Privacy policy
Crewpot is a shared tab for group trips: you add what was spent, we work out who owes who. This page says what we keep, why, who else touches it, and how to get rid of it. We keep it to what the app actually does.
Who we are
Crewpot is operated by Ricki Taiaroa, an individual developer, {{LEGAL_ENTITY}} (the "controller" of your data). Contact: support@crewpot.app.
What we collect, and why
| Data | Why |
|---|---|
| Email address (only if you create an account) | To email you a one-time sign-in link and identify your account. There are no passwords. Sign-in links work once and expire after 15 minutes. We store only a hash of each link and of your session token; a session lasts 90 days. |
| Trip content: trip name, destination, dates, currency, people's names (and optional emoji or photo avatar), expenses (description, amount, currency, date, category, who paid, who shared it), comments and questions on expenses, settlement records | This is the app. We use it to calculate balances and who should pay whom, in every currency involved. |
| Bank details you choose to add (free text, for example an account number) | Shown to other people on the same trip so they know where to send money when settling up. We do not verify them and never move money. |
| Receipt photos you upload (JPEG, PNG, WebP, HEIC; up to 20 MB) | To attach receipts to expenses and to read receipts for you (see "AI receipt reading" below). Photos can contain whatever is in the picture; please do not photograph things you would not want the group to see. |
| Profile picture (optional): an emoji with a background colour, or a selfie / photo you choose (JPEG, PNG or WebP, up to 2 MB) | Only to show your face next to your name, to the people in the same pot (and to you on your other devices if you sign in). Photos are optional: you can always skip, use an emoji, or remove it. When you add a photo our server re-encodes it as a small square picture, which strips location (GPS), camera and other metadata, and keeps only the pixels. It is stored under a random file name, never sent to AI models, and used for nothing else. A signed-in account can keep one default picture that is copied into pots you join or create. Anyone in a pot can report a picture they find inappropriate, and the organiser can remove it. |
| Purchase records: which plan you hold (Crewpot Plus monthly or annual, or an earlier Trip Pass / Annual), expiry, which store bills it | To unlock creating more than one pot. We never see your card or Apple ID / Google account details; the store handles payment. |
| Network data: your IP address, held in server memory for rate limiting | To slow down abuse (sign-in attempts, guessing trip links, expensive image rendering). It is not written to our database. Our hosting and web server may also keep ordinary access logs. |
| Phone number (only if you want your first pot free) | To prevent abuse: one free pot per phone number, not per email. We text you a 6-digit code to prove the number is yours. We don't store your number: it is kept only as a keyed hash, plus the time you verified; the code is kept only as a hash and expires after 10 minutes. We do not use it for marketing and do not share it. The hash stays on a short list of numbers that have already claimed a free pot, even if you delete your account, so the same number cannot claim another. You do not need a phone number to join a pot or to subscribe to Plus. The text is sent through our SMS provider (SMSPortal), which sees your number to deliver it. |
| Crash and diagnostic reports: when the app hits an error, the error message, a short technical stack trace, the screen path (with trip links removed), app version, platform (web, iOS or Android) and browser/device user-agent | To find and fix bugs. Sent to our own server, linked to your account id if you are signed in (otherwise not linked to anyone). Error text is generated by the app or your browser and can occasionally include fragments of what was on screen; we automatically remove trip-link tokens, sign-in tokens and email addresses from it before it is stored. No IP address is stored. |
| Product interaction events: simple counts such as "trip created", "invite shared", "trip joined", "expense added", "settle-up viewed", "paywall viewed", with a random identifier generated on your device, the platform, and (for trip events) an internal trip id | To understand whether invites and core features work and to improve the app. Sent to our own server, linked only to your account id if you are signed in. These events carry no expense text, names, amounts, bank details or other content you type. |
| On your device: your session, which person you are on each trip, and display preferences, kept in the app's local storage | So you stay signed in and the app remembers who you are. Cleared when you sign out or delete the app. |
The diagnostic and interaction data above is collected by our own code and stored on our own server: we use no third-party advertising, analytics or crash-reporting SDKs and share it with no one. It is not used for tracking or advertising. Deleting your account deletes the diagnostic and interaction records linked to it. We we do not track you across other apps or sites, and we do not sell your data.
