Privacy notice
What CrewPal keeps, where, and why — in plain English. Last updated 3 October 2026.
The short version. Your Titan password never leaves your phone. Your roster stays on your phone. The only things that reach our server are what you choose to share with other crew: places, reviews, photos, messages, and your location only while you have switched it on in a chat.
Who we are
CrewPal is an unofficial app made by Ben Thompson, a Titan Airways captain, for Titan crew. It is not a Titan Airways product and Titan Airways is not responsible for it. For the shared features described below, the data controller is Ben Thompson. You can reach us at contact@crewpal.app.
On your phone, and nowhere else
Most of what CrewPal does happens entirely on your iPhone. None of the following is sent to our server.
- Your Titan login. Your username and password are kept in the iPhone’s Keychain and are only ever sent to Titan’s own websites — the Raido crew portal and EFOS — exactly as your browser would. For EFOS, the app opens EFOS’s own sign-in page and you complete the Duo step yourself.
- Your roster, changes to it, your EFOS leave, balances and bids, and the sign-in cookies EFOS gives your phone.
- A crew directory built from the crew listed on your own roster — the names, crew codes and contact details the portal already shows you — and, only if you allow it, matches against your own address book. It stays on the phone and is never uploaded.
- Alarms, widgets and the watch app, which read the roster on your phone.
Deleting the app removes all of it. Signing out of Titan in the app removes the login from the Keychain.
What our server holds
CrewPal’s shared features — Places, crew chat and the standby watch — run on a server in London that we operate. It holds only what those features need.
| What | Why |
|---|---|
| Your account: your Titan email address, a display name, when you last used the app, when you agreed to the crew usage policy, and any warning or suspension an administrator has recorded. | To know you are Titan crew, show your name on what you post, and keep the shared spaces fair. Sign-in codes are stored only as a one-way hash and expire within minutes. |
| Places: the places, reviews, photos, suggested corrections and edits you post, marked with your name. | That is the point of Places. City pictures come from Wikimedia and contain no personal data. |
| Crew chat: the messages and attachments you send, who is in each conversation, polls, anyone you have blocked, and the flights you are on (flight number, date and route) used to put you in the right trip chat. | To deliver messages to your crew and no one else. Your block list is not shown to anyone else, administrators included, and the people on it are not told. |
| Live location: your position, only while you have switched sharing on inside a chat. | So the crew you are meeting can find you. It is shared with that chat’s members only, and deleted the moment you switch it off. |
| Hotel stay reports: the hotel, the date, your ratings and remarks, with your name, email address and crew code. | So that what crew say about a hotel can be acted on, and you can be asked about it. |
| Standby windows: the start and end times of your standby duties, if you turn the standby watch on. | So the server can quietly wake your phone to check for a callout. No roster content is sent. |
| A push-notification token for your device. | To send you notifications you have allowed. |
| Reports and moderation: reports you make, reports made about something you posted, and any action taken. | To handle misuse under the crew usage policy. |
| Technical logs including your IP address. | Security and fault-finding. Kept for a short time only. |
Why we are allowed to
- To provide what you signed up for — the account, Places and chat you asked to use.
- Our legitimate interest in keeping the shared spaces safe, fair and working — moderation, security and technical logs.
- Your consent for location sharing, notifications, contacts matching and the standby watch. Each is off until you turn it on, and you can turn it off again in the app at any time.
Who can see what
- Other Titan crew using CrewPal see your name on the places, reviews, photos and messages you post, and your position in a chat you share it with. Anyone with a Titan email can join, so that may include managers.
- Administrators — currently only the person who runs CrewPal — can see everything in the shared features in order to moderate it, including reports. Hotel stay reports are seen by administrators only, not by other crew.
- Nobody else. We do not sell data, we do not show adverts, and we do not hand data to Titan Airways or anyone else unless the law requires it.
Services we rely on
A few companies process data on our behalf, under their own security commitments: DigitalOcean hosts the server in London; Resend sends the sign-in codes and notices by email from an EU region; Apple delivers push notifications and, during testing, the app itself through TestFlight. When you add a place, the search you type goes to Apple Maps from your own phone under Apple’s terms. City pictures are fetched from Wikimedia by the server, with nothing about you attached.
How long we keep things
- Your account — while you use CrewPal. If it goes unused for twelve months — because you have left Titan, say — it becomes dormant: your email address, sessions, device and location details are removed and nobody can sign in to it, but your name stays on what you posted. We keep a one-way fingerprint of the email address, not the address itself, so that the account reopens if you sign in again. A dormant account with nothing posted is simply deleted. The one exception is an account an administrator has removed for breaking the crew usage policy: its email address and the reason are kept, so that the removal stands.
- Places, reviews and photos — while they are useful to crew, even after you leave, because the next crew still want to know about the restaurant. They stay under your name unless you delete your account, or ask us to delete it; then your name comes off them. Ask and we will remove them entirely.
- Messages — while the conversation is live. A conversation with no messages for twelve months is deleted, and so are its messages. If your account is deleted, the messages you sent stay with the crew you sent them to, without your name; a conversation nobody is left in is deleted.
- Your block list — until you unblock someone, or delete your account.
- Live location — only while sharing is switched on. Switch it off and it is deleted at once. A position that has stopped updating is deleted after twelve hours, and so is the position attached to a “find me” message.
- Hotel stay reports — while they are useful. When your account is deleted, your name, email address and crew code come off them; when it goes dormant, only your email address does.
- Warnings and reports about you — while your account exists, dormant or not. If you delete an account that has a warning, a pause or an open report on its record, that record is held for twelve months so that deleting and signing up again is not a way to start clean: it is kept against a one-way fingerprint of your email address, not the address itself, and returns to your account if you sign up again in that time. After twelve months it is deleted. The log of what an administrator did is kept, without your name.
- Technical logs — no more than thirty days.
Your rights
You can ask us for a copy of what we hold about you, ask us to correct or delete it, or object to how we use it. Deleting the app removes everything on your phone. To delete your account, open Settings in the app and choose Delete Account under CrewPal account: everything that is only about you is deleted there and then — apart from a moderation record, held as described above — and your name comes off what you posted for other crew. If you can no longer sign in — you have left Titan — contact us at the address above and we will delete the account for you. To have what you posted removed as well, tell us so. If you are unhappy with how we handle your data you can complain to the Information Commissioner’s Office at ico.org.uk.
Keeping it safe
Everything between the app and the server is encrypted in transit. Your password is never on our server, sign-in codes are stored only as hashes, uploads are checked, and administrator access is limited to named people. CrewPal is for working crew, who are adults; it is not for children.
Changes
If this notice changes in a way that matters, the app will tell you and the date at the top will move.
This notice covers CrewPal’s shared features. The crew usage policy says how we expect people to behave in them.