Privacy Policy

If you use CCHQ without signing in, your roster and everything you add stays on your device in your browser's local storage (IndexedDB). We do not store anonymous users' roster data on our servers. The only thing an anonymous device sends us is anonymous usage counts, and you can turn those off in the app's Settings.

If you create an account, we store:

• Your email address
• A password, if you choose to add one (stored as a hash, never the password itself). Signing in with an email link needs no password at all.
• Your roster events (dates, times, flight numbers)
• Your crew directory (names, rank, notes you add)
• Your saved destinations
• Your app preferences (home base, roster year)

Your data is used only to provide the service: syncing your roster across your devices and (if you choose) sharing a read-only view with family or colleagues. We do not sell your data, use it for advertising, or share it with third parties except as described below.

• Supabase: stores your data in a Postgres database hosted on AWS infrastructure. Data is encrypted at rest (AES-256) and in transit (TLS).
• Google: reads roster screenshots. When you import a screenshot, the image is sent to Google's Gemini service to be turned into roster events. The same happens if you ask CCHQ to read pasted text that would not read on your device. Roster text that reads on your device is never sent anywhere.
• Resend: sends the sign-in and password-reset emails. We pass your email address to Resend solely for this purpose.
• Vercel: hosts the application. Vercel may log IP addresses in standard server logs for up to 30 days.
• Vercel Analytics: counts page views on this site and in the app, so we can see whether anyone is using CCHQ. It does not use cookies and does not build a profile of you. We never send it your name, email, or anything from your roster. In the app you can turn it off in Settings, under Privacy.

You have the right to:

• Access & portability: download a JSON export of everything stored on your device from Settings › Data Storage (available without an account). If you're signed in, you can also export the copy held on our servers from Settings › Account. Both exports are machine-readable JSON.
• Delete your data: clear all on-device data any time from Settings › Data Storage. If you have an account, deleting it removes everything that identifies you from our servers: your email, roster events, crew directory, destinations and preferences are deleted immediately. Feedback you sent and anonymous usage counts are kept, stripped of your name, email and any link back to you.
• Rectification: you can edit any stored crew or destination data directly in the app.

We use one strictly necessary cookie to keep you signed in (a session cookie). This cookie is required for the service to work; it does not track you and does not require consent under UK GDPR. We do not use any analytics or advertising cookies.

Account data (roster, crew, destinations, preferences) is stored until you delete it or delete your account. Deleted roster months are soft-deleted and permanently purged after 30 days. Detailed usage events are deleted after 90 days; anonymous daily totals are kept. Feedback is kept so we can act on it, and is stripped of everything that identifies you when you delete your account.

Questions about your data? Email privacy@cchq.uk