Effective October 26, 2026
This Privacy Policy explains how personal data is handled when you use the Crew app, website, event pages, dashboard, support channels, and related services (the “Service”).
The controller for the core Service is ALETHEIA SYSTEMS HOLDINGS LIMITED, registered in England and Wales.
Where Article 27 GDPR requires an EEA representative, our representative is Zhongli Liu in Italy. EEA users may contact the representative at andrea@crew-app.com about GDPR matters, or contact us directly at the privacy address above.
You must be at least 18 years old to use the Service, and you confirm this when you create an account. Specific events or features, including payments and payouts, may have separate age or eligibility requirements.
This policy is available in English and Chinese. If the versions differ, the language rule in the User Agreement applies.
The data we handle depends on the features you use.
| Category | Examples |
|---|---|
| Account and profile | Name, email, phone number, user ID, sign-in identifiers, username, avatar, bio, language, country, preferences, verification and account status |
| Events and registrations | Event details, organizer information, registrations, attendance or check-in status, cancellations, routes, requirements and event rules |
| Location and maps | Precise location when you allow it, approximate location, selected places, coordinates, addresses, routes, map views, geocoding and timezone data |
| Content and communications | Photos, videos, posts, comments, messages, reports, feedback, support content and attachments |
| Payments and payouts | Purchase and registration records, payment status, Stripe identifiers, Stripe Connect status, balances, payouts, refunds, disputes, chargebacks, subscriptions and platform fees |
| Device and usage | Device or app identifiers, push tokens, IP address, browser or operating-system information, app version, feature usage, diagnostics, crash and performance data, security signals |
| Marketing and preferences | Marketing choices, notification preferences, campaign or promoted-content interactions, consent and opt-out records |
| Safety and compliance | Reports, moderation actions, fraud or abuse signals, policy acceptances, account-deletion records, audit and legal-compliance records |
We receive data directly from you and from your use of the Service. We may also receive relevant data from other users or organizers, sign-in providers, payment providers, app stores, map providers, device or SDK services, support and communications providers, and public authorities or public sources where reasonably needed for safety, fraud prevention or legal compliance.
If you sign in with a phone number or link one to your account, you enter the number yourself. We use it to send you a verification code by SMS, to sign you in, and to link or recover your account. This sign-in phone number is kept with your sign-in account at Google Firebase Authentication and is not added to your Crew profile. Any phone number you add to your profile is a separate field.
When Stripe handles payment-card details, we do not store the full card number.
For UK, EEA and EU users, our main purposes and legal bases are:
| Purpose | Main legal basis |
|---|---|
| Create and manage accounts, including sign-in, SMS verification codes, account linking and recovery, and provide core features | Performance of a contract |
| Publish and discover user content, manage profiles and follows, and communicate with other users | Performance of a contract; legitimate interests where appropriate |
| Show, create, manage and join events | Performance of a contract; legitimate interests where appropriate |
| Payments, refunds, payouts, subscriptions and financial records | Performance of a contract; legal obligations; legitimate interests |
| Maps, routes, places and device location | Performance of a contract; consent where required; legitimate interests |
| Service, account, event and safety communications | Performance of a contract; legitimate interests; legal obligations |
| Support, reports, moderation, fraud prevention, prevention of SMS and sign-in abuse, and platform security | Legitimate interests; legal obligations; vital interests in limited urgent situations |
| Analytics, diagnostics and reliability | Legitimate interests; consent where required |
| Marketing and promoted content | Consent where required; legitimate interests where permitted |
| Tax, accounting, disputes, audits and regulatory compliance | Legal obligations; legitimate interests |
Our legitimate interests include keeping the Service secure and reliable, preventing fraud and abuse, supporting users, enforcing platform rules, resolving disputes and understanding how features perform. We consider those interests against your rights and reasonable expectations.
Some information is required to create or perform your account contract or to provide a feature you request. Payment, payout, identity, tax or compliance information may also be required by law or by a payment provider. If required information is not provided, the relevant account, event, payment or payout feature may be unavailable. Optional profile, marketing and similar information can be left blank or disabled where the product allows it.
Some information is public or shareable by design, such as public event pages, organizer profiles, selected profile information, public posts, event media, usernames and avatars. Content already copied, cached, indexed, screenshotted or shared by others may remain outside our control after you delete or hide it.
For the core platform, we normally act as controller. An event organizer may act as a separate controller when it independently uses participant information for event delivery, attendee management, safety, local compliance, tax records or customer communication. Organizers must use participant data lawfully and only for appropriate event-related purposes.
We use precise device location only when you grant the relevant permission. Approximate or selected location may also be used for nearby events, maps, routes, meeting points, distance, addresses and timezone support.
If you choose to share your live location on the map with mutual followers or people you select, we process your precise location while sharing is on and show it only to those people. You can stop sharing at any time; when sharing stops, your shared location is removed. Crew does not use your location in the background.
Map and location data needed for a requested feature may be sent to map or location providers such as Google Maps Platform. You can manage device location permission in your device settings; some map or nearby features may not work without it.
