Commute Magic — Privacy Policy

Last updated 2026-10-26.

Commute Magic (the "Service") estimates the probability that a commuting airline crewmember makes report time. This policy describes what the app and its server store, why, where it lives, and how to delete it. Using the Service is also subject to the Terms of Service.

What we collect

• Account: your email address and a password hash (argon2id — the password itself is never stored). If you sign in with Google instead, we store the Google account's stable identifier and its verified email address in place of a password. If you sign in with Apple (on iPhone), we store Apple's stable identifier for you and the email address Apple shares with us — which may be a private relay address Apple creates if you chose “Hide My Email”. Apple may also pass us your name the first time; we do not store it.
• Terms acceptance: the date you accepted the in-app disclaimer and Terms of Service, and which version of them you accepted, so there is a record of what you agreed to. It is asked again when the terms change.
• Subscription: if you buy Pro on Android, the Google Play purchase token, the product and plan identifiers, and the subscription's state and expiry, so we can verify it with Google. If you buy Pro on iPhone, the App Store transaction identifiers (the original transaction id and the latest one), the product identifier, whether it was a sandbox or real purchase, and the subscription's state and expiry; we verify Apple's signature on the transaction the App Store gives your phone, and Apple tells us about renewals, cancellations and refunds. Google Play or the App Store handles payment; we never see your card number or billing address.
• Commute settings: the airports you commute between, your airline, your report times and duty roster, and your alert preferences.
• Roster corrections: flights you add, retime or remove on a route's schedule.
• Shared commute: when you confirm the flight — or the one-stop routing — you plan to take for a duty day, the app records it (one row per leg), together with the role and airline from your settings, so other crew on the same flight can be counted. A flight you only looked at while planning is never recorded. This is the one thing you store here that other people see, and only ever as a count — see "What other crew can see" below.
• Outcome answers: whether you made report and whether you boarded your first choice, when you choose to answer.
• App version: which version of the app each of your signed-in devices is running, so we can tell whether an update reached people. No device model, no operating system version, no identifier.
• Push token: a device token used only to deliver your own briefings to your own phone.
• Prediction and alert history: an append-only log of the predictions computed and the briefings sent for your account, keyed by an internal numeric id.
• Crash reports and problem notes: the website's browser errors are stored on our own server: the error message, the screen and the app version, with no device identifiers. The app's own crashes go to Sentry only (see below), not to our server. If you use Settings > Report a problem, the note you write is stored with your account so it can be read and fixed.

What we do not collect

• No location tracking. The app never reads your device location.
• No calendar, contacts, or anything else on your device. Photos only when you yourself pick a screenshot to add to a problem report (below); the app never browses your photos.
• No advertising identifiers, no analytics SDKs, no trackers.
• No employer credentials. The Service never signs in to any airline or crew-scheduling system.
• No sale or rental of your data, ever, to anyone. No advertising, no data brokers, no third-party analytics. The only outside company that handles any of it is the push-notification relay described below, and the only thing other users ever see is the anonymous count described in "What other crew can see".

What other crew can see

Commute Magic shows you how many other crewmembers are planning the same flight. That is the only feature in the Service where your data reaches another user, and it reaches them as a number, never as an identity.

For one flight on one day, another crewmember planning that same route and date is shown:

• how many people have that flight recorded, and how many of those are pilots, how many are flight attendants and how many are dispatchers;
• a count per airline, by name — for example "United 2 · Delta 1";
• the same two counts crossed: how many of each role fly for each airline — for example "pilots: UA 2, DL 1; flight attendants: DL 1";
• whether they themselves are one of the people in that count.

Your name, email address, account identifier, device, location and duty roster are never included. No message or contact of any kind passes between users: there is no way for anyone to reply to you, find you, or learn who you are through this feature.

Be aware of what a small count implies. On a thin route, "1 pilot · DL 1" may be enough for a colleague who knows the operation to guess who it is. That is the nature of the feature — a crew lounge tells them more — but it is why we publish exactly what is shared and nothing beyond it. You can remove your row for a day at any time by stepping the plan card off that flight, and deleting your account removes every one of them.

