Version 2026-10-03k (Last Updated: 3 October 2026)
1. Who We Are
TeamGT Aviation Ltd ("we", "us") operates Crew Roster Share and
is the data controller for it. We are responsible for deciding how and why your
personal data is processed through this Service.
Registered in England and Wales, Company No. 14421662. Registered
office: SIU Offices, 4-6 Greatorex Street, London, E1 5NF, United Kingdom.
This is an independent crew tool and is not operated by, or an
official system of, any airline. Data protection queries: see Section 13.
2. What Personal Data We Collect
Identity & contact data you give us: first name, surname, rank
(Captain/First Officer/Senior Cabin Crew Member/Cabin Crew), employee number, home
base, and email address, collected when you complete your profile or when an
administrator sets up your account directly on your behalf.
Your roster calendar link: the crew scheduling app's
".ics" calendar subscription URL you provide. We use this link to fetch your
schedule (see Section 4).
Roster & duty data derived from that calendar feed:
flight numbers, routes, scheduled times, aircraft registration, block hours, and a
day-by-day classification of your duty (working, standby/reserve, or off). See
Section 3 for how sickness and fatigue entries specifically are handled.
Account security data: your password (stored by our
authentication provider, Google Firebase, in hashed/encrypted form. We never see
or store your actual password), and a sign-in log recording the time, success or
failure, sign-in method, IP address, and browser/device information (User-Agent
string) for each sign-in attempt, and for each time you open the Service while you
are still signed in from an earlier visit (recorded at most once every 30 minutes).
This log is visible only to administrators and is kept for 90 days.
Content you create: custom "friend list" groups you
set up to view rosters across bases, and any invitations you send (which record the
recipient's name).
Swap flags and swap messages (optional): if you flag one
of your own flights as one you'd like to swap, or a day off you'd be happy to work,
we store that flag (the flight or date, your name, rank, employee number and home
base, and any note you add). If a colleague messages you about it, we store those
messages (the text, who sent it, and when) in a conversation between the two of
you.
Roster history: each time your calendar is synced, we remember
what is on each upcoming day of your roster - which flights (number and route) and which
other duties (such as standby, reserve, days off, leave or training) - the first time we
see that day, and again whenever it changes. We do not store times for this, so a delay is
not recorded as a change. Sickness and fatigue are never stored. This lets you see how
your roster has changed and look at earlier versions of it. It is kept
in a private record that only you can read.
Your permanent logbook record: so that your logbook can last for years, once a
flight you worked is a couple of days old we keep a private copy of it just for you: the date, flight
number, route, times, aircraft, and the names and ranks of the crew who were on it (as shown in the
roster at the time). Colleagues' employee numbers are not kept in it. Only you can see it; it is not
shown to other crew or to administrators.
Invitations: if you join by following an invite link another member
shared, we store that member's user ID on your profile. It is visible to you and to
administrators (who see it when deciding whether to approve you), and may be used later to
thank members who bring colleagues in. Sending an invite stores nothing about the person you
send it to - the link is just a web address.
Commission entries (optional, cabin crew only): if you log
the commission you earned on a flight, we store the amount together with the flight,
route, date, and your name and employee number. We also keep a running total and
count per route, used to show an average to other cabin crew.
Flight times from the ACARS page (optional, pilots only, in
the iPhone app): if you photograph the aircraft's ACARS flight log page to add your
actual flight times, the photo is read on your phone and is not uploaded or saved. We
store only the four times (out, off, on and in), the flight and date, and your user
ID, in your own private logbook. A time you adjust by hand on a Logbook row is kept
only on your device.
Landings, instrument time and simulator time
(optional, pilots only, in the app or on the website): if you type these into your logbook
yourself, we store the numbers (landings, instrument time, or a simulator session's
date, duration and short note), the flight they belong to, and your user ID, in your
own private logbook. The same applies to the other optional details a pilot can add to a
flight - whether you were pilot flying, night landings, holds, up to three approaches
(type, runway and airport) - and to the short note any crew member can add to a flight
(up to 80 characters). None of this comes from the roster feed.
Importing your own logbook (optional, in the app or on the website):
if you import a logbook file from another app or a spreadsheet, the file is read on
your phone and only the flight entries in it (date, airports, times, flight time,
aircraft type and registration, your capacity, commander's name, landings, instrument
and simulator time, and a short remark) are stored, in your own private logbook,
with your user ID. The file itself is not uploaded or kept. You can delete an import
at any time from the import screen.
