Privacy Policy

1. Information We Collect

Data	Source	Purpose
Apple ID email & name	Apple Sign In	Account creation & identification
Crew category, aircraft type, base	You (profile setup)	Filtering patterns to your eligibility
ARMS pattern book PDF	You (upload)	Parsing trip patterns for bid optimization
Bid briefs	You (free-text input)	AI-powered bid sheet generation
Bid sheets	Generated by the service	Optimization results for your review
Subscription status	Apple App Store	Access control and billing
Buddy link data	You (invite/accept)	Connecting you with another pilot for joint bid optimization
Forwarded ARMS roster emails	You (forwarded to your unique @bidcheck.co address)	Parsing your awarded roster into a calendar feed and proactive contact-window reminders
Awarded pattern records (pattern code, week of departure, your seniority number)	Derived from your forwarded roster	Aggregated, anonymized insights into pattern competitiveness for all pilots (e.g. typical seniority cohort that wins a given pattern)
Trip Swap discoverability flag, Qantas work email, employee number	You (Settings & in-app prompts)	Matching you with other pilots for a one-for-one trip swap and CC'ing your swap partner on the ARMS hand-off email
Trip Swap proposals & Port Requests (wishes)	You (Trip Swap screens)	Persisting your active proposals/requests, validating legality against crewing rules, generating the email pilots forward to crewing

2. How We Use Your Information

• Bid optimization: Your bid brief and parsed pattern data are sent to Anthropic's Claude API to generate optimized bid sheets. No other purpose.
• Account management: Your Apple ID information is used solely for authentication and account identification.
• Subscription management: Subscription transactions are handled entirely by Apple via StoreKit 2. We store only your subscription status, not payment details.
• Buddy Bidding: When you link with another pilot, your name and crew category are shared with your buddy. During Buddy Sync, the backend reads both pilots' bid briefs server-side to generate buddy-aware bid sheets. Your buddy never sees your bid brief text, raw preferences, personal dates, email, or subscription status — only the resulting schedule overlap (matched patterns, shared slip days).
• Roster ingestion: Rosters you forward to your unique @bidcheck.co address are parsed into day-level structured data, stored against your account, and used to generate your private calendar feed and proactive contact-window reminders (A-day BLH/PLH, RM54 last-duty-free, 15-4 pre-duty call-in).
• Aggregated pattern competitiveness insights: The patterns awarded to you and your seniority number, derived from forwarded rosters, are retained and combined with the same data from other pilots to produce aggregated, anonymized insights about which seniority cohort typically wins each pattern. Individual awards are never disclosed to other users, attributed to you by name, or linked to your identity in any user-facing surface.
• Trip Swap: If you are discoverable for swap proposals (on by default — see below), the trips on your current roster become visible to same-base pilots in your aircraft + crew category cohort when they look for a match. They can see the pattern code, sign-on date, credit hours, and your display name + base. They cannot see your bid brief, leave dates, personal preferences, or roster outside the cohort filter. When you propose a swap to another pilot, both of you become visible to each other and the proposal is shared with both. When you post a Port Request, the destination you want and the trips you're offering are visible to out-of-base pilots in your same cohort — those pilots cannot see your wider roster, only what you chose to expose in the request. You can disable Trip Swap discoverability at any time in Settings → Privacy; doing so removes you from match lists and hides your trips from other pilots immediately, though buddies you have explicitly linked still see your trips for swap purposes regardless of the flag.

2a. Trip Swap Default — What Changed

From version 1.13 onwards, Trip Swap discoverability is on by default for all accounts. Previously this setting defaulted off and required an explicit opt-in. We changed the default to make the feature actually usable — a default-off swap directory with a small user base means nobody finds anyone, so the feature dies.

When the change went live, every existing account was flipped to discoverable. The next time you opened the upgraded app, the What's New screen showed you a toggle so you could opt back out in one tap. If you want to opt out at any time, go to Settings → Privacy → Discoverable for swap proposals.

What "discoverable" means and what data is shared is described in section 2 above. Trip Swap is a same-cohort, same-aircraft feature: pilots flying different aircraft or in different crew categories never see each other regardless of the flag.

3. Third-Party Services

• Anthropic (Claude API): Bid briefs and parsed pattern data are sent to Anthropic's servers in the United States for AI-powered optimization. Anthropic's use of this data is governed by their privacy policy. Anthropic does not use API inputs to train their models.
• Apple: Authentication via Apple Sign In and payments via StoreKit 2. Governed by Apple's privacy policy.

We do not sell, rent, or share your personal information with any third parties. When you use Buddy Bidding, your name and crew category are shared with pilots you explicitly link with. You can remove a buddy link at any time from Settings, which immediately stops all data sharing with that pilot. When Trip Swap discoverability is on (the default — see section 2a), your display name, base, crew category, and the trips on your current roster are visible to other pilots in your same-base cohort, and your destination wishes are visible to out-of-base pilots in your same aircraft + crew category cohort. Turning the toggle off in Settings → Privacy removes you from those surfaces immediately. Aggregated pattern competitiveness insights derived from forwarded rosters are shown to other BidCheck users only in anonymized, statistical form — never as individual awards, never attributed to you. We do not use analytics, tracking cookies, or third-party advertising services.

4. Data Retention

• Account data (email, name, profile): retained until you delete your account.
• Bid sheets: retained for 12 months, then automatically deleted.
• Uploaded PDFs: parsed server-side and not retained after parsing is complete. We do not store your pattern book files.
• Buddy links: retained until either pilot removes the link. Removed links are soft-deleted (status set to “removed”) and purged after 90 days.
• Forwarded rosters & derived day-level data: retained until you delete your account, after which they are removed.
• Aggregated award records: the per-award rows (pattern code, week of departure, seniority, trip start date) are retained indefinitely to build historical coverage. When you delete your account, the link back to your identity (pilot_user_id) is set to NULL but the anonymized award row remains in the aggregate dataset.
• Trip Swap proposals & Port Requests: active proposals/requests are retained until accepted, declined, withdrawn, expired, or invalidated by a roster change. Once resolved they are retained for 90 days for support/audit, then deleted. Wishes auto-expire at the end of their bid period or 14 days from creation, whichever is sooner. When you delete your account, all your proposals and requests are deleted immediately; proposals made to you by other pilots are anonymised but retained for the other pilot's history.

5. Data Security

We protect your data using:

• TLS encryption for all data in transit
• JWT-based authentication with HS256 signing
• Server-side API key management (your device never holds AI service credentials)
• PostgreSQL with connection encryption
• Rate limiting and request size controls

6. Your Rights

• Access: You can view your profile data and bid sheets within the app at any time.
• Deletion: You can delete your account at any time from the app's Settings screen. This permanently removes all your data, including profile information, bid sheets, and optimization history. Account deletion is immediate and irreversible.
• Portability: Bid sheets can be viewed and copied from within the app.

7. Children's Privacy

BidCheck is designed for professional airline pilots. We do not knowingly collect information from anyone under the age of 18. If you believe a child has provided us with personal information, please contact us and we will delete it.

8. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes through the app or by updating the "Last updated" date above. Continued use of BidCheck after changes constitutes acceptance of the updated policy.