Good friends. Great challenges.

Pilot privacy notice

Updated October 2, 2026. This notice describes the Crewcapade pilot operated by Kamil Ladhani. Contact the operator for privacy questions or requests.

Information we use

We use your account email, display name and account identifier to sign you in and manage crew membership. Supabase handles password authentication and account verification. We store season and crew settings, challenges, written responses, photos, videos (including recorded audio), review decisions, reports, participation acceptances and score history to run competitions and prevent abuse.

Camera, selected-photo and video microphone access are used when you choose those features. We do not request your contacts or device location. Uploaded files can contain embedded metadata, including location; raw files are temporarily stored privately while processing strips location metadata from the versions served to players. Avoid uploading sensitive information or people without permission.

Who can see entries

Pending and rejected text entries follow crew and host access rules; accepted text entries are visible to season members. Photos and videos stay visible to their author and eligible hosts until a separate content review allows broader viewing. The operator can process safety concerns and take down content. Blocking prevents new access to each other's evidence; links already issued expire within at most five minutes. Blocking the group owner makes their seasons unavailable.

When you choose to share finalized results, the summary includes season and crew names, scores, dates and result revisions. It excludes entry responses, photos, videos and private viewing links. People can save or share copies outside Crewcapade; we cannot recall those copies.

Service providers and security

Supabase provides authentication, database and private file storage. Vercel hosts our media, account and support services. Our planned transactional email provider is Resend; hosted sender setup is still pending. These providers can process network and service metadata, including IP addresses and request/security logs, under their own service practices. We use HTTPS for hosted services, private evidence storage and access controls. Authorized services process files; this is not end-to-end encryption.

The current app has no advertising, advertising identifiers, cross-app advertising tracking, payments, facial analysis or model training. Device entry drafts stay on that device until submitted. Native session tokens use Keychain or Keystore.

Retention and deletion

Written responses, media and review details expire 90 days after the season ends. Access ends at the deadline; automated cleanup then scrubs evidence and deletes active files, with retries after failures. Accepted scores remain. Abandoned raw uploads become cleanup-eligible after 21 minutes; unregistered processed files after 24 hours.

Account deletion removes your sign-in account, profile and memberships, withdraws your entries and reverses their points. Evidence is hidden and queued for file deletion. Score history without your profile, shared season settings and challenges remain for the other participants. This is not a guarantee that other participants cannot infer authorship. Existing co-hosts inherit ownership where available; seasons without sufficient host/review coverage are archived.

Support/deletion requests and operator safety reports are kept while being handled, then for up to 90 days after resolution. Moderation action records are retained for up to 90 days. For request abuse prevention we store a daily-keyed hash of the request's network address, not the raw address in our support table; that hash is cleared after 25 hours. Provider access/security logs have separate retention practices.

Active-storage cleanup cannot immediately erase provider disaster-recovery backups or copies saved by other people. We do not operate a separate app-managed backup service for this pilot. Backup handling and restore safeguards must be reviewed before public launch. Contact the operator for questions about provider retention or access to your information.

Your choices

You can skip activities, withdraw entries, block players or report content. In the app, open Account → Delete your account, type DELETE, confirm a new email code and choose the final deletion action. You can also request deletion on this website after uninstalling; identity verification is required before any account is removed. You do not need to reinstall the app to request help. Never send passwords or sign-in codes through the form.

The pilot is for adults 18 and over. This notice and the app's participation terms may change as the pilot develops; substantial community-rule changes require renewed acceptance. Use the support form for privacy rights, corrections, deletion questions and concerns.