How your data is handled

CrewLeave is a small, invite-only tool run by Benji for colleagues. Contact: [email protected]. Last updated: 09-11-2026 (version 1.3).

What is saved

Your email address and password (the password is stored scrambled, so nobody can read it).
The status you enter in the calendar (sea, home, travel, course) and your settings and rates.
The leave figures read from your payslips: balances, day counts, corrections, paid-out days and any notes about the reading.
The date and time of each payslip reading, which reading allowance it used and what it cost, so the limits can be applied.
Whether your account is Founding crew, which app version you last saw, and whether you've chosen your own password.
A copy of your calendar and settings on your own phone, so the app works without internet. It's synced with your account when you're online.

What is not saved

Payslip photos are never stored. A photo is sent once to be read and is then thrown away.
Before a photo is sent, you can black out your name, CPR number, salary and bank details. Please do.
The reading only returns leave information. CPR numbers, salaries and bank details are not saved, even if they were visible.
Feedback and problem reports you send from the app are emailed to the contact address and not stored in the app. Only the time you sent one is logged, for the limit of 5 a day.

Who can see your data

Only you, through your account. The database only lets each person read and change their own data.
The person running the app (the admin) can see your email address, how many payslip readings you've used, whether you're Founding crew, and totals across all users, such as the number of readings, their cost and the number of days corrected. The admin page does not show anyone's calendar or payslip figures.
The admin also has technical access to the database for maintenance but will not look at your data unless you ask for help.
Once a week, an encrypted backup of the app's data is emailed to the admin, so it can be restored if something goes wrong. It's locked with a password only the admin knows.

Services used

Supabase stores accounts and data, in an EU data centre (Frankfurt).
Anthropic (Claude) reads the payslip photo. Anthropic is based in the USA, so the photo is processed there. Anthropic does not use this data to train its models by default.
Cloudflare serves the website (crewleave.app) and forwards email sent to [email protected]. It does not receive your app data.
Resend sends the app's emails: invitations, password reset links and the feedback you send from the app. Resend is based in the USA.

Your choices

Download all your data any time: ☰ → Settings → Account → Download all my data.
Delete your account and all your data any time: ☰ → Settings → Account → Delete my account and all my data. It's removed immediately. The admin gets a short note with your email and the reason, if you give one. The record of your payslip readings (date, type and cost) is kept without any link to you. Encrypted weekly backups made before you deleted your account can still contain your data; they're only opened if data has to be restored.
The admin can also delete an account, for example when someone leaves the company. You then get an email saying so.
For anything else, or to ask what's stored about you, contact [email protected], or use Settings → Feedback & report a problem.

The legal basis for storing your data is your consent when you accept the invitation and use the app. You can withdraw it any time by deleting your account.