Privacy Policy

Who we are

Feiban is an iPhone app that turns cabin crew rosters into calendars their families can understand, operated by Tenfold Wuji Co., Ltd. The web version has been discontinued; the website keeps the product introduction, the app download page, family app guidance pages and the account deletion page. This policy explains what data we collect, how we use it and what your rights are.

Data we collect

• Email: used to sign in to your account (email and password, or a sign-in link sent to your inbox). If you use Sign in with Apple, we receive a user identifier and an email address from Apple (which may be an Apple relay address); we do not receive your name.
• Profile photo: you may choose a photo for your avatar. The app and backend re-encode it, remove metadata and limit its dimensions before sending it over an encrypted connection to your private account record in Supabase for cross-device sync. A private cache is kept on your device. The photo is not sent to AI processors or shared with other users. You can remove it at any time; deleting your account also deletes the cloud photo, while clearing device data removes only the local cache.
• Roster data: the rosters, daily notes and custom codes you create are stored on your device. Once you sign in, they are encrypted in transit and backed up to our cloud database (Supabase) so you can sync them across devices. Cloud account data is access-controlled. Family members sign in to their own app account and enter a family follow code to join; private notes are excluded. Old anonymous family links no longer provide rosters.
• Roster changes and acknowledgements: when you use family collaboration, we keep the necessary before-and-after roster fields, version and creation time in Supabase, together with whether each invited viewer has viewed a change and explicitly acknowledged it. The interface does not list individual viewing timestamps or view counts. To prevent duplicate submissions, the system separately keeps operation records including the actor, command contents and creation time. Family members see differences only within their current sharing scopes; crew can see acknowledgement totals and the names of those who acknowledged. Private notes and original screenshots are excluded from this change record.
• Family events and airport pickup: after these features are separately authorized, we keep event titles, participants, start and end times, time zones, places, notes, replies and proposed times in Supabase. For pickup we keep the exact flight leg, meeting information, eligible participants, assignee, manual check-in states and times, and record creation and update times. The departure reminder time is returned only to the assignee. Participants manually confirm departure, arrival at the meeting point, meeting and arrival home; these do not use GPS or treat a flight landing as arrival home. The server applies current viewing relationships and capability permissions.
• Roster screenshots: when you use AI reading, the app first removes the image metadata, then sends the screenshot through our backend to an AI processor to read it. The processor for free system AI reading is OpenAI or Google Gemini; if the main one is temporarily unavailable, the same screenshot may be processed by the other one instead. Which one actually receives it each time is whichever is listed on screen before sending, that is, on the consent screen in the app. Our servers do not store your screenshots; AI processors may keep them temporarily under their API policies to prevent abuse, so this does not mean that third parties never keep them. AI reading is not available when your App Store storefront is Hong Kong or Macao, or when you connect from Hong Kong, Macao or mainland China; your connection region is checked only at that moment and is not stored.
• Who’s coming home: the name and pronoun you set for the person whose roster it is (entered by you; we suggest a nickname), which appear in the family links you share and in notification text; and your notification preferences.
• Language, time zone and base: the language the app is shown in and this device’s time zone are kept with your account and push devices, so that we can send account emails and notifications in your language and schedule quiet hours by your local time. The base airport you choose is kept in your account and cloud backup, and is used to show base and layover times (the times family members see are converted from it too), to decide which days’ flight times can be updated, and to schedule notifications. You choose your base yourself; the app does not use your phone’s location.
• Friend referral rewards: when the campaign is open and you take part, we keep referral attribution, reward statuses (earned, code issued, or redemption confirmed by an Apple transaction), Apple offer identifiers and encrypted assigned codes to record and deliver rewards. We also derive keyed one-way hashes (HMACs) from your verified email address and stable sign-in provider identifiers to match identities, enforce the lifetime total of five referral months per person and prevent repeat claims. The referral ledger does not separately store the original email address or provider identifiers. HMACs cannot be converted directly back to their original values, but can match the same identity when it is verified again. Earning a reward or receiving a code does not activate membership; membership depends on verified Apple transactions, and Apple continues to handle payment.
• Usage counts: counts of free AI readings and flight refreshes (to prevent abuse). If you change your sign-in email, we keep a one-way hash of the old email address (it cannot be turned back into the address), also to prevent free uses being claimed more than once; see below for what we keep after deletion.

What we don’t do

• We do not show ads, use third-party trackers or track your activity across other websites.
• We do not sell personal data. We provide only the data that is needed, to service providers or to people who have your share link, and only for sign-in, sync, AI reading, notifications and the sharing features you choose to use.

Notifications

Flight and day-off reminders are scheduled locally on your phone. Landing and sync notifications, which you turn on separately, use Apple Push Notification service (APNs); our servers keep your device’s push token, App Attest security identifiers, hashes of followed links and notification preferences to verify your device and deliver notifications, not for ad tracking. During quiet hours, layover notifications are held until later, while notifications that someone is back home are sent right away, according to your settings. You can turn off notifications in the app or in your phone’s settings.

Following and sharing

Family members sign in to their own account in the app, enter the family follow code from the person sharing their roster and confirm joining. The server applies the viewing relationship and sharing scopes; private notes are excluded. The old family web view and browser landing notifications have closed. Old links never automatically grant account access.