We use your public IP address with the MaxMind GeoLite2 Country database to derive a coarse country. We do not display your IP address. The derived IP location may be shown publicly on your profile and alongside your public posts and comments. We show this country-level location publicly to support community trust and to help prevent impersonation and fraud, based on our legitimate interests. Only the country is shown, never your IP address or precise location. The IP location is updated automatically from your IP address whenever you use Crew while signed in. If you object to this, email privacy@crew-app.com. We review each objection and can hide the IP location on your account.
This product includes GeoLite2 Data created by MaxMind, available from https://www.maxmind.com.
Payments, payouts and subscriptions are processed through Stripe and Stripe Connect; banks and card networks may also be involved. Those providers may receive information needed for payments, refunds, disputes, identity or business verification, tax checks, transfers, payouts, subscriptions, fraud prevention and compliance.
For paid event registrations, we send the email address you confirm before paying to Stripe so that Stripe can email you the payment receipt. When your payment is authorized, we also email you a registration confirmation at that address through our email delivery provider.
We may receive and keep provider identifiers and transaction status needed to operate paid features, support users, reconcile balances, handle refunds or disputes and meet financial obligations. Sensitive onboarding or card details should be entered through the provider's secure flow, not through chat.
We share personal data only where needed for the Service, a transaction, safety, compliance or a request you make. Recipient categories may include:
Service providers may process data under our instructions, their contracts, their own legal duties, or as independent controllers for services they provide directly to you. Service providers that process personal data on our behalf are bound by contracts that require them to protect it to at least the same standard as described in this Privacy Policy and to use it only to provide their services to us.
When you use phone sign-in, your phone number is sent to Google so that the verification code can be delivered. Google states that phone numbers provided for phone sign-in are also sent to and stored by Google to improve spam and abuse prevention across Google services, including Firebase. Depending on your device, reCAPTCHA may process signals such as IP address, device identifiers, device integrity information, app interaction information and information about certain apps installed on the device. More information is available in Google's Firebase privacy and security information.
Our website also uses Google reCAPTCHA to protect our interfaces from automated abuse, such as scripts that copy content in bulk or flood the Service with requests. When you use the website, reCAPTCHA processes your IP address and browser and device signals, such as browser, screen and device information and how you interact with the page, and tells us how likely it is that a request comes from a genuine visitor. We rely on our legitimate interests in preventing abuse and keeping the Service secure. Google provides reCAPTCHA to us as a service provider. reCAPTCHA sets a cookie that is necessary for this check; our Cookie Policy explains it. More information is available in Google's Privacy Policy.
Although your sign-in phone number is held in Firebase Authentication, the personal data export you can request in the app includes it.
Where allowed, we may send product updates, event recommendations or promotional messages and measure promoted content. Where consent is required for marketing, non-essential analytics, advertising or similar technologies, we ask for it before using those technologies for that purpose.
You can opt out of marketing without stopping necessary service, account, payment, event or safety messages. We do not sell personal information or share it for cross-context behavioural advertising as those terms are commonly used in California privacy law.
Our Cookie Policy explains cookies, local storage, SDK storage and similar technologies in more detail.
Automated systems may help detect fraud, spam, suspicious sign-ins, payment risk, abuse, security incidents and policy signals. Authorized personnel may review relevant reports, content, account context or payment context when needed to investigate or enforce rules.
To moderate content, photos and video frames you upload are analysed by Google Cloud Vision, and text you publish in posts and events is analysed by Google Cloud Natural Language, after translation into English by Google Cloud Translation where needed. Clear results decide automatically. When a result is uncertain, and for reports and appeals, a Google Vertex AI (Gemini) model in the EU assesses the content together with the report or appeal and the earlier decision. These decisions are made automatically, without a person reviewing each one. The Community Guidelines explain these checks.
Decisions to publish, reject or remove content, comments and media, and decisions on reports and appeals, including the measures taken when a report is upheld that the Community Guidelines describe, are made solely by these automated systems. Each decision tells you the reason, and you can appeal decisions about your content, events or profile in Crew Studio, where appeals are decided again automatically. Our team decides whether to cancel a reported event and refund attendees, and whether content that may endanger someone’s life or safety, sexual content involving minors or terrorist content must be reported to law enforcement. Decisions about your account, such as suspension, are not made solely by automated means. Payment providers, app stores or other independent services may use their own automated risk or eligibility systems under their own notices.
We and our providers may process data in the United Kingdom, the EEA, the United States and other countries. Where required, we use lawful transfer mechanisms such as adequacy decisions, standard contractual clauses, provider contracts and supplementary safeguards. For example, Google Firebase Authentication processes sign-in data, including sign-in phone numbers, in the United States; Google's data processing terms for Firebase include standard contractual clauses, and Google states that it complies with the EU-U.S. and Swiss-U.S. Data Privacy Frameworks.
To ask about the safeguards or obtain a copy of an applicable transfer mechanism, contact privacy@crew-app.com.
