Your trip is for your crew.

What Crew Roll handles

Trip details. A trip name, the name you choose when joining, membership records, and photo status are kept on participating phones so the shared roll can stay consistent.

Photos and previews. With photo access, Crew Roll finds eligible photos added while a trip is active. Encrypted previews and originals can then move to other members of that trip.

Camera metadata. Original-quality files can retain details saved by your Camera app, including capture time, device details, and a capture location if the Camera saved one. Crew Roll does not request separate location permission.

Invite secrets. A trip link contains the private information needed to request entry. Treat it like a key: anyone you send it to may ask to join until it expires.

Connection data. Internet services necessarily process an IP address and basic connection timing while phones connect. Crew Roll uses this only to establish and protect the live connection.

Diagnostics you choose to share. Connection diagnostics stay on your device unless you copy and send them to support. The app redacts identifiers and links before export.

Safety reports you choose to send. An in-app member or photo report includes a report ID and time, the reason you select, optional details you type, pseudonymous IDs for the reporting and reported devices, and a one-way content correlation tag. Crew Roll does not automatically attach the photo, display names, an invite, or raw trip, member, or media IDs.

Where the data goes

App records, received files, and encryption keys are stored locally on your device. Sensitive keys use the phone's protected key storage.

Cloudflare hosts the website, live routing service, and safety-report endpoint. During a trip, the routing service passes encrypted traffic between connected phones. Crew Roll has disabled application request logging and observability for that relay and does not write photo payloads to a database, object store, or offline queue. Cloudflare still necessarily processes limited IP, security, and connection data at its network edge under its own policies.

When you deliberately submit a safety report, Cloudflare forwards its limited developer-readable contents to the monitored Crew Roll mailbox. Safety-report emails and a private moderation decision record may be kept for up to 12 months after the last action, or longer when needed for an active safety investigation or legal obligation.

App stores and network operators may process limited purchase, download, security, and connection records under their own policies. They do not receive a readable copy of trip photos from Crew Roll. Crew Roll does not sell personal data and does not include advertising or cross-app tracking.

Permissions

Photos. Used to find eligible images added to your library after you join an active trip. That can include images you save or download; Android may also include screenshots because its library metadata does not always identify them reliably. On supported iPhones you can choose limited photo access. Broader access makes automatic catch-up more complete. Received files use Crew Roll's app-private storage.

Network. Required to join a trip and exchange encrypted updates while members are online.

Clipboard. Used only when you tap to copy a trip link or a diagnostic report.

Crew Roll does not request your location, contacts, microphone, or in-app camera permission. You continue using your phone's normal Camera app.

Retention and your choices

The routing service does not retain a trip photo library. Local trip data stays on each phone so saved rolls can remain available. Ending a trip stops new capture and sharing. Removing the app clears its app-private data according to your phone's operating system; photos that already existed outside Crew Roll are not deleted.

You can revoke photo permission in system settings at any time. Crew Roll will keep the records and files it already has, but it cannot discover new camera photos without access.

Because Crew Roll has no central account or central photo database, there is no server-side profile to export or delete. Each person controls the copy stored on their own phone.

You can hide another trip member on your phone. That prevents their Crew Roll content from being displayed or transferred to this device, but cannot erase copies already saved on any phone. You can separately report a member or photo from inside the app.

Security

Trip traffic is encrypted and authenticated before it leaves a phone. Received originals are checked before being marked ready. Access is capability-based: protect the invite link, keep your phone locked, and send a fresh invite if a link reached the wrong person.

No security system can promise zero risk. If you believe an invite or build has been compromised, stop using that link and visit Crew Roll Support. For objectionable member or photo content, use the separate in-app Report action so the safety report reaches moderation without attaching the photo.

Children and changes

Crew Roll is not for children under 13. If local law requires parental consent for an older minor to use the app, they may use it only with that consent.

This policy may change as the product and its release channels change. The updated date above will move when a material change is published.

Questions

Crew Roll is operated by Ankit Upadhyay. Contact support@crewroll.app or use the support page. Never send a trip invite link or anyone's photos in an ordinary support message.