Privacy policy

Who we are

On Chocks is run by [full legal name], a sole trader in Australia (ABN [ABN]). In this policy "we" and "us" mean On Chocks. You can reach us at support@getonchocks.app.

The short version

• The app refuses hotels and other places to stay, and hotel names in what you post. If one slips through, report it and we remove it.
• You sign up with your airline work email. Your airline stays private and never shows, to other crew or anyone else.
• Other crew see your nickname, your role and the month you posted.
• The app never stores your email address. It keeps only a scrambled fingerprint of the address and your airline.
• Your location stays on your phone. Apple Maps gets it only when you ask for travel times, or when you search for a place to add while your map is showing where you are.
• Location data is removed from the photos you add.
• Searching for a spot runs on your phone, and what you type stays there.
• The health and safety log stays on your phone. We never receive your entries.
• Your data is never sold.
• We never tell your airline or employer that you use On Chocks.
• You can delete your account in the app: open Me and tap Delete account.

What we collect and why

Your work email and sign-in

To sign up, you type your airline work email. Our server sends a 6-digit code to that address through Postmark, our email provider, and then discards the address. Our database stores a scrambled fingerprint of it instead (a keyed hash). The fingerprint lets you sign back in to the same account and stops one email from making two accounts. Postmark keeps a copy of the code email for [45] days, then deletes it.

We store codes only in scrambled form. A code expires after 15 minutes.

Your airline

We work out your airline from your email's domain and record it privately. Other crew, share pages and this website never show it. We use it for three things: to check that you're airline crew, to work out whether your access is free, and to make sure a health note counts crew from more than one airline.

Your profile

You choose a nickname and a role, Pilot or Cabin crew. Other crew see them beside what you post, with the month you posted. They don't see your account ID, the exact time you posted, your email or your airline, and your nickname doesn't open a profile.

What you add

We store the spots, quotes, recommends, tips, photos and saves you add with your account. In the app you can remove a save, and take back a quote, a recommend or a spot you added, from Me. Taking back a recommend removes your quote, tips and photos for that spot with it. A spot you added stays on the map while other crew recommend it. To remove one photo, email us. Other verified crew see your spots, quotes and recommends. A dropped pin, or a place with no Apple Maps category or place ID, waits for our approval before other crew see it. Your saves stay private.

Before anyone else sees a photo you add, we remove its location and other hidden data and check it by hand. We refuse photos of hotels.

Before your first post, the app asks you to agree to the posting rules in our terms. We record which version you agreed to and when.

"Can't verify?" requests

If your airline email doesn't work, you can send a request with a short note, such as your role and base. We keep the note, your email's domain (the part after the @), the email's fingerprint and a scrambled form of your network address, so we can check the request and send the answer to your phone. We delete a request [90 days] after we decide it.

Reports and blocks

When you report a spot, quote or photo, we store what you reported, the reason and any note you add. The person you report isn't told who reported them. When 2 crew report the same thing, the app hides it until we review it. We get an email about new reports, and it never says who sent them.

When you block a crew member, you stop seeing their quotes and photos, and the spots only they added. They aren't told.

Search

Searching for a spot runs on your phone, over the city you have open, with or without signal. The app doesn't send what you type to us, and we don't store what you searched for. Your recent searches stay on your phone.

When you look for a city, or for a place to add as a spot, the app sends the text you type to Apple Maps so Apple can find it. When you search for a place to add, it also sends Apple the area your map is showing, so places near it come first. If your map is on where you are, that area includes your position. None of this reaches us.

Notifications

If you allow notifications, we store your phone's push token so we can tell you when we answer a "Can't verify?" request or your photo goes live. Expo's push service and Apple deliver them. A notification never shows a city, a spot, a time, a nickname or an airline. We delete the token when you sign out or delete your account.

Purchases

The unlock is a one-time purchase in the app. You pay through Apple, and we never see your card details. RevenueCat checks your purchase for us and restores it on a new phone. It receives your purchase details and your account ID. We don't send it your nickname, role, email or airline.

We keep a record of whether your account is unlocked, by a purchase or because we gave it free access.