We keep identifiable data only for as long as needed for the purpose described here, unless law or a legitimate need requires longer retention.
| Data | Typical retention |
|---|---|
| Account and profile | While the account is active; after deletion, removed, anonymized or put beyond normal use within a reasonable period except where retention is required |
| Sign-in phone number | While it remains a sign-in method for your account. When you remove it, or when account deletion is completed, it is deleted from your sign-in account, and Google removes deleted Firebase Authentication data from its live and backup systems within 180 days. Firebase keeps logged IP addresses used for sign-in security for a few weeks. Phone numbers that Google stores for its own spam and abuse prevention are kept under Google's practices |
| Sign-in accounts without a completed registration | Sign-in accounts that verified a sign-in method but never completed registration are deleted automatically after 7 days |
| Events and registrations | Usually up to 3 years after the event or account closure; up to 6 years where tied to payment, tax, accounting, complaints or legal claims |
| Payment, payout, refund, subscription, invoice and tax records | Kept in pseudonymised form for 6 years from the end of the relevant financial year to meet accounting obligations, or longer where law, audit, fraud, dispute or legal claims require it |
| Contact details of an organizer who still owes money | If an organizer deletes their account while still owing Crew money, for example after a refund or chargeback larger than their available earnings, we keep their email address and the phone number in their profile in identifiable form, together with the payment records that show the amount owed, only to recover it or to establish, exercise or defend legal claims. We delete these contact details once nothing is owed |
| Support, reports, moderation and safety records | Usually up to 3 years after closure; serious safety, fraud, legal or payment records may be kept up to 6 years or longer where legally required |
| Messages and user content | While the account or relevant feature remains active unless deleted earlier; content linked to reports, safety, payment or disputes may be kept longer |
| Precise location and technical logs | Used for the requested feature; recent technical logs are usually kept up to 90 days unless linked to safety, fraud, support or legal records |
| Analytics, diagnostics and performance | Usually up to 14 months in identifiable or pseudonymous form where available; aggregated or anonymized statistics may be kept longer |
| Records of your acceptance of the User Agreement and this Privacy Policy | While your account exists and for 6 years after account deletion is completed, or longer where a specific legal obligation or dispute requires it. These records contain only your internal user ID, the document and version, language, acceptance time and source, and the time you confirmed you are at least 18; they do not include your IP address or browser or device details |
| Consent, marketing suppression and cookie preferences | Consent or suppression records may be kept up to 3 years or as needed to respect your choice; cookie preferences are usually up to 12 months |
| Backups | Usually overwritten or deleted within 90 days unless security, disaster recovery, legal hold or system integrity requires longer |
When identifiable data is no longer needed, we may delete it, anonymize it, aggregate it or place it beyond active use.
You can request account deletion in the app under Settings / Account & Security / Delete account. The current process includes a 7-day cooling-off period before execution. If you cannot access the app, the public Account Deletion page explains the alternative request route.
You can’t submit a deletion request while items such as pending payments, balances or payouts, refunds, disputes, events you host or attend, unsettled event ledger amounts, active subscriptions or groups you own remain unresolved; the app shows what to finish first. Money you owe Crew as an organizer, for example after a refund or chargeback larger than your available earnings, does not block a request: after deletion we keep the amount owed, your email address and the phone number in your profile only to recover it (see section 11). Registrations for paid events hosted by others that are still waiting for payment do not block a request: when you submit it, we cancel them without charging you and give up any spot a waitlist was holding for you. Withdrawing the request does not restore them. If such an item comes up before deletion is carried out, the request is cancelled and we notify you. Records may still be retained where needed for payment integrity, fraud prevention, tax, accounting, safety, disputes, audit, backup or legal compliance.
Depending on where you live and the legal basis used, you may have rights to access, correct, delete, restrict or object to processing, receive or transfer certain data, withdraw consent and opt out of direct marketing. Withdrawing consent does not affect processing that was lawful before withdrawal.
Right to object: where we rely on legitimate interests, you may object to that processing in circumstances provided by law. You may object to direct marketing at any time.
To exercise a privacy right or make a data-protection complaint to us, contact privacy@crew-app.com or use an in-product privacy tool where available. We may need to verify your identity and may limit a request only where applicable law permits it.
UK users also have the right to complain to the Information Commissioner's Office (ICO). Information about making a complaint is available at ico.org.uk/make-a-complaint. EEA users may complain to the data-protection supervisory authority in the country where they live, work or believe an infringement occurred.
California and other US state residents may also have applicable rights to know, access, delete, correct or port personal information; opt out of sale, sharing, targeted advertising or certain profiling; limit certain uses of sensitive personal information; and exercise rights without unlawful discrimination. Where a legally recognized opt-out preference signal applies and is technically supported, we treat it as required by law.
We use reasonable technical and organizational measures designed to protect personal data, including access controls, logging, encryption in transit, provider security features, least-privilege access and monitoring where appropriate.
No online service or transmission method is completely secure. Keep your credentials, devices, verification codes and payment access secure, and contact us if you believe your account has been compromised.
We review this policy as features, data practices, providers and legal requirements change. For material updates, we may provide notice in the app, on the website, by email or through another appropriate channel where required.
If we plan to use personal data for a materially new purpose, we will update the relevant privacy information and provide any notice or choice required by law before starting that use.