Data Policy

A plain-language account of how crew data is stored, scoped and protected on Veoma — the engineering companion to our Privacy Policy.

Last updated: 3 September 2026.

Roster confidentiality, technically

• Roster imports are parsed in your browser; only the normalised duties are stored — the raw crew-app file never leaves your device.
• Stored duties are protected by row-level security: the database itself refuses to return your roster to any account but yours.
• Posting a duty for swap exposes exactly that duty to pilots at your airline with the same rank and fleet — anonymously, and only at the disclosure level you choose (category, route, or exact times).

Identity & anonymity

Identities on the swap board are sealed server-side. A post stays anonymous for as long as it is on the board, including while pilots are showing interest in it. Names are attached only when the poster opens a private chat with one interested pilot, and then only for those two — the poster can talk to several pilots, and each reveal covers just that pair. Interest that is withdrawn, not chosen, or expired never reveals anyone.

Because the board is anonymous, reporting a post never asks you who posted it — the server resolves that itself, and the report is readable only by the Veoma team, never by the pilot who filed it.

Verification documents

Licence/ID uploads are stored in a private bucket, readable only for review, and are never shown to other crew. The public signal is a single verified badge. The document is deleted once the decision has been made — the decision itself is what we keep, so there is no reason to hold the photo ID after it.

Infrastructure

Veoma runs on Supabase (Postgres, auth, storage) in the ap-northeast-1 region, encrypted in transit (TLS) and at rest. Time-sensitive logic runs on UTC throughout.

Private by construction, not by screen

Anything we hold that is not meant for other crew is kept out of their reach in the database, not merely hidden in the interface. Your gender sits in a separate table only you can read, and which the database will let you write exactly once — the women-only matching in Hangouts is decided in there, and it answers only “may this person join?” and never hands your answer to anyone; the date you last opened the app is in a table no account can read at all, reachable solely by the team's own review tools. A field the screen does not draw is still a field, so we do not rely on the screen for privacy.

The same holds for where you are. Hangouts resolves your position to an airport on your own device and sends us only the airport code, so there is no coordinate in our database to protect in the first place.

And the same principle governs our error reporting. When the app breaks we are sent the failure, not the person: the settings that would attach your IP address, session or account are switched off, and session recording — which on this app would capture rosters and private chats — is not enabled at all. The safest data to hold is the data you never collect.

Retention & deletion

Stale swap posts and offers are cleaned up automatically once their duty has flown. Deleting your account removes your profile, roster, posts, offers and messages; all that remains is a count with no name, email or identifier in it. Full instructions are on our account deletion page, and deletion or data requests reach us at veoma.app@gmail.com.