Contact Crew messages (optional): if you use "Contact
Crew" on a flight, the message you write is emailed to the other crew on that flight
(or in your shared list), one email each, sent from our shared mailbox. Replies come
back to that mailbox and are passed on to you by our system, so nobody's email
address is ever shown to the other person - only names. To make that work we
keep a small routing record for 30 days (who the email was sent to, who a reply should
be passed to, and the flight), and a reply sits in the mailbox only until it has been
passed on, then it is deleted. We don't keep a copy of the message text itself; see
Section 7 for who handles the email.
Technical data: your browser temporarily stores a
cached copy of your roster (for up to 15 minutes, to avoid repeated loading) in your
browser's session storage. This is cleared automatically when you sign out or close
the tab, and never leaves your device. Both the website and the mobile app also keep
a longer-lived copy of the last roster and profile you loaded on your own device, so
they can still be viewed without a signal (see Section 11).
If you delete your account, the reason you give is kept
in two places. A copy with no name, employee number, or any other identifying detail
attached is stored so we can see patterns in why people leave. Separately, just
before your data is erased, we send an email to the administrators' mailbox
(crewrosters@teamgt.aero) saying that you have left, with your name, email address,
base, rank and the reason you gave, so an administrator knows about it. That email is
an ordinary email record, not part of the app's database, and is permanently removed
from the mailbox and the mail server within 30 days.
3. Sickness & Fatigue: Not Stored At All
Your roster feed can include days marked as sick leave or fatigue. Information
about your health is "special category data" under UK GDPR, requiring a higher level
of protection than ordinary personal data, so we've designed the Service to avoid
holding any record of it: when a sickness or fatigue entry appears in your feed, the
Service recognises it only long enough to discard it, and stores nothing for that day
at all: no entry, no status, no label of any kind, the same as any day the Service
simply has no data for.
This means we do not hold a record you could later ask us to produce
showing which days you were marked sick or fatigued. That information isn't kept in
any form. If you ever need a record of your own sickness/fatigue history, your
official airline roster remains the authoritative source for that, not this
Service.
4. How We Get Your Data
Most data comes directly from you (profile details, your calendar link). Your
roster and duty data comes from your airline's own systems, via the personal calendar link
you provide. We fetch it automatically on a schedule (roughly every 30 minutes) and
whenever a crew member triggers a manual refresh, and we do not modify or verify it
against any other source.
5. Why We Use Your Data, and Our Legal Basis
| Purpose |
Legal basis (UK GDPR Art. 6) |
| Creating and administering your
account, approving access |
Contractual necessity: required to
provide the Service you've asked to use |
| Displaying roster/schedule data to
you and relevant colleagues |
Contractual necessity: the core
purpose you signed up for |
| Keeping a private, permanent copy of the
flights you have flown, with the crew's names, as your logbook |
Contractual necessity: it is the logbook
feature you use |
| Recording who invited you (invite links) |
Legitimate interests: helping administrators
check a new sign-up, and growing the Service among crew |
| Remembering your roster as it was and
when it changed (roster history) |
Contractual necessity: it is a feature
of the Service you use |
| Swap flags and swap messages,
commission entries, and Contact Crew emails (optional features you
choose to use) |
Contractual necessity: they only
happen when you use these features of the Service |
| Sign-in and access logging (security,
detecting misuse) |
Legitimate interests: account and
data security |
| Bot/abuse protection for the Service
generally, and specifically for SMS codes during optional two-factor
authentication (reCAPTCHA) |
Legitimate interests: keeping the
Service and your account secure |
Where we rely on legitimate interests (sign-in logging and bot/abuse protection above), we've considered that this is balanced against your rights: both
exist purely to keep the Service and your account secure, access to the sign-in log
itself is restricted to administrators, and neither is used for any other purpose.
Separately, the more sensitive categories of data (your full profile including email
and calendar link) are visibility-restricted rather than shared with every user, and
sickness/fatigue data specifically is designed not to be stored at all (Section
3).
