Your voyage. Your data.

Effective 22 July 2026 · Cruise Command 1.0 RC2

Cruise Command is a personal cruise-planning workspace. This policy explains, in plain English, what data we collect when you use the app, why we collect it, who ever sees it, and the controls you have over it. We wrote this the way we'd want our own to read.

The short version. We store the voyage information you enter, keep it scoped to your account, and never sell any of it. We use a small number of third‑party services to make the app work; the specifics are listed below. You can export or delete your data at any time.

1 · Who this policy applies to

This policy covers Cruise Command's web app at cruisecommand.app, its native iOS and Android companion apps, and any related surfaces (marketing pages, this policy page, and the Terms of Service). "We" / "us" refers to the Cruise Command team.

2 · What data we collect

a. Account & identity

Email address — required to sign in.
Display name — the name you chose (optional).
Sign-in method — either an email + password we hash with bcrypt, or Google OAuth (Cruise Command never sees your Google password).
Session tokens — a signed JWT stored in an HTTP-only, secure cookie so you can stay signed in on your own devices.

b. Voyage & travel data you enter

Everything you type into a workspace — cruise details, travelers, travel agent, flights, hotels, ground transportation, dining, excursions, add-ons, insurance policies, packing lists, notes, documents, budget entries. Documents you upload (PDFs, tickets, screenshots) are stored on our object-storage tier scoped to your account. Passport metadata (name, number, issuing country, expiry) is stored per traveler; passport images are never stored (governance directive PD-021).

c. Operational data

Server-side logs of API requests (timestamp, endpoint, response code, IP address, user id). Retained 30 days for security and debugging.
Application audit trail for sensitive events (sign-in, voyage delete, permission changes). Retained 12 months.

d. Product analytics (optional, off by default when Do-Not-Track is on)

Cruise Command uses PostHog to understand which workspaces travelers use most and to catch regressions early. Session replays are captured with input fields masked by default.

PostHog is disabled automatically when:

Your browser sends the standard Do-Not-Track signal.
You append ?opt_out=analytics to the app URL once — it's remembered for future visits on that device.
You set cc-analytics-opt-out=1 from the Settings → Privacy panel (or via localStorage).

3 · Third-party services

The app talks to a small, deliberate set of external services. Each is used only for the purpose listed, only on the endpoints listed, and never for advertising.

Emergent LLM Gateway — routes voyage-composition prompts to OpenAI GPT-5.2 and Google Gemini (Nano Banana). Prompts are the voyage details you explicitly ask us to summarise or illustrate. No PII beyond what you paste is sent.
Open-Meteo — free weather forecast API. Only port coordinates + dates are sent; never your identity.
REST Countries — country reference data. Only ISO country codes are sent.
Google Fonts — serves the Archivo and Poppins typefaces. Loaded from Google's CDN.
PostHog — product analytics + session replay (opt-out described above).
Object storage — Cloudflare R2 stores the documents you upload. Access is scoped to your account via signed URLs.

4 · What we don't do

We don't sell, rent, or trade your data.
We don't run advertising, and we don't share data with ad networks or data brokers.
We don't build a shadow profile of you across other apps.
We don't scrape your inbox or calendar.
We don't upload passport images (PD-021).

5 · How your data is protected

All traffic is TLS-encrypted (HTTPS).
Passwords are hashed with bcrypt (industry-standard, one-way).
Access tokens are short-lived, HTTP-only, and Secure-flagged cookies.
Every voyage row and reservation row carries an owner_id; the API refuses reads or writes that don't match the authenticated caller (LAW-001).
Third-party API keys live only on the server — the browser never sees them.

6 · Your rights & controls

You can, at any time:

Export your entire voyage (Binder → Publish) as a PDF.
Edit or delete any workspace record.
Delete your account — tap Settings → Delete my account in the app and confirm. Your account will be scheduled for deletion; sign back in within 30 days to cancel. After the 30-day grace period we remove every row keyed to your account. You can also email us at privacy@cruisecommand.app if you prefer.
Opt out of analytics — see §2 d.

If you're in the EU / UK (GDPR) or California (CCPA/CPRA) you also have the right to request a machine-readable copy of your data, correct inaccurate records, restrict processing, or lodge a complaint with your local supervisory authority. Same email address for all requests.

7 · Data retention

Voyage & workspace data: retained until you delete it or your account.
Backups: encrypted, retained 30 days rolling.
Server request logs: 30 days.
Audit trail: 12 months.
PostHog: 12 months rolling.

8 · Children

Cruise Command is intended for travelers age 16 and up. We don't knowingly collect data from children under 16. If you learn a child has created an account, please email us and we'll delete it.

9 · International transfers

The service is currently operated from the United States. If you access it from outside the US, your data is transferred to and processed in the US under the appropriate contractual safeguards.

10 · Changes to this policy

We'll post any material change here with a new effective date and, when appropriate, notify you in-app before the change takes effect.

11 · Contact

Privacy questions or data requests: privacy@cruisecommand.app. General support: support@cruisecommand.app.