Data you own and control

Here’s exactly what leaves your device, where it goes, and what we don’t do with it. No hand-on-heart language: the point of this page is to tell you the shape of the data flow in specific enough terms that you can decide for yourself whether it is the shape you want.

Where your syndicate data lives

Your syndicate’s data lives in a managed database on servers we rent in the European Economic Area. The app keeps a local copy on your device, a filtered slice of the relevant data, so it can run without a signal; writes queue locally and push back when you reconnect. The filter is per-membership: you only ever receive data for syndicates you belong to.

The kinds of data that replicate to the device (bookings, usage logs, maintenance, financial transactions, and so on) are listed on Offline capabilities. Some areas are deliberately online-only (invites, notification preferences) because they either need a server-side check or are too sensitive to last-write-wins conflicts. Payments replicate so you can see them without a signal, but making one always goes to the server.

What else leaves your device

Crash reports. When the app crashes, we collect the technical trace of where the code failed, the device model, the OS version, and the app version, linked to your account so we can follow it up. We do not collect your content and we do not collect syndicate data. If you had a flight log open when the app crashed, the crash report does not contain that log, only the trace of where the code failed.

That is the whole list of non-sync egress. No analytics SDK, no advertising identifiers, no third-party tracking.

What we don’t do

We don’t sell your data.
We don’t train AI models on your data.
We don’t show ads.
We don’t share your data with marketing or advertising partners.

These are commitments, not hedges. The business model is straightforward (see Subscription philosophy) and none of the above is part of it.

Your account and your syndicate

A syndicate’s data belongs to the syndicate, not to any one member, because it is shared by all of them. When you delete your own account, your personal profile and your own identifying records are removed; records that belong to the syndicate as a whole (shared financial records, the booking history that the group relied on) may be retained in anonymised form for the other members, so their records of the syndicate are not torn up when one person leaves.

The in-app confirmation states this directly: deleting your account removes you from all syndicates, and your bookings and financial records are anonymised rather than destroyed. Once nothing is outstanding, deletion happens 30 days later and you can cancel any time before then; after that it is irreversible. If something is still outstanding when you request it (an unsettled balance, a payment of yours still being collected, or a syndicate where you are the only admin, for example), the request is put on hold and the 30-day countdown starts only once you have cleared it. A payment still with the bank is the one hold you need do nothing about: it clears itself when the collection settles or fails, usually within a few working days.

If you are the only member of a syndicate, there is no one left whose records depend on yours, and the syndicate can be wound up. If you are one of several, your departure does not erase the syndicate.

How long we keep things, and when they are removed

Your data does not sit around forever once it stops being used. A few automatic rules apply, all with the same aim: keep what the group still relies on, and clear out what has been abandoned.

Idle free syndicates are eventually removed. A free syndicate that goes about six months with no activity is deleted, along with its data. Members are emailed a warning well before the date, and again as it approaches, so it never happens unannounced. Any activity resets the clock, and paid syndicates are never removed this way.
An account with no syndicate is reminded, not removed. If you leave your last syndicate and do not join or create another, nothing happens to your account. Being between syndicates is an ordinary situation and we do not treat it as an abandoned account. What we do instead is tell you: six months after your last membership ends, and once a year after that, we email you to say what is still held on your profile and how to delete your account if you would rather it were gone. Deleting it is your decision, never ours, and joining a syndicate stops the reminders.
A closed syndicate stays recoverable for a while. Closing a syndicate makes it read-only and keeps it reinstatable through a retention window before it is finally removed. See Close a syndicate.
Financial records outlive the rest. Wherever money has changed hands, an anonymised financial trail is kept even after a syndicate or account is gone, and financial records are held for as long as tax rules require. That is for the group’s audit trail and our legal obligations, not for anything to do with you personally.

Deletion you ask for yourself works differently and is covered above. The timings here can be adjusted over time; the binding version is always the Privacy Policy and Terms of Service (see below).

Your settings, your control

Separately from account deletion, you have fine-grained privacy controls at the syndicate level while you are a member. Three settings (whether member names appear on other people’s calendar bookings, which roles see the financial detail of other members’ usage logs, and whether usage photos are visible across the syndicate) are configured on Privacy & Visibility. Photos attached to usage logs are stored privately and served only via short-lived signed URLs; see usage photo privacy for the exact rules.

None of these settings are feature-gated. They apply equally on the free tier and the paid tier.

Getting a copy of your data

You can download a copy of your personal data at any time, straight from the app: open the Profile tab, find the My data section, and tap Download my data. After you confirm your password, the app hands you a zip file containing your data in a common, machine-readable format, including copies of the pilot documents you uploaded. See Download your data for the steps.

This is your data-portability right under UK GDPR, and it is separate from deleting your account: taking a copy leaves your account and your syndicates exactly as they are. If you would rather not use the app (or no longer can), email [email protected] from the address on your account, and we will send you an export within 30 days.

Ask us rather than using the in-app download if you need the records of a syndicate that closed more than 30 days ago. An ordinary member’s access to a closed syndicate ends at that point, so the in-app download can no longer reach it, but we still hold the data for the retention window and can put the complete set together for you. Close a syndicate explains the cutoff and how long the data is kept.

Where to read the legal version

This page explains the shape of the policy in plain terms. The legal versions live in-app at Account → About → Terms of Service and Account → About → Privacy Policy. They are also available as public routes (/terms and /privacy) so you can read them before signing up or share a link with a prospective member. The legal text is the binding version; if anything here and there disagree, the legal text governs.