Trips are shared by link
Anyone with a trip's link can view that trip and, depending on the trip's settings, add or edit expenses and join it, with or without an account. That is how the app works: treat the link like a key and share it only with the people on the trip. The organiser can turn off open joining and can replace the link, which stops the old one working. Bank details are visible to anyone who can open the trip.
AI receipt reading (OpenRouter)
When you tap "scan receipt", the receipt image(s) are sent from our server to OpenRouter (openrouter.ai), which passes them to a third-party AI model provider to read out the merchant, total, currency, date and main line items. The same applies to the "quick add" box: the text you type, plus the trip name, destination, dates and the names of the people on the trip, is sent to a model to turn it into an expense. We ask OpenRouter to route only to providers that do not retain prompts or train on them (zero data retention, data collection denied). Provider behaviour is up to those providers and OpenRouter; see openrouter.ai/privacy. Nothing is sent unless you use these features. The result is a draft you review before saving. Each trip is limited to a set number of AI requests per day.
Other services we call
- SMS provider (SMSPortal) for verification codes: it receives your phone number and the code text.
- Email provider for sign-in links: {{EMAIL_PROVIDER}}. It receives your email address and the link email.
- Payments: purchases are made through Apple's App Store, Google Play or (on the web) a card checkout run by RevenueCat with Stripe, and managed with RevenueCat, which tells our server which plan you own (using your Crewpot account id). See Apple's, Google's, Stripe's and RevenueCat's privacy policies.
- Place photos: to decorate an expense or trip with a picture, our server searches Wikimedia Commons using a few words from the expense description or trip destination (for example "beach club Bali"), and if nothing suitable is found it may generate an illustrative image with an image-generation service ({{IMAGE_GEN_PROVIDER}}). Only those few words are sent, not your name, email or photos.
- Exchange rates: our server fetches public currency rates from open.er-api.com. No personal data is sent.
- Hosting: our servers are run by {{HOSTING_PROVIDER}} in {{HOSTING_REGION}}. Data is therefore processed there, which may be outside your country.
How long we keep things
- Account, sessions and purchase records: until you delete your account. Sign-in links are single-use and expire in 15 minutes; sessions expire after 90 days.
- Trips and their expenses, comments and receipts: until the trip organiser deletes the trip, or (see below) as shared records after an account is deleted. Deleting a trip removes its expenses, receipts, uploaded files, people and comments.
- Crash reports and interaction events: kept in our database for 90 days, then deleted automatically; records linked to your account are deleted with it.
- Cached place photos and exchange rates: kept as a cache with no personal data.
- Backups: {{BACKUP_RETENTION}}.
Deleting your account
In the app: Profile, then Account, then Delete account, and confirm. It is immediate and cannot be undone. What happens:
- Your email, sign-in links, sessions, phone hash and purchase records are deleted. The separate record that a (hashed) number has claimed a free pot is kept so it cannot be claimed twice.
- Bank details and profile pictures you set are wiped, and your account's default picture is deleted. Picture files are deleted from our server with them. Deleting a pot, or an organiser removing you from one, deletes your picture in that pot too.
- Your name on trips becomes "Former member" and is unlinked from you.
- Expenses, shares, comments and questions you added stay on the trip as shared records, because other people's balances depend on them. Trips you organised stay for the other members but lose their organiser, so organiser-only actions (renaming, deleting, rotating the link) are switched off.
If you want a trip's content removed too, delete the trip first (organiser only) or ask us at support@crewpot.app and we will help. If you never made an account (you only used a trip link), email us and we will remove what we can identify as yours. Deleting your account does not cancel an App Store or Google Play subscription; manage that in the store.
Your rights
Depending on where you live (for example under GDPR, UK GDPR, the New Zealand Privacy Act, the Australian Privacy Act or CCPA), you can ask to access, correct, export or delete your data, and to object to or restrict some processing. Email support@crewpot.app. You can also complain to your local privacy regulator.
Children
Crewpot is not directed at children under 13 (or under 16 where local law sets a higher age), and we do not knowingly collect their data. If you think a child has given us personal data, email us and we will delete it.
Security
Traffic is encrypted in transit. Sign-in links and session tokens are stored hashed. Trip links are long random strings and repeated wrong guesses are rate-limited. No system is perfectly secure, so please do not put anything in bank details you are not comfortable sharing with your trip group.
Changes
If we change this policy in a way that matters, we will update the date above and, for big changes, tell you in the app.