Crew KittyPrivacy policy
Your trip data and your rights.
Updated 25 October 2026
My data & privacy requestsWho is responsible
Crew Kitty is operated by Alex Petrova, the controller for the personal data processed to provide this service. This policy applies to sailkitty.app and the Crew Kitty web app. Contact Alex using the email below for any privacy question or request.
Information we handle
Google sign-in supplies your account identifier and email address; the sign-in provider may also supply basic profile details. Trips contain names and roles of crew, optional email addresses or phone numbers, boat and trip dates, expenses, currencies, who paid and shared costs, optional dates and locations, kitty contributions, settlement status and account links. We also handle authentication/session information and technical error, security and hosting logs. Please do not enter card details, bank passwords, health information or other sensitive personal information.
Why we use it and our legal bases
We use account and trip data to provide the service you request, sync trips, manage crew access and calculate settlements (performance of a contract). For crew information entered by an organiser who is not the person concerned, and for necessary security and diagnostics, we rely on legitimate interests in running a safe shared-expense service, subject to individuals' rights. We may process information to meet legal obligations. Optional activities requiring consent will be explained separately; consent can be withdrawn without affecting earlier lawful processing. We do not sell personal data or use trip information for advertising.
Who can see a trip
The organiser manages their trips. Invited, signed-in crew can view the trip they join and manage only their own entries; settlement payment controls are limited to payments involving them. Alex Petrova, the authorised app administrator, can inspect and edit trips for support and administration. Treat an invite link as private: a signed-in person with it can preview the trip and claim an available crew name. Share links only with the intended crew.
Service providers and sharing
Lovable Cloud and its hosting, database and authentication providers process information needed to operate Crew Kitty. Google handles sign-in, and Google Fonts is requested by the app. Currency lookups use Frankfurter with currencies and dates, not crew names or contact details. When an organiser closes a trip, we send its summary to their account email through Lovable's managed email service once the sender domain is verified. The email includes crew names, expenses, optional locations and settlement payments; the service handles delivery records and opt-outs. Optional donations open PayPal, which handles payment under its own privacy policy; Crew Kitty does not collect payment credentials or verify donations. WhatsApp summaries are shared only when you choose to copy or send them and can contain crew names, costs and locations. The app's receipt scanning interface is currently disabled. Platform diagnostics may receive technical errors and page paths.
International processing and safeguards
Service providers may process data outside the UK or EEA. Where required, the controller must establish an appropriate transfer mechanism, such as adequacy decisions or approved contractual safeguards. Contact us for information about applicable providers, processing locations and safeguards. A provider and transfer review is required; this policy does not certify that review has been completed.
Storage on your device
The app uses browser storage for sign-in sessions, cached trip data, settlement currency preferences, the return path after sign-in and remembering the optional support invitation. This enables core app functions rather than advertising. Anyone with access to an unlocked device may be able to read cached information. Sign out on shared devices; My data includes a sign-out-and-clear option. Hosting or sign-in providers may use their own cookies or storage. This notice is not consent for future optional tracking, which must be assessed separately before it is added.
How long data stays
Active account and trip records remain while needed to provide the service, unless you delete a trip or request erasure. Closing a trip locks it; it does not delete it. An organiser can delete a trip from the app, removing its active record and linked memberships. Copies in backups, provider logs, exports, other devices or messages already shared may remain under the relevant provider's retention or another person's control. Exact backup and log retention periods are still being reviewed; contact us for the current position. We do not promise immediate deletion from every backup.
Your UK and EU GDPR rights
Subject to applicable law, you can request access, correction, erasure, restriction, portability, or object to processing based on legitimate interests. You can download your account and accessible trip records in My data. Organisers can correct or delete their trips; crew can correct their own editable entries or ask the organiser. Contact us for account deletion or other rights, including details retained in shared trips. We may need to verify identity and consider others' rights or legal retention requirements. We aim to respond within one month; permitted extensions and any lawful exceptions will be explained. Settlement calculations are informational, not legally binding decisions about you.
Crew information supplied by organisers
Tell your crew that their details are recorded here and share this policy with them, including people who do not create an account. Add only necessary details, keep them accurate, and share summaries only with appropriate recipients. Account removal does not automatically erase every record kept by other organisers; requests concerning shared records will be reviewed without silently changing financial amounts.
Complaints and changes
You can contact us first, but this does not limit your right to complain to the UK Information Commissioner's Office (ico.org.uk) or your local EEA data protection authority. We will update this notice when practices change and communicate material changes where appropriate. This notice and the app's data tools support privacy obligations; they are not a legal certification of GDPR compliance.