Your trip is for your crew.

What Crew Roll handles

Trip details. A trip name, the name you choose when joining, membership records, and photo status are kept on participating phones so the shared roll can stay consistent.

Photos and previews. With photo access, Crew Roll finds eligible photos added while a trip is active. Encrypted previews and originals can then move to other members of that trip.

Camera metadata. Original-quality files can retain details saved by your Camera app, including capture time, device details, and a capture location if the Camera saved one. Crew Roll does not request separate location permission.

Invite secrets. A trip link contains the private information needed to request entry. Treat it like a key: anyone you send it to may ask to join until it expires.

Connection data. Internet services necessarily process an IP address and basic connection timing while phones connect. Crew Roll uses this only to establish and protect the live connection.

Diagnostics you choose to share. Connection diagnostics stay on your device unless you copy and send them to support. The app redacts identifiers and links before export.

Where the data goes

App records, received files, and encryption keys are stored locally on your device. Sensitive keys use the phone's protected key storage.

During a trip, a routing service passes encrypted traffic between connected phones. It is designed not to read photo contents or keep a copy of the roll. Crew Roll does not sell personal data and does not include advertising or cross-app tracking.

App stores, hosting providers, and network operators may process limited purchase, download, security, and connection records under their own policies. They do not receive a readable copy of trip photos from Crew Roll.

Permissions

Photos. Used to find eligible images added to your library after you join an active trip. That can include images you save or download; Android may also include screenshots because its library metadata does not always identify them reliably. On supported iPhones you can choose limited photo access. Broader access makes automatic catch-up more complete. Received files use Crew Roll's app-private storage.

Network. Required to join a trip and exchange encrypted updates while members are online.

Clipboard. Used only when you tap to copy a trip link or a diagnostic report.

Crew Roll does not request your location, contacts, microphone, or in-app camera permission. You continue using your phone's normal Camera app.

Retention and your choices

The routing service does not retain a trip photo library. Local trip data stays on each phone so saved rolls can remain available. Ending a trip stops new capture and sharing. Removing the app clears its app-private data according to your phone's operating system; photos that already existed outside Crew Roll are not deleted.

You can revoke photo permission in system settings at any time. Crew Roll will keep the records and files it already has, but it cannot discover new camera photos without access.

Because Crew Roll has no central account or central photo database, there is no server-side profile to export or delete. Each person controls the copy stored on their own phone.

Security

Trip traffic is encrypted and authenticated before it leaves a phone. Received originals are checked before being marked ready. Access is capability-based: protect the invite link, keep your phone locked, and send a fresh invite if a link reached the wrong person.

No security system can promise zero risk. If you believe an invite or build has been compromised, stop using that link and visit Crew Roll Support.

Children and changes

Crew Roll is not directed to children under 13. If local law requires parental consent for a younger person to use the app, the trip organizer is responsible for obtaining it.

This policy may change as the product and its release channels change. The updated date above will move when a material change is published.

Questions

Use the support page for contact details and the information that helps diagnose a problem. Never send a trip invite link in a support message.