection, are replaced rather than accumulated, and any left over from a previous session are deleted when the app next starts. A file that no longer exists cannot leak.
If you enable calendar sync, CrewRoster writes your duties into a dedicated calendar on your device using Apple's EventKit. The app updates and removes only events it created. Calendar contents are governed by your device and any calendar accounts you configure (e.g. iCloud) under Apple's Privacy Policy; CrewRoster itself sends nothing to us.
Roster-change alerts and report-time reminders are local notifications, scheduled and delivered entirely on your device.
CrewRoster shows every roster time in the local time zone of the airport it happens at. It does that with an airport table built into the app. About once a week, and only over an unmetered Wi-Fi connection, the app asks a server we run whether a newer version of that table exists.
What is sent: the request itself, and nothing more. No roster, no flights, no home base, no device or advertising identifier, no account — there is no account. Our server sees the connecting IP address, as every web server does; there is nothing in the request to tie it to you, and we keep no profile of who asked.
What comes back: a public reference list of airports — IATA and ICAO codes, names, IANA time zones and coordinates. It is cryptographically signed, and the app verifies the signature before it will use a single line of it. Anything that fails that check is discarded and the previous table kept.
Nothing depends on it. The built-in table ships complete and works with no network at all. If the check never runs — airplane mode, a metered connection, a server of ours that is down or gone — the app behaves exactly as it does with the check disabled. The update is an improvement, never a requirement.
If you purchase CrewRoster Pro, payment is processed by Apple. To validate purchases and manage entitlements the app may use Adapty, which processes your Apple transaction information and a random app-install identifier on our behalf. Adapty does not receive your roster, flights or any schedule data. You can request deletion of purchase-profile data via the support contact below.
Calendar files (.ics) you export are generated on your device and shared only where you choose to send them (e.g. your family's calendar, iCloud Drive). We never receive a copy.
All roster data lives on your device: deleting an import in the app, or deleting the app, removes it. If you enabled iCloud sync, a copy also lives in your own iCloud account until you delete the app's iCloud data from your device settings or iCloud.com. Purchase records held by Apple are governed by Apple's terms; Adapty purchase-profile data can be deleted on request.
CrewRoster is not directed at children under 13 (or the equivalent minimum age in your jurisdiction) and we do not knowingly collect personal information from them.
Depending on where you live (e.g. GDPR in the EU/UK, CCPA in California), you may have rights to access, correct, delete or port personal data. Because your data is stored on your device (and, if you enable sync, in your own iCloud account) and we hold none of it, you can exercise these rights directly in the app and in your Apple Account settings; for purchase-profile data, contact us below.
We will post any changes to this policy on this page with an updated effective date.
Mobile Alchemy · richard@techkudos.com