6. What Other Crew Members Can See About You
- Visible to any approved crew member: your name, rank, employee
number, home base, and your flight assignments (route, flight number, time,
aircraft registration). Access to flight data is controlled at the
account-approval level, not scoped to your own base or to people you're
connected with: any approved crew member's account can technically
access any base's flight data, the same access boundary that lets the app show
you your own base's full roster and lets a custom cross-base list work at all. In
practice, the app's own screens only ever surface another base's flights to you
if you view it directly (e.g. as an administrator) or you're in a shared list with
someone based there, but this is a design choice about what the interface
displays by default, not a technical restriction on what your account can access.
Separately: if you choose to flag one of your own flights as one you'd like to
swap, or one of your own days off as one you'd be happy to work, that flag and
any note you add is shown to your own base. Nothing is shown for a flight or day
you haven't actively flagged. The name and membership of any shared "friend
list" group you're part of is visible to its other members. Your name, rank, and
home base can also be found by any approved crew member using the name-search
tool used to invite people to a shared list, regardless of whether you're already
connected to them or share a base.
- Your day-by-day work/standby/off classification: used to show
your own "current month / next month" block hours and flight counts, visible only
to you by default. If you're a member of a custom list whose creator has enabled
showing days off, standby days, or work days for that list, your status for those
categories becomes visible to the other members of that specific list, the same
account-level access boundary described above applies here too, so this is a
statement of what the app's screens show by default, not an absolute technical
restriction.
- Visible only to you and administrators: your email address and
your calendar (.ics) link. When you use "Contact Crew", your email address is
never shown to the people you write to, and theirs is never shown to you: replies
are passed on through our system (see Section 2).
- Swap messages: visible only to the two people in the
conversation, not to administrators.
- Roster history: visible only to you - not to other crew and not to
administrators.
- Your permanent logbook record: visible only to you - not to other crew and
not to administrators.
- Commission entries: each individual entry is visible only to you
and administrators. Cabin crew and administrators see an average per route (with
the number of entries behind it) on the roster, where only a few entries exist,
an average can be close to, or the same as, one person's figure.
- ACARS flight times, typed-in logbook entries and imported logbook: visible only to you - not to other crew and
not to administrators.
- Visible only to administrators: the sign-in log (Section 2).
7. Third Parties We Use
We use the following service providers to run the Service. They process data on
our instructions and are contractually/by their own terms restricted from using it
for their own purposes:
- Google Firebase (Authentication, Cloud Firestore database, and
Cloud Functions), which hosts your account credentials and all data described in
Section 2. Our background processing (roster sync, sign-in logging) runs in
Google's London (europe-west2) data center; the database itself is stored in
Google's "eur3" multi-region location, which replicates data across data
centers in Belgium, the Netherlands, and Finland for availability and
durability.
- Google reCAPTCHA: runs invisibly in the background on every
page load (including before you sign in) to verify requests to the Service are
coming from a genuine user, not a bot or script, protecting the Service from
automated abuse. A separate, equally invisible instance is also used specifically
during optional two-factor authentication (Options) to prevent automated abuse of
SMS verification codes. Neither ever shows you a visible challenge (no "click the
traffic lights" puzzle) under normal use.
- Our email service: the mailbox crewrosters@teamgt.aero, hosted by
BB Online UK Limited (the same UK provider as our web hosting, below). It is used
to send Contact Crew messages and to notify us of new registrations (which include
the applicant's name, email address, base, rank and calendar link). The content of
those emails passes through it, and replies to Contact Crew emails are received there
and passed on by our system before being deleted from it.
- Our web hosting provider, which serves the website itself: BB Online UK Limited (Company No. 3458098), PO Box 2162, Luton,
Bedfordshire, LU3 2YT, United Kingdom.
We do not sell your data, and we do not share it with anyone for
marketing purposes.
8. International Transfers
Your data is processed in two locations, both recognised as adequate under UK GDPR.
Our Cloud Functions processing (roster sync, sign-in logging) runs in Google's
London data centre (europe-west2), inside the UK itself, not a transfer at all.
The Firestore database is stored in Google's "eur3" multi-region location (Belgium,
the Netherlands, and Finland), within the European Economic Area, which the UK
government has formally recognised as providing an adequate level of data
protection under UK GDPR and the Data Protection Act 2018. Under Google's own Cloud
Data Processing Addendum, a transfer to a recognised adequate country doesn't
require Standard Contractual Clauses or any other additional transfer safeguard. The adequacy recognition itself is sufficient. We don't use any Google configuration
that would move your data outside these two locations.
9. How Long We Keep Your Data
- Sign-in log: 90 days, then automatically deleted.
