Crewops — Privacy Policy

Last updated: 15 October 2026

Crewops is a personal planning tool for airline crew, published by Hawk & Mason Studios (“Hawk & Mason”, “we”, “us”). It has no account. Your roster, your logbook, your documents and everything you record about your own sleep and fatigue are stored on your device and are not sent to us. The exceptions are yours to make: if your airline runs a fatigue programme on Crewops Insight, you can choose to share your post-flight rating with it (see the section on sharing); and if your airline licenses other Crewops products, the reports you file and the notices and courses you sign or complete go to your airline (see the section on products your airline licenses). Beyond the requests that section lists, nothing is shared until you switch it on or send it.

Hawk & Mason Studios is a trading name of Hakan Aydın, an independent developer based in Türkiye. Contact: hello@hawkmason.com.

What stays on your device

Crewops works without an account. There is no sign-up, no password of ours, and no profile of ours held anywhere but on your phone. The following is written to the app's private storage on your device and nowhere else:

• Your profile — the first name, crew code, home base and rule set you enter during setup.
• Your roster — duties, flights, report and release times, and the raw text of the roster the import was read from.
• Your logbook — the sectors you confirm, and the flight-and-duty record for cabin crew.
• Your documents — licence, medical, passport and visa records, their expiry dates, and any scan or photo you attach.
• What you record about yourself — sleep entries, fatigue self-ratings, IMSAFE answers and notes.
• The colleagues on your roster — when a roster PDF names the crew on each sector, those names are read and kept with the duty, together with anything you write about a colleague or an airport yourself. That is personal data about other people, held on your device only: it is never sent to us, never sent anywhere else, and it goes when you delete your data.
• Calculated results — duty limits, rest, the fatigue indicator, the estimated radiation dose and the coaching cards built from all of the above.

We cannot read any of it. It is not backed up to a server of ours: the only things we hold are what you chose to send to your airline, namely a post-flight rating you share (see below) and what you file, sign or complete in the products your airline licenses, together with the pairing of your crew code with your phone's identifier (see the section on those products). If your phone is included in an Apple device backup, that backup belongs to Apple and to you.

One option changes where some of this sits, and only if you switch it on yourself: iCloud sync puts an encrypted copy of part of it in your own iCloud account so your second device can read it. It is off unless you turn it on, and your sleep entries, fatigue self-ratings and IMSAFE answers are never included.

Your calendar and notifications

Two optional conveniences use parts of your phone outside the app, and each asks for its own permission only when you switch it on:

• Calendar mirroring — writes your duties into a calendar you choose on the device, so they appear next to everything else in your Calendar app. It only ever writes the events it created and removes them when you switch it off. The calendar belongs to your device and to whichever account backs that calendar; nothing about it is sent to us.
• Report reminders and roster-change notices — scheduled on the device itself as local notifications. There is no push server: nothing about your roster leaves the phone to make a notification appear.

What leaves your device

Only these, and only for the purpose named:

• Weather — when you open a duty briefing, the app asks a public aviation weather service for the METAR and TAF of an airport. The request carries an airport code and nothing about you.
• Space weather — the app reads NOAA's public space-weather scales. The request carries nothing about you.
• Purchase state — if you subscribe, RevenueCat, Inc. processes your subscription status on our behalf so the app knows whether Crewops Pro is active and can restore it. RevenueCat receives an app-generated identifier and the purchase information the App Store returns. It does not receive your roster, your logbook, your documents or your health entries.
• Your airline's crew portal — only when you choose that import method. See the next section.
• A calendar link you paste — if your crew system publishes your roster as a calendar link and you paste it into the app, the app downloads the calendar from that address when you refresh. The request goes only to the address you gave and carries nothing else about you; the link stays on your device.
• Your post-flight rating, to your airline — only if you switch it on, and only where your airline runs a Crewops Insight programme. See the section below.
• What you file, sign or complete in your airline's products, and the requests that read your notices, records and documents — only where your airline licenses them. See Products your airline licenses.
• A link or file your airline hosts elsewhere — if your airline points a notice, course or document at its own web address, the app opens or downloads it from there. That address sees your IP address and what any web request carries; we do not.
• Your own iCloud account — only if you switch iCloud sync on. See the section below for exactly what goes and what does not.
• Anything you export yourself — a CSV logbook or a JSON copy of your data goes wherever you send it, through your own share sheet.
• App updates — when it opens, the app asks updates.hawkmason.com, our own server, whether a newer version of its code is available. The request carries the app's runtime version and platform, nothing about you; updates are signed and the app refuses anything we did not sign.
• A roster file you choose to send us — when the app cannot read your airline's roster format yet, it offers to email the file to us. The email opens in your own mail app with the file attached — plus your portal's sign-in address if you choose to type it, never a password — and nothing is sent until you press Send. We use the file only to teach the app that format, keep it no longer than that takes, and then delete it; it may contain your name, crew code and colleagues' names, so remove anything you prefer not to share before sending.