Crash reports

If the app crashes or hits an error, it sends a crash report to Sentry so we can fix it. Before sending, the app removes email addresses, codes, coordinates, search text and nicknames, and it doesn't attach your account. A report holds technical details: your phone model, iOS and app versions, and what the app was doing. Sentry's own software sends one kind of report, a crash deep in iOS code, before the app can trim it. That report can also hold your phone's time zone and a random ID for this install. Sentry keeps reports for [90] days.

Security

To stop abuse of sign-in, we keep a scrambled form of your network (IP) address, which changes every day, with sign-in attempts and requests. We don't store the IP address itself. Supabase, which hosts our server, logs requests to it with their IP address for security and keeps those logs for [number] days.

What stays on your phone

Your location stays on your phone. If you allow it, the app uses your location while it's open to work out walk times and show spots near you. It never sends your location to us, and it never asks for your location in the background. The phone works out walk times itself and sends nothing to Apple for them. Apple Maps gets your position only when you tap for travel times, and only for that request, or when you search for a place to add while your map is showing where you are. The app also sends Apple the text you type in a city search, so Apple can find the city.

The cities you download for offline use, your saves, your recent searches and posts waiting to send live on your phone.

When you keep a place for yourself, the app stores it on your phone and nowhere else. Other crew can't see it, and it stays out of search, counts and share pages until you share it with crew. When you sign out or delete your account, the app clears your private places from the phone.

You can bring your Google Maps lists into the app. You export them with Google Takeout and pick the file on your phone, then choose for each list whether its places go on the crew map or stay private on your phone. The app reads the lists on the phone. Your notes and Google's links don't leave it. To find each place, the app looks up place names and list names in Apple Maps. Places from a list you share are posted as crew spots; your lists themselves are never shown to anyone. When you sign out or delete your account, the app clears the checklist from the phone.

When you sign out, the app also clears your saves, recent searches, unsent posts and the list of cities you opened recently from the phone. If you're online, signing out ends your sessions on our server too, on every device. The app keeps the downloaded cities, which hold only what any verified crew member can see.

Health & safety log

You can keep a private log of health and safety problems on a layover, such as feeling unwell after a meal or a security scare. The log can hold health details, which are sensitive, so the app asks you to agree before your first entry.

The log stays on your phone. The app never sends your entries to us, to your airline or to anyone else, and other crew can't see them. You can delete any entry. To pass entries to someone, such as your union or safety rep, you export them yourself through the iPhone share sheet.

Signing out or deleting your account removes the log from the phone. The app warns you first and offers an export.

Counting an illness for other crew

When you log an illness at a crew spot, you can switch on "Count this for crew". It stays off unless you switch it on. The app then sends us one thing: which spot. It sends nothing you wrote and no details of the illness. We keep the count, and the day we received it, with your account for up to 30 days, so that one account counts once for a spot.

You can take a count back from its log entry at any time, and deleting the entry takes it back too. We delete a count after 30 days, and when you delete your account.

Crew see a note on a spot only when 3 or more crew from more than one airline have counted an illness there within 30 days. The note reads "3 or more crew logged feeling unwell after a visit here in the last 30 days." It shows no number, name or airline, and nothing anyone wrote. It never appears on share pages or this website. If the owner of a place sends a valid complaint about a note, we take it off.

What the public can see

Share links and this website show only share-safe details of a spot: its name, category and kind, city, place on the map, hours, crew count, a crew photo, and a crew quote with the writer's role and month. They never show nicknames, airlines or health notes, and spots held for review never appear.

Who else handles your data

These companies handle data for us, only to run their part of On Chocks:

• Supabase: our database, sign-in, photo storage and server code. Data is stored in [region].
• Postmark: sends sign-in codes to you, and report and complaint alerts to us. United States.
• Sentry: crash reports. United States.
• Expo: push notifications and app updates. United States.
• RevenueCat: purchase checks. United States.
• Apple: the App Store, payments, maps, city and place search, travel times, and notifications.
• Cloudflare: this website and share pages, served from data centres worldwide.

