Privacy Policy

This policy describes what Crew (the “app”, “we”) collects, how we use it, where it is stored, and what choices you have. Crew is operated by Playriot. Contact: [email protected].

Version availability: the current App Store app is 1.0.7. Receipt-photo reading and the report, block, leave and owner photo-review screens described here are part of the upcoming 1.0.8 update. The app controls are not available in 1.0.7; server-side media and privacy rules apply when the backend update is active.

1. What we collect

• Apple ID identifier and email. When you sign in with Apple, we receive a stable opaque user ID (the Apple “sub”) and, if you choose to share it, your email or Apple’s private relay address. We use this only to identify your account and reach you for account-related notices.
• Profile name. The name you provided to Apple at sign-in. Used to label you to your crew members.
• Apple refresh token. A short, opaque token Apple returns at sign-in. We store it solely so we can call Apple’s revoke endpoint when you delete your account, as required by App Store guideline 5.1.1(v).
• Crew membership and session activity. Which crews you belong to and the activity you log inside them: who drove, where you stopped, who pinged whom, who marked themselves home safe, and drinks you log against an active session.
• Live location during a session. While a night session is active and you have granted “When in Use” location permission, your device sends your latest GPS coordinate (no history, ever) to our server. The server keeps your latest position in memory only — never written to disk — and broadcasts it to other members of the same active session. Sharing stops automatically when the session ends.
• Photos and videos you choose to upload. A current crew member may add media to a current or past night. Cloudflare R2 holds the file; our database holds its size, type, dimensions, optional capture time and review status. Limits are 8 MB for photos and 60 MB for videos. Pending media is private to its uploader and a current crew owner; a legacy upload still being written stays private to its uploader until its upload link expires. Before approving an older writable upload or saving its chosen complaint evidence, we copy the selected version to a private review file with no client upload link. Approved album links and chosen evidence use that copy. Peers see only owner-approved media. Reported media is withheld pending PLAYRIOT review. You and the night initiator can remove uploads; storage cleanup covers both the upload and review copy while holding chosen evidence privately.
• Safety choices and reports. We save your private blocks, leave receipts and reports. A report contains its reason, chosen member or content IDs, minimal selected evidence, status and review decision. Private report reasons may quote reported text. PLAYRIOT operators can review reports; the reported person and other crew members cannot read your report or reporter link. An owner sees their pending-media queue. Blocks hide social posts, media, location and notifications in both directions while preserving shared debts and needed bill-party names. Leaving preserves shared bills and lets you read your own former-crew payments.
• Apple push token. If you grant notifications, we store your APNs token so we can send pings, designated-driver alerts, and Guardian alerts. The token is invalidated when you sign out.
• Guardian contact (if configured). Name, phone number, relationship, and check-in hour for the person you designate as your Guardian. Stored only to send them a single safety push if you don’t mark yourself home by your check-in time. We do not call or text the contact ourselves.
• Subscription state. Whether you have an active Crew Premium entitlement, derived from Apple’s StoreKit. Apple handles the actual payment — we never see your payment details.
• Optional feedback. PLAYRIOTFeedback sends the feedback you choose to submit, optional email or screenshot, app/build and device/OS details, locale, paid tier and a device identifier to our feedback service at api.aiappnation.com. Bug reports also include recent app diagnostics. It checks for replies and release notices after engagement. A screenshot can include what was on your screen; check it before submitting.

2. What we do not collect

• We do not track you across other apps or websites.
• We do not access your camera, microphone, or contact list. We read only photos or videos you choose in the system photo picker. Receipt-photo reading uses Apple Vision on your phone; the chosen receipt image is not uploaded by that reader. Your checked bill details sync to Crew.
• We do not store location history. The server only ever holds your latest position in memory during an active session, and wipes it when the session ends.
• We do not sell your data, period.
• We do not use third-party advertising, analytics, or tracking SDKs.

3. Who we share with

• Other members of your crew — permitted live positions, pings and stops, owner-approved media, your name, avatar and driver availability. Your drink kinds and counts stay private; logging alcohol makes you unavailable for driving that night. Blocking filters social sharing but does not erase shared financial records.
• Apple — APNs delivers our push notifications. StoreKit verifies your subscription. Apple’s authentication service issues and revokes your sign-in token.
• Cloudflare — we use Cloudflare R2 (object storage) to host session photos and videos, and a separate Cloudflare R2 bucket to hold database backups. Cloudflare acts as a sub-processor of the data we collect.
• PLAYRIOT support and safety operators — optional feedback and attachments go to our first-party feedback service. Chosen report evidence and review status stay private with operators who handle safety reports.