There is no analytics SDK, no advertising, no identifier used to track you across apps or sites and no crash reporter that sends us your data. We do not sell personal data and we have nothing to sell.

Your airline's crew portal

One of the ways to import a roster is to sign in to the crew portal your airline operates. If you use it, the username and password you enter are sent to your airline's own system so it can return your roster. They are never sent to us and we never see them.

If you leave the automatic refresh on, they are sent to that same portal again each time you open the app, at most once every six hours, so the app can notice a republished roster. Turning the refresh off in Me → Roster sync stops that, and manual import keeps working. Those credentials are stored in the iOS Keychain on your device, protected by your device passcode and marked so that they are not copied into device backups or to another phone. You can remove them at any time from Me → Roster sync (Turkish build: Ben → Roster senkronu).

Two things you should know before using it. First, many airline crew portals are reachable only over an unencrypted connection, because that is how the airline operates them; where that is the case, the connection between your phone and your employer's server is no more protected than opening the same portal in a browser. Second, what happens to your data inside your airline's system is governed by your airline's own policies and your employment relationship, not by this policy.

Sharing your post-flight rating with your airline

Some airlines run a fatigue programme on Crewops Insight, our analysis tool for operators. If yours does, the Me tab offers a switch, off by default: Share post-flight rating with airline. The app shows you what travels before you can switch it on, and you can switch it off at any time.

With the switch on, each time you give a Samn-Perelli rating after a flight the app sends, to updates.hawkmason.com (our own server, hosted on Cloudflare), this and nothing else: the date, flight number, departure and arrival of that flight, the number of sectors, the rating and when you gave it, whether you fly in the cockpit or the cabin, your crew code as you entered it in the app, and a random identifier for your phone so a changed rating replaces the earlier one. Your sleep, health, roster and logbook data do not travel; neither does your name.

Your airline's compliance or safety team reads these records on its Crewops Insight page with the airline's licence code, beside the model's prediction for the same flight. The records are stored for two years and then deleted; the airline decides what it does with them on its side. To have your records deleted earlier, switch sharing off and write to the address below with your crew code; we delete them within 30 days. The legal basis is your consent (GDPR Article 6(1)(a)), which the switch gives and withdraws.

Products your airline licenses

An airline can license further Crewops products for its crews: Crewops Safety (reports to its safety office), Crewops Academy (notices to read and sign, training records, courses and exams), Crewops Library (manuals and their revisions) and Crewops Insight. The app offers a product only if your airline has licensed it. The rating you can share through Insight is described in the section above; this section covers the others.

What you send, and when:

• A report — when you press Send in Crewops Safety, or send one through your airline's web report link. It carries the kind of report, what you wrote, whether it is urgent, an optional headline and suggestion, up to four optional photos, your answers to that kind's questions (most are ticks; a few are a number or a short text), the time of the event, the airport if you picked no duty, and your language setting. If you pick a duty from your roster, the flight comes with it: date, flight number, route, aircraft registration and type, and scheduled times. A fatigue report carries your Samn-Perelli rating and the reasons you tick, and from a picked duty the planned and maximum duty period and the number of sectors; a commander's discretion report carries the planned, maximum and actual duty period. Your crew code goes with a report unless you send it anonymously; whether you fly in the cockpit or the cabin always goes with it. A report about an injury or an illness carries what you say about it. Information you add to a report later, and the safety office's replies, travel the same way. Offline, a report waits on your phone and goes the next time you open Crewops Safety; photos are sent in separate requests after the report.
• A report sent with “anonymous” switched on — leaves out your crew code, and nothing else. It still carries what you wrote, the flight and times if you picked a duty, whether you fly in the cockpit or the cabin, and the random identifier of your phone. That identifier is stored with the report, and your airline's operator access can read it. It is the same identifier the app uses when it asks for your notices and records and when you share a rating, so an airline whose records tie your crew code to it, or that knows the flight, can tell who sent the report. Anonymous here means only that your crew code is not attached.
• A confirmation — when you mark a notice as read and understood in Crewops Academy, or confirm a revision in Crewops Library: which notice or document and revision, your crew code, the identifier of your phone and the time.
• A course or module result — when you finish a course in Crewops Academy: that you completed it, and when, with your crew code and the identifier of your phone. For an exam, your answers are marked on the server and what is stored is the score, the result and the number of attempts. For a SCORM module it is the result the module reports (passed or completed, and a score if it gives one; a failed result is not stored); the module's own progress stays on your phone.
• Your crew code and a random identifier of your phone — whenever the app asks your airline's workspace for what is yours: your notices, training records, courses and documents. That happens when you open the Me tab or those screens, if you have entered a crew code and your airline licenses Academy or Library. The app makes the identifier at random. It is the same on every request your phone makes to your airline's workspace, and the workspace stores it next to your crew code in the pairing. The first phone to ask for a crew code is paired with it, and another phone using the same crew code is refused until your airline resets the pairing. The app also keeps the identifier in the iOS Keychain, so deleting and reinstalling the app on the same phone keeps the pairing.
• The web report link — for crews without the app, your airline's safety office can share a web form. A report sent through it reaches the same safety office and is marked “web”. Your crew code is optional there. Your browser keeps a random identifier, and the report numbers and secret keys it needs to show the state of your reports, on that browser only; anyone using the same browser can open them. The page loads its typefaces from Google Fonts, so Google receives your IP address when you open it.

To know whether your airline runs a product, the app asks our server for the list of airlines that do. That request carries nothing about you.

What your airline puts there. In Crewops Academy the airline loads your qualification records itself: for example the dates of checks, training, licences and medical certificates, each with a label and a short note, with your crew code, your role and, if it chooses, your name. They show in the app under your training. The airline also publishes the notices, courses and documents. Its staff may type their own names in the browser panel, for example as the author of a notice or of a change to a report. If the airline points a notice, course or document at its own web address, the app opens or downloads it from there (see What leaves your device).

What stays on your device. Your roster, sleep entries, health entries, logbook and notes. Apart from the requests above, only what you file, sign, complete or share leaves. The reports you sent, the notices and documents the app shows and a course's progress are kept on your phone and are not part of iCloud sync.

Who receives it. Your airline: its safety office for reports, its training department for Academy and its documentation office for Library, through the airline's browser panel. If the airline has set them up, its own systems receive it too, by API and by webhook. A webhook sends events such as a new report, a signed notice, a completed course or a confirmed revision to one address the airline names. Each event carries the record itself: for a report, the report as sent and the safety office's handling of it, that is what the person wrote, the flight, the answers, their crew code unless it was sent anonymously, and the status, classification and reply (the photos are only counted, and the phone's identifier is left out); for the other events, the crew code, the time and the notice, course or document concerned, with a score or result where there is one.

Where it is stored, and who can read it. On Cloudflare: records in Workers KV, and photos, course files and manuals in R2 storage, kept apart by airline code. The airline reads them in its browser panel with its operator code, or through an API key it made from that code. Your phone asks for your notices, records and documents by sending your airline code, your crew code and the phone's identifier; the first phone to use a crew code is paired with it. That pairing prevents mix-ups; it is not a password. As the provider of the service we can reach the storage itself; we do that to run the service and to carry out the airline's instructions.

How long. We set no expiry on the records of these products. They stay until your airline asks us to delete it, and that is also so when an airline's licence ends. The post-flight rating of Crewops Insight is the exception: two years, as described above.

Who decides what is done with it. Your airline decides why the data is collected and for how long; Hawk & Mason Studios hosts it and processes it on the airline's instructions. To have a report, a photo or a record deleted, or a record corrected, ask your airline: its safety office for a report, its training department for a record or a confirmation. The airline then instructs us. The text of a report cannot be changed once it is sent; you can add information to it. You can also write to us and we will pass your request to your airline. Deleting the app removes what the app holds on your phone, not what your airline holds; the one thing it leaves is the phone's identifier in the iOS Keychain, kept so that reinstalling does not look like a new phone. Delete everything in the app clears your own data but not that identifier, nor the course files and manuals the app downloaded, nor the photos of a report not yet sent; see how long data is kept.

We do not use any of this for advertising, we do not sell it, and we build no analytics profile of crew members.

