Your voyage. Your data.

Effective 23 October 2026 · Cruise Command 1.0

Cruise Command is a personal cruise-planning workspace. This policy explains, in plain English, what data we collect when you use the app, why we collect it, who ever sees it, and the controls you have over it. We wrote this the way we'd want our own to read.

The short version. We store the voyage information you enter, keep it scoped to your account, and never sell any of it. We use a small number of third‑party services to make the app work; the specifics are listed below. You can export or delete your data at any time.

1 · Who this policy applies to

This policy covers Cruise Command's web app at mycruisecommand.com, its native iOS and Android companion apps, and any related surfaces (marketing pages, this policy page, and the Terms of Service). "We" / "us" refers to 1001714184 ONTARIO INC., operating as Cruise Command ("Cruise Command").

2 · What data we collect

a. Account & identity

Email address — required to sign in.
Display name — the name you chose (optional).
Sign-in method — you sign in with Google, Microsoft or Apple. Cruise Command never sees the password for those accounts; the provider shares your name, email address (with Apple, this may be a private relay address) and an account identifier. Email and password sign-in is no longer offered. Accounts created before it was retired may still hold a one-way hashed form of the old password, which can no longer be used to sign in.
Session tokens — a signed session token, stored in an HTTP-only, secure cookie on the web and held by the app on your device in our mobile apps, so you can stay signed in on your own devices.

b. Voyage & travel data you enter

Everything you type into a workspace — cruise details, travelers, travel agent, flights, hotels, ground transportation, dining, excursions, add-ons, insurance policies, packing lists, notes, documents, budget entries. Documents you upload (PDFs, tickets, screenshots) are stored in our hosted database, scoped to your account. Passport metadata (name, number, issuing country, expiry) is stored per traveler; passport images are never stored (governance directive PD-021).

c. Operational data

Server-side logs of API requests (timestamp, endpoint, response code, IP address, user id). Kept for a limited period by our hosting provider for security and debugging.
Application audit trail for sensitive events (sign-in, voyage delete, permission changes). Kept for security, accountability and legal purposes; see §7.

d. Product analytics (optional, off by default when Do-Not-Track is on)

Cruise Command uses PostHog to understand which workspaces travelers use most and to catch regressions early. Session replays are captured with input fields masked by default.

PostHog is disabled automatically when:

Your browser sends the standard Do-Not-Track signal.
You append ?opt_out=analytics to the app URL once — it's remembered for future visits on that device.
You set cc-analytics-opt-out=1 from the Settings → Privacy panel (or via localStorage).

3 · Third-party services

The app talks to a small, deliberate set of external services. Each is used only for the purpose listed, only on the endpoints listed, and never for advertising.

Emergent LLM Gateway — routes requests to OpenAI GPT-5.2 and Google Gemini (Nano Banana). It is used for the voyage details you ask us to summarise or illustrate, and to read the documents you upload so their booking details can be filled in for you. Only that content is sent.
Google, Microsoft and Apple — sign-in only (see §2 a).
Stripe — processes membership payments. Your card details go directly to Stripe; Cruise Command never sees or stores them.
Email delivery provider — delivers messages you send through the support form to our support team.
Open-Meteo — free weather forecast API. Only port coordinates + dates are sent; never your identity.
REST Countries — country reference data. Only ISO country codes are sent.
Google Fonts — serves the Archivo and Poppins typefaces. Loaded from Google's CDN.
PostHog — product analytics + session replay (opt-out described above).
Emergent — hosts the app and its database, including the documents you upload. Access is scoped to your account.

4 · What we don't do

We don't sell, rent, or trade your data.
We don't run advertising, and we don't share data with ad networks or data brokers.
We don't build a shadow profile of you across other apps.
We don't scrape your inbox or calendar.
We don't upload passport images (PD-021).

5 · How your data is protected

All traffic is TLS-encrypted (HTTPS).
Sign-in is handled by Google, Microsoft or Apple; we do not ask for your password. Any legacy password data is stored only in industry-standard one-way hashed form.
On the web, access tokens are time-limited, HTTP-only, Secure-flagged cookies.
Every voyage row and reservation row carries an owner_id; the API refuses reads or writes that don't match the authenticated caller (LAW-001).
Third-party API keys live only on the server — the browser never sees them.

6 · Your rights & controls

You can, at any time:

Get a copy of your data by emailing us at the address in §11.
Edit or delete any workspace record (see §7 for when deleted items are permanently erased).
Delete your account — tap Settings → Delete my account in the app and confirm. You are signed out everywhere and your account is scheduled for deletion. For 30 days nothing is removed: sign back in and choose Cancel deletion, or contact us, to restore everything. After the 30-day grace period we delete your account and the travel records, settings, sign-in links and files you uploaded or created that are tied to it. Files another traveller uploaded to your voyage are moved to that traveller's own Documents, and a file that another account still uses stays with that account. Documents you uploaded to the document area of another traveller's voyage before 23 October 2026 are kept for that voyage's owner only, without your account attached, and you can ask us to remove them; documents uploaded there from that date are deleted with your account. We keep a minimal record that the account existed and was deleted, which holds no readable name or email address, along with membership and payment records and the security and audit records described in §7. You can also email us at support@mycruisecommand.com if you prefer.
Opt out of analytics — see §2 d.

If you're in the EU / UK (GDPR) or California (CCPA/CPRA) you also have the right to request a machine-readable copy of your data, correct inaccurate records, restrict processing, or lodge a complaint with your local supervisory authority. Same email address for all requests.

7 · Data retention

Voyage & workspace data, including files you upload: retained until you delete it or your account. When you delete an individual document or entry it is removed from your workspace straight away; documents in a voyage's document area are permanently erased 30 days later (documents deleted there before 23 October 2026 are not erased automatically and remain under review), and other deleted files and entries are permanently erased when your account is deleted.
Backups: managed by our hosting provider. Deleted data may remain in backups for a period we are confirming with that provider.
Server request logs: kept for a limited period by our hosting provider.
Audit trail: kept for security, accountability and legal purposes, and not currently deleted on a fixed schedule.
Document-processing records: when a document is read to fill in booking details, a record of that processing — including the details extracted from it, which can include personal information such as names and booking references — is kept unaltered, even after the document or your account is deleted. We are reviewing these periods and will update this notice when they are set.
Membership and payment records: kept to meet tax, accounting and legal obligations.
Deleted-account record: kept as described in §6; it holds no readable name or email address.
Product analytics (PostHog): kept under our analytics provider's retention settings, which we are confirming.

8 · Children

Cruise Command is intended for travelers age 16 and up. We don't knowingly collect data from children under 16. If you learn a child has created an account, please email us and we'll delete it.

9 · International transfers

Our hosting and service providers listed in §3 may store or process your data outside your country, including in the United States. We are confirming the exact locations with our hosting provider and will update this notice.

10 · Changes to this policy

We'll post any material change here with a new effective date and, when appropriate, notify you in-app before the change takes effect.

11 · Contact

Privacy questions, data requests and general support: support@mycruisecommand.com.