Where it lives and how it is protected

All data is stored on a server the Operator controls, reached only over HTTPS. That server is hosted by Contabo (a server host, which runs our prediction server). Push notifications are delivered through Expo's push service, which sees your device token and the text of your briefing in transit and nothing else. When the server itself hits an unexpected error, Sentry (an error reporting service) receives the error, its stack trace and the address path of the request that failed — no request content, no headers, no IP address and no account id. The app sends its crash reports there, and only there (error, stack trace, app version, phone model and OS; no account, no device id). RevenueCat, a subscription bookkeeping service, receives a copy of a Pro purchase keyed by the same pseudonymous code the app stores receive, never your email or name. Flight schedule and weather inputs come from public government data (BTS, FAA, NOAA) and licensed schedule providers, and contain nothing about you. Passwords are hashed, sessions expire, and a password change signs out every other device.

The help chat

The app's help button (the ? at the top) and Settings › About › Contact support open a help chat. A copy of the conversation stays on your phone until you end the chat, sign out, or 30 days pass. Its answers are written by an AI model from Anthropic, and the chat asks for your OK before the first message. What you type there goes to our help service (run on Google Firebase by The Pocket App Company LLC, which publishes this app) and to Anthropic, which reads it to write the reply. To answer questions about your account the chat can look up, read-only: whether you are on Free or Pro and where you pay, the app versions on your devices, your airline and role if you set them, and your duties and confirmed flights for the next 30 days. It never sees your password or another person's data. Your email address goes to the help service only so a person can answer you if the chat hands your question over; it is not given to the AI model. Chat transcripts are kept for 30 days. If you would rather not use it, email support instead; nothing else in the app uses it.

Report a problem

Settings › Report a problem opens a box in the app. What you type there, the address we should reply to (required; pre-filled with your account email, and yours to change), your account email (from the signed-in help ticket), your app version, your platform, your phone's model and system version (for example "iPhone 17 Pro Max, iOS 27"; never the name you gave the phone), your account number with a link to the operator's page for it, and the name of the screen you were on go to the same help service (Google Firebase, run by The Pocket App Company LLC) and from there, as an email, through SendGrid, an email delivery service, to the support inbox, which is a Gmail mailbox. No AI reads or writes that email. A copy of the message text, your app version and the screen name is also kept on our own server so the operator can see what was reported. Screenshots: if you add up to three screenshots, they are uploaded to our own server only, never to the help service or the email; the email carries only a link, and only the operator, signed in, can open them. They are deleted after 90 days or when you delete your account, whichever comes first. If the send fails the app offers your mail app instead, and that email leaves your phone through whatever mail service you use. If the help chat passes a question to the support team on your request, it goes by the same route.

How long we keep it

Account data is kept while your account exists. Prediction and alert history is append-only and kept indefinitely for model evaluation, keyed by an internal number only. Crash reports on our own server have no automatic expiry; the operator deletes them by hand.

The server's databases are backed up every night. Backups are kept for 14 days on the server and for 30 days in the operator's own off-server copy, then deleted automatically, so something you delete can still exist in a backup for up to 30 days.

Deleting your account

Full instructions, including how to ask us if you cannot get into the app, are on the account deletion page.

Settings → Account → Delete account erases your account immediately: email, password hash, settings, duty roster, roster corrections, shared-commute rows, outcome answers, devices and sessions. Already-computed prediction history remains in the append-only log, but with your account gone it carries no email, name or token — only an internal number no longer connected to anyone, and that number is never reused.

Taking a copy with you

Settings → Account → Export my data gives you everything this service holds that is your own record, as one JSON file: your account row, your settings, your duty roster, the flights you said you were on, your outcome answers, your roster corrections and your subscription state. The web client downloads it as a file; the app hands it to your phone's share sheet.

Three things are deliberately not in it, and the file says so inside itself rather than leaving you to wonder. Credentials — your password hash, recovery-code hash, Google account id, Apple account id, sign-in tokens, device push tokens and Play purchase token — because an exported file gets downloaded, emailed and pasted where nobody controls it. Diagnostics — crash reports, delivery logs and the count of flight-data requests your planning caused — which are records about the service rather than about you. And the model's working, the per-flight predictions behind each briefing, computed from public schedule and weather data rather than entered by you. Ask at the contact address if you want any of those too.

Children

The Service is for adults who work as airline crew. It is not directed to children under 13, and we do not knowingly collect data from them. If you believe a child has given us data, write to the contact address below and we will delete it.

Changes

When this policy changes, the "last updated" date above changes with it, and material changes will be announced in the app.

Contact

Questions or data requests: support@thepocketappcompany.com.

The Pocket App Company LLC, 2501 Chatham Rd Ste N, Springfield, IL 62704-4188.