Before you share a roster or start following one in the iPhone app, it asks you to confirm that you have the roster owner’s permission. If the roster is yours and you find that someone is sharing it without your permission, please email us; once we have verified it, we will stop that sharing.

Service providers and international transfers

We use Supabase for accounts and cloud data, Resend for account verification and support feedback emails, Vercel for our backend, Apple for sign-in and push notifications, and the AI processors listed on screen before a screenshot is sent (OpenAI or Google Gemini). Weather comes from WeatherAPI.com: our backend looks it up using only the public coordinates of the destination airport and never sends your name, account, roster or phone GPS. When flight services are enabled, server configuration selects AeroDataBox (directly or through RapidAPI or API.market) or Aviationstack; our backend sends only the flight number and date, never your name, account or the rest of your roster. Available data and update times are shown in the app; listing a provider here does not mean live lookup is enabled. Images for Android home screen widgets are generated by our backend, which gets the font for the characters shown in the image from Google Fonts, sending only those characters and nothing about your account. These services may process data outside Taiwan and work under their own policies, with only the access they need.

The third-party data, services and open-source software Feiban uses, and the terms they are provided under, are listed on the Licensing & Data Sources page.

Getting a copy of your data

In the app, sign in, go to “Me → Data Export and Clearing” and tap “Export My Account Data” to download your account data (a JSON file, including your synced profile photo); the same screen also offers a local backup. Family collaboration change, event and pickup records are not yet included in this automatic export. Email us for a copy of those records; we will verify your identity first. To protect your credentials, the export does not include passwords, sign-in tokens, push tokens or link access keys. If you don’t have an iPhone, you can also email us for a copy.

Feedback and support

When you send feedback, we store its category, message, app language, platform and time. Feedback sent while signed in is linked to your account. You may choose images or videos to attach after signing in. Only the files you select and submit are uploaded; your roster and other library items are never attached automatically. Attachments are stored privately and administrators access them using short-lived links. Avoid including personal information unrelated to the issue.

• Contact email (optional): used only to reply to that feedback. If you leave it blank but are signed in, we may reply to your account email.
• Diagnostic info (optional): sent only if you choose to include it: app version and build, OS version, device model, device language and time zone, base airport, airline, membership status, role (cabin crew or family), the screen you were on and the most recent error code, to help us reproduce the problem. It never includes your roster, names or location.

Only Feiban’s administrators can see feedback. We use it to reply, fix issues and improve Feiban, never for advertising or public display. To prevent abuse, we count submissions using an irreversible network hash cleared within two days; we do not store IP addresses. The feedback message, optional reply email, attachment list and admin link are sent through Resend to our company support inbox. Files are not emailed as public links. If an additional notification service is enabled, that alert contains only the category, language and first 140 characters, never your email, account or diagnostic information.

Feedback and attachments are kept for 24 months, then queued for cleanup; account deletion also queues linked files for removal. Unsubmitted uploads are queued for cleanup after 24 hours. Your account data download includes signed-in feedback and attachment metadata. Email us for copies of attachment files; we will verify your identity first. Signed-out text feedback is not linked to an account; provide its approximate time and content when requesting deletion. Email notification copies are retained as needed for support; please include them in any deletion request.

Deleting your account and data

You can delete your account yourself at any time: in the iPhone app, sign in and tap “Delete Account” in the “Me” tab; or sign in on the account deletion page (in Traditional Chinese) and delete it there. Deletion takes effect immediately: your cloud rosters, private notes, custom codes, family links and widgets, family notes and landing alert monitoring are all deleted. If you signed in with Apple and delete your account in the app, we try to revoke Sign in with Apple; if that does not work, the app explains how to remove it manually in your Apple Account settings.

Family collaboration records support ongoing coordination and currently have no automatic deletion schedule based on a fixed number of days. Removing a follow or revoking permission stops access under the old permissions; it does not delete another participant’s shared arrangements. Account deletion removes roster versions you own and event or pickup records you own or proposed. Arrangements created by others and operation records submitted by other participants may retain related contents, replies and states. Contact us to review personal data in those records.

After deletion we keep: for accounts that used the free AI reading, a one-way hash of the email address (including any previous addresses) and of the Apple identifier, with the number of uses, kept for 24 months to prevent free uses being claimed again (it cannot be turned back into the email address); one deletion record that contains no personal data, kept for 24 months; and code reports, which are no longer linked to you.

Once the referral campaign is open, before deleting an account we save HMACs of its verified identity and its eligibility decision, even if you have not taken part, to prevent an existing account from being deleted and registered again to claim a new-friend reward. Deletion removes the link between the referral ledger and the auth account. Identity HMACs, the lifetime five-month total, referral attribution, reward statuses, encrypted assigned codes and assignment history continue to be kept to prevent repeat claims and duplicate assignments and to reconcile redemptions; the 24-month deletion period for former free AI records above does not apply to them. HMACs cannot be converted directly back to email addresses or provider identifiers, but can match the same identity if it registers again.

To clear data from this device only, use “Me → Data Export and Clearing”. You can also email us to request access to, correction of, restriction of or deletion of your data; we will verify your identity first and then handle your request in accordance with applicable law.

Contact us

For privacy questions, please email support@feiban.ai