Legal
Privacy Policy
Last updated: June 2026
Overview
StewardForge.ai ("we", "us") respects your privacy. This policy explains what data we collect, how we use it, and the choices you have. We do not sell your personal data.
What we collect
- Account data: name, email, password hash, optional profile fields (airline, base, seniority, photo, nickname).
- Verification data: the airline ID or badge image you optionally upload for crew verification.
- Content you create: messages, forum posts, lounge posts, comments, pay submissions, AI prompts.
- Billing data: handled entirely by Stripe — we receive only a customer ID, last four digits, brand, and subscription status. We never see or store full card numbers.
- Usage data: device type, browser, IP-derived country (for rate limiting), pages visited, and feature interactions.
How we use it
To operate and improve the Service, personalize tools, prevent abuse, process payments (via Stripe), provide support, and send service-related emails. We do not use your data to train third-party foundation models.
Security: end-to-end encrypted, secure data handling
All traffic is encrypted in transit using TLS 1.2+. Data at rest is encrypted on our infrastructure providers (Supabase / Postgres). Crew ID uploads live in a private storage bucket accessible only to you and our review team. Passwords are stored as salted hashes. Stripe handles all card data under PCI-DSS Level 1.
Crew verification documents
ID uploads are reviewed by a small human team and are not shared with airlines or third parties. After review, you may request immediate deletion of the document by emailing privacy@stewardforge.ai; otherwise documents are deleted within 90 days.
Anonymous & aggregated data
Contract Intelligence submissions and pay-transparency data are anonymized and aggregated before display. We do not associate these submissions with your identity in any public view.
Sharing
We share data only with: (a) infrastructure subprocessors (Supabase, Stripe, email providers) under contract; (b) when legally required (subpoena, court order); (c) to protect users from imminent harm. We never sell personal data.
Cookies
We use first-party cookies and local storage for authentication, preferences, and essential analytics. You can clear cookies at any time via your browser.
Your rights
You may access, correct, export, or delete your data at any time by emailing privacy@stewardforge.ai. We honor GDPR, CCPA, and similar requests.
Data retention
We retain account data while your account is active and for up to 30 days after deletion (for backup rotation). Aggregated, anonymized analytics may be retained longer.
Children
The Service is not directed to children under 18. We do not knowingly collect data from minors.
International users
Our infrastructure is hosted in the United States. By using the Service, you consent to your data being processed in the U.S.
Changes
We will post any updates here and notify users of material changes by email or in-app notice.