Health information

Sleep entries, fatigue self-ratings, IMSAFE answers and the estimated cosmic radiation dose are health-related information about you. They are created by you and stored only on your device. This app does not send them to us, to your employer, to your regulator or to anyone else, with two exceptions that are yours to make: a post-flight fatigue rating you share with your airline (see the section on sharing), and a report you send in Crewops Safety, which carries what you rate, tick or write in it (see Products your airline licenses). Your logged sleep entries and IMSAFE answers are not sent in either.

Each health module is switched off until you turn it on, and each one states what it reads and what it keeps before you enable it. Turning a module off stops it being used; deleting your data removes it.

Crewops is not a medical device. Its fatigue indicator, sleep readings, circadian plan and dose estimate are planning aids, not diagnoses, and the app never states that anyone is fit or unfit to fly.

Purchases

Crewops Pro is an auto-renewable subscription sold through the App Store. Apple processes the payment; we never receive your payment card details. RevenueCat, Inc. processes the resulting subscription state on our behalf under its own privacy policy so that Pro can be restored on a device you sign into with the same Apple Account.

iCloud sync

Crewops can keep your devices in step through your own iCloud account. It is off when you install the app and stays off until you turn it on in Me → iCloud sync, where the app tells you what travels before you agree. You can turn it off again at any time, which also deletes that device's copy.

What is copied to your iCloud:

• Your roster — duties, flights, report and release times, and the crew named on each sector.
• Your logbook confirmations and the times you attested a duty as flown.
• Your document records — kind, title, number, issuer, issue and expiry dates, countries and notes.
• Your crew notes, airport notes and the notes you write on a duty.
• Your profile and display settings — name, crew code, home base, rule set, language, theme.

What is never copied, whatever your settings:

• Your sleep entries, fatigue self-ratings and IMSAFE answers. These are health data, and Apple does not permit personal health information to be stored in iCloud. They stay on the device that recorded them. If you want them on another phone, the JSON export is the way.
• Document scans and photographs. The record travels; the image does not.
• Your crew-portal password. It is held in your device Keychain, bound to that device, and you enter it once on the new phone.
• Per-device settings such as the portal address, the last sync time and cached weather.

How it is protected. Each device writes a single file into a private area of the app's iCloud container, and the file is encrypted by the app before it is written, with AES-256-GCM. The key is generated on your device and kept in your iCloud Keychain, which Apple encrypts end-to-end. We never hold the key and never hold the file. Apple stores the encrypted file but cannot read its contents.

How long it lasts, and how to remove it. The copy belongs to your iCloud account, not to the app, so deleting Crewops from your device does not delete it — that is what lets your data come back on a new phone. To remove it, either turn iCloud sync off in the app, which deletes that device's copy, or delete the app's iCloud data from Settings → your name → iCloud → Manage Account Storage. The copy counts against your iCloud storage. Deleting it removes it from every device signed into that account.

If iCloud Keychain is switched off on a device, that device cannot hold the key and Crewops will not start syncing there rather than write anything unencrypted. If you lose access to your iCloud Keychain, the encrypted copy cannot be decrypted by anyone, including us; your own JSON export is the safeguard against that.

Crewmates (formerly Crew Circle)

Crewmates lets you share your roster with colleagues you choose, and see the rosters they share with you. It is off until you tap Share my roster in Me → Crewmates. It uses Apple's iCloud sharing (CloudKit): your shared roster is stored in your own iCloud account and read through Apple by the people who join your circle. You send the invitation link yourself, through WhatsApp, Messages or any app you choose; anyone who opens that link in Crewops while signed in to iCloud can join, read-only, so send it only to people you trust. You see everyone who has joined and can remove anyone, and stopping sharing turns the link off. We run no server for this and cannot read it.

What the people you invite see: your first name as you entered it in the app, your role and home base, and your duties from 7 days ago to about 2 months ahead — the day, type, report and release times, stations, flight numbers and sector times. Your name as it appears on your Apple Account is shown to them by Apple as part of the invitation.

What is never shared: the names of the other crew on your duties, your fatigue, sleep and IMSAFE entries or any other health information, your notes, documents, logbook confirmations and tail numbers. The roster is written as one of CloudKit's encrypted fields.

Stopping. In Me → Crewmates → Manage people you can remove anyone, or stop sharing altogether, which removes their access. Pressing and holding a colleague's name removes their roster from your phone. Delete everything in Data & privacy also deletes your shared roster from iCloud and ends the sharing. What someone already saw on their screen is not recalled.