4. Where we store data

IONOS hosts our application server and Postgres database. Cloudflare R2 holds uploaded session media. Apple provides sign-in, payments and push delivery; PLAYRIOT operates the first-party feedback service described above.

5. How long we keep it

• Account data — for as long as you have an account. Settings → Delete Account removes your profile, memberships, private drink logs, device tokens, Guardian details, block records and reporter/subject account links. Shared nights and bills may remain with opaque participant IDs and a former-member label. Selected complaint evidence can remain privately as described below.
• Purchase ownership — while your account exists, verified Apple product and transaction identifiers and expiry or revocation dates support paid access. Deleted-account purchase records retain the original Apple transaction ID, keyed owner and account-token hashes, the last signed-state time and any refund/revocation time so the rightful owner can restore a purchase and old or copied receipts cannot unlock access. These records have no automatic expiry and do not contain your profile name or email. Deleting Crew does not cancel a subscription with Apple.
• Photos and videos — hidden from shared albums after 30 days and processed by the existing hourly cleanup. Storage failures are retried. Chosen complaint evidence is held out of that cleanup. New viewing links last 60 seconds; links from the old server may last up to five minutes. A report, block or removal stops new shared links but cannot revoke bytes already downloaded or a still-valid old link.
• Upload cleanup keys — an upload accepted before its link expired may finish after a storage delete. We keep only its opaque storage key and creation/retry times, without profile, reporter or photo metadata, to retry removal through the existing hourly cleanup. These minimal keys have no automatic expiry. Chosen complaint evidence and current photo references remain protected.
• Private safety records — blocks last until unblocked or an affected account is removed. Leave receipts last while your account exists so your former bills stay readable. Report reasons, chosen evidence, coded retry matches and operator audit records have no automatic expiry; PLAYRIOT keeps them only as needed for review and safety follow-up. Account removal clears the reporter and subject account links, but selected complaint evidence may remain privately.
• Live location — in-memory only, wiped when the session ends.
• Push tokens — invalidated on sign-out.
• Server logs — request URLs and basic timings are kept for operational debugging. There is currently no fixed automatic age limit for these logs. Bearer tokens and session-token query parameters are redacted from logs at write time.
• Database backups — the local backup job keeps snapshots for 14 days. Copies uploaded to Cloudflare R2 have no automatic expiry in that job. Copies of historical data may remain in those backups after account removal.

6. Your rights

• Access — email us and we will send you everything we have on your account.
• Delete — Settings → Delete Account requests Apple sign-in revocation and removes your profile, memberships, private drinks, block records, devices and Guardian contact. Reporter and subject account links are cleared. Uploaded media is queued for removal, including abandoned uploads tracked by saved grants; outstanding upload links must expire before cleanup finishes. Selected complaint evidence can remain privately, and shared bills and pseudonymous purchase ownership remain as described above. Cancel an Apple subscription separately in your Apple account settings.
• Report, block or leave — upcoming 1.0.8 — member and media safety actions save your choices and show a receipt or error. In 1.0.8, you can manage blocks and your reports in Settings and a crew owner can review pending media. These screens are not in 1.0.7. Contact [email protected] about private safety records and review.
• Stop receiving pushes — disable in iOS Settings → Notifications → Crew, or sign out.

7. If you are in the European Economic Area, the United Kingdom, or Switzerland

You have additional rights under the GDPR and equivalent laws: access, rectification, erasure, restriction, portability, and the right to object to processing. The legal basis we rely on is the contract you enter into when you create a Crew account, plus your consent for optional permissions (location, notifications, photo selection). To exercise any of these rights, email [email protected]. You also have the right to lodge a complaint with your local data protection authority.

8. Children

Crew is rated 17+ and is not directed at children under 13. We do not knowingly collect data from anyone under 13. If you believe a child has signed in, email us and we will remove the account.

9. Changes

If this policy materially changes, we will update the “Last updated” date and (for changes that affect what we collect) prompt you in-app on next launch before any new collection takes place.

10. Contact

Playriot
Email: [email protected]