Most of them are outside Australia, so your data leaves Australia when they handle it. We choose providers that protect it to a standard similar to Australian privacy law. We also share information if the law requires it, for example under a court order.

What we never do

• Sell your data, or use it for advertising.
• Track you across other apps or websites. The app has no advertising or tracking code.
• Show where crew stay, or let anyone pay to rank a spot.
• Tell your airline or employer that you use On Chocks, or what you post.

How long we keep it

• Your account, profile, airline and email fingerprint: until you delete your account.
• Sign-in codes and attempts, with the scrambled IP address: [2 days].
• "Can't verify?" requests: [90 days] after we decide them.
• Reports: [12 months] after we close them, so we can spot repeated abuse.
• Push tokens: until you sign out or delete your account, or after [90 days] unused.
• Your agreement to the posting rules: until you delete your account.
• Health counts: 30 days. A count you take back stops counting as soon as you take it back.
• Complaints sent through this website: [12 months] after we answer them. The scrambled network address kept with one: 1 day.
• Crew alerts: we keep an alert with the area you picked, the account that posted it and the accounts that tapped "Seen it too". For a closed road we keep the exact point you marked, and other crew see that point. We delete all of that [7 days] after the alert ends. A nightly job does the deleting, so it can take up to a day longer. If another crew member blocks you from one of your alerts, we keep that block with your account until they remove it or either of you deletes your account. The block doesn't say which alert it came from. Other crew never see who posted an alert. We see who posted one only when we review a report on it.
• City heads-ups: the city you picked, kept with your phone's notification token: [48 hours], then deleted.
• Crash reports: [90] days, at Sentry.
• Backups: our backups roll over every [number] days, so deleted data leaves them within that time.

If we ban an account for breaking the terms, we keep its email fingerprint to stop the same email signing up again.

Deleting your account

You can delete your account in the app: open Me and tap Delete account. The screen lists what goes and what stays before you confirm.

We then delete your profile, nickname, role, airline, sign-in and email fingerprint. We delete your saves, tips and blocks, the reports you made, your push tokens, your agreement to the posting rules, your health counts, any "Can't verify?" request, and photos still waiting for our check. We ask RevenueCat to delete its record of your account. The app clears your personal data from the phone, including your private places and your health and safety log.

Spots, quotes, recommends and approved photos you posted stay up for other crew, signed "Verified crew", with no link to you. To remove any of them first, use Take back in Me, under Spots you added and Spots you recommend.

Your unlock stays with your Apple Account. If you join again, Restore purchases brings it back. Deleting an account doesn't lift a ban.

Your rights

You can ask us for a copy of the personal data we hold about you, ask us to correct it, or ask us to delete it. Email support@getonchocks.app and we'll reply within 30 days. You can also delete your account in the app, from Me.

Depending on where you live, you may have more rights, such as objecting to how we use your data or taking a copy to another service. We rely on these legal grounds: running the service you signed up for (your account, posts and purchases), our legitimate interest in keeping On Chocks safe and working (sign-in security, moderation and crash reports), and your consent (notifications, the health & safety log, and counting an illness for other crew). You can withdraw consent at any time in the app or in your iPhone's Settings.

This website

This website sets no cookies and runs no analytics or tracking scripts. If you pick light or dark mode, your browser remembers the choice, and it never reaches us. Cloudflare serves the site and processes your IP address to deliver the pages. Map images come through our server, so your browser doesn't contact Apple.

If you send a complaint through the form on this website, we keep the reason you chose, what you typed, the place you named and the email address you gave, so we can answer you. To stop abuse of the form, we also keep a scrambled form of your network address for a day. We never store the address itself. Postmark emails the complaint to us, and only we read it.

Age

On Chocks is for airline crew aged 18 and over. We don't knowingly collect data from anyone younger.

Changes to this policy

When we change this policy, we update this page and the date at the top. If a change affects what we collect or who sees it, we update this page before the change applies.

Questions and complaints

Email support@getonchocks.app. To complain about how we handled your data, see Complaints. If you're not happy with our answer, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au, or to the data protection authority where you live.