Legal basis and international transfers

Almost everything Crewops does with your data happens on your own device, under your control. The exception is what you send to your airline's workspace, which we host for your airline (see above). Where the GDPR and the KVKK ask us to name a basis, these are the ones that apply:

• Performance of our contract with you (GDPR Art. 6(1)(b); KVKK Art. 5(2)(c)) — processing your subscription state so Crewops Pro works and can be restored.
• Your consent (GDPR Art. 6(1)(a), and Art. 9(2)(a) for health data; KVKK Art. 6(2)) — each health module, and the crew-portal sign-in. Each is off until you switch it on, and you may withdraw at any time by switching it off or deleting your data. Withdrawing does not affect what was done before you withdrew.
• Our legitimate interests (GDPR Art. 6(1)(f); KVKK Art. 5(2)(f)) — the public weather and space-weather lookups, which carry an airport code and nothing about you.

Products your airline licenses. For the reports, records and confirmations described in that section, your airline decides why the data is collected and for how long; Hawk & Mason Studios hosts it and processes it on the airline's instructions. This policy does not state a legal basis for what the airline does with the data; ask your airline.

Where the data goes. We are established in Türkiye, so if you are in the EU/EEA or the UK your subscription state reaches a country outside it. RevenueCat, Inc. is established in the United States. There is no European Commission adequacy decision for Türkiye, and the EU–US Data Privacy Framework covers only certified recipients, so these transfers rest on the Standard Contractual Clauses in our agreement with RevenueCat and on your explicit consent to use a paid subscription from a developer based in Türkiye, which you give by subscribing. The data transferred is an app-generated identifier and the purchase information the App Store returns — never your roster, your logbook, your documents or your health entries. If you are in Türkiye, the same transfer to the United States rests on your explicit consent under KVKK Art. 9.

Cloudflare. Our update service and the airline workspaces are hosted on Cloudflare, Inc., a company established in the United States whose network runs in many countries. We do not promise a country for the data held there, so what you send to your airline's workspace, or share as a post-flight rating, can be processed outside the country you are in.

The service providers we use are RevenueCat, Inc., for subscription state, and Cloudflare, Inc., which hosts our update service and the airline workspaces. Apple is an independent controller for the purchase itself.

How long data is kept, and how to delete it

Nearly everything Crewops holds about you stays on your device, or with iCloud sync on in your own iCloud account, until you remove it. The exceptions are what you chose to send: a shared post-flight rating, kept for two years (see sharing), and what you file, sign or complete in your airline's products, kept until your airline asks us to delete it (see Products your airline licenses). Those sit in your airline's workspace, and deleting the app or using Delete everything does not remove them; the sections named explain how to have them deleted.

• Delete everything in the app — Me → Data & privacy → Delete everything (Turkish build: Ben → Veri ve gizlilik → Her şeyi sil) wipes the roster, logbook, documents and attachments, health entries, saved portal credentials and scheduled reminders, and your roster shared through Crewmates, and returns the app to its first-launch state. It does not remove the phone's identifier from the iOS Keychain, kept so that reinstalling does not look like a new phone, nor the course files and manuals the app downloaded, nor the photos of a report not yet sent; deleting the app removes those files.
• Export first if you want a copy — the same screen writes a full JSON copy of your data, and the logbook exports as CSV.
• Delete the app — removing Crewops from your device deletes its storage with it, except the phone's identifier in the iOS Keychain. If you turned iCloud sync on, the encrypted copy in your iCloud account is not deleted with the app; remove it as described under iCloud sync.
• Subscription — deleting your data does not cancel a subscription. Cancel it in your Apple Account settings.

Your rights

Under the Turkish Personal Data Protection Law (KVKK) and the EU General Data Protection Regulation (GDPR), you have the right to access, correct, delete and port your personal data, to object to its processing, to ask us to restrict it, and to withdraw a consent you have given at any time. For Crewops those rights are exercised directly on your device: the data is in your hands, the export gives you a portable copy, and the delete function erases it. Where you believe we hold something about you — for example a support email you sent us — write to us and we will tell you what we have and delete it on request. What you sent to your airline's products sits in your airline's workspace: ask your airline to have it deleted, or a record corrected, as described under Products your airline licenses. You may also complain to your national data protection authority.

Crewops is a professional tool intended for adults working as airline crew. It is not directed at children and we do not knowingly process children's data.

Contact

Questions about this policy, or about what the app does with anything: hello@hawkmason.com.

If we change this policy we will update the date at the top of this page, and where the change is significant we will say so in the app.