- Profile data: for as long as your account exists, plus a short
period after removal to handle any queries, unless you ask us to delete it
sooner (Section 12).
- Roster/duty history: flight and duty records are kept for 12
months after the date they occurred, then automatically deleted. You can ask
for this to be deleted sooner on request.
- Your permanent logbook record: kept for as long as your account exists, so
your logbook lasts for years (the shared roster data it is copied from is still deleted after
12 months). It is erased when you delete your account.
- Who invited you: kept on your profile for as long as your account exists.
- Roster history: 12 months after the end of the month it covers, then
automatically deleted, or sooner if you delete your account.
- Swap flags: until you remove the flag, or 7 days after the
flagged date, whichever is sooner.
- Swap messages: 90 days after the last message in the
conversation, then automatically deleted.
- Commission entries: until you delete them yourself or delete
your account. Deleting an entry also removes it from the route average.
- ACARS flight times, typed-in logbook entries and imported logbook: until you delete them or delete your
account.
- Contact Crew emails: we don't keep a copy of the text; the
recipients' own mailboxes hold them. The small routing record that lets a reply be
passed on is deleted automatically after 30 days, and a reply is deleted from our
mailbox as soon as it has been passed on.
- Copies on your device: the 15-minute session cache is cleared on
sign-out; the longer-lived offline copy is cleared on sign-out and when you
delete your account.
- If you delete your account (Options): we erase your profile,
roster and duty records, roster history, swap flags, commission entries, list memberships and
invitations, your permanent logbook record, any Contact Crew routing records, and every swap conversation you took part in, including the other
person's copy of it, since the conversation can't be split.
10. How We Protect Your Data
Access to your data is controlled by security rules enforced on every request (not
just hidden in the interface), for example, your email and calendar link are only
ever readable by you and administrators, never by other crew. All connections use
HTTPS. Passwords are never stored by us directly. They're handled entirely by
Google Firebase's authentication
system in hashed form.
11. Cookies & Similar Technology
We don't use advertising or tracking cookies. The Service uses your browser's
temporary session storage to cache your own roster view for performance (Section 2).
Since October 2026, it also uses your browser's IndexedDB storage to keep a
longer-lived local copy of your roster data, so it remains viewable if you lose
signal. Unlike session storage, this can persist after you close the browser tab,
and is cleared automatically when you sign out. It also remembers a few small preferences on your device - such as whether times are shown in UTC or local time, how airports are written, when your roster last updated, and (in the app) whether the app lock is on. These stay on your device and contain no personal information. The mobile app does the same job
using its own storage on your device (not a cookie): it keeps a copy of the last
roster and profile you loaded so they can still be shown without a signal, and
clears it when you sign out or delete your account. Google reCAPTCHA (Section 7) runs
invisibly in the background to protect the Service from automated abuse. It doesn't track you for advertising or profiling purposes, and shows no visible
challenge under normal use. All of this falls within UK PECR's "strictly necessary"
exemption and doesn't require separate cookie consent, which is the same basis most
websites rely on for essential security measures like bot/abuse protection,
distinct from tracking cookies that do require consent.
12. Your Rights
Under UK GDPR, you have the right to: access the data we hold about you; have
inaccurate data corrected; ask us to delete your data; restrict or object to certain
processing; receive your data in a portable format; and withdraw consent at any time
where we rely on it (this doesn't affect processing already carried out). To
exercise any of these, contact us using the details in Section 13 and we'll respond
within one month as required by law.
For deletion specifically, you don't need to wait on us at all. Options
in the Service has a "Delete Account" tool that erases your account and data
immediately and permanently, yourself, at any time.
13. Contact Us & Complaints
For any question about this notice or your data, or to exercise your rights,
contact crewrosters@teamgt.aero.
If you're unhappy with how we've handled your data, you also have the right to
complain to the UK's data protection regulator, the Information Commissioner's
Office (ICO), at ico.org.uk
or by phone on 0303 123 1113.
14. Automated Decision-Making
We don't use your data to make any automated decision about you that has a legal or
similarly significant effect. Duty classification (working/standby/off) is a simple,
transparent categorisation of your own roster data for display purposes, not a
decision made about you.
15. Changes to This Notice
We may update this notice from time to time. Material changes require you to accept
the new version before continuing to use the Service (see the Terms of Service
Section 10).
