Crewby FIFT Studio

Privacy Policy

Harjasdeep Singh, trading as FIFT Studio, Dubai, United Arab Emirates, is responsible for the personal data described here. Contact support@fift.studio.

This website today

This static site counts page visits with Vercel Web Analytics, served from this site’s own address. It sets no cookies, and it keeps only aggregated counts (the page, the referring site, the country, the browser and the device type): it can’t identify you or follow you across other sites, and a visit’s short-lived identifier is discarded after 24 hours. The pages that handle a sign-in or a payment (/join and /checkout) aren’t counted. There are no trackers, other analytics, cookies or ads. The one exception is the checkout page (/checkout): when you open a Crew payment link, it loads Paddle’s checkout script from Paddle, and Paddle may use cookies or similar storage there to run the checkout, under Paddle’s own privacy policy. The checkout page asks our membership service whether the payment link belongs to a Crew member before it opens. Request an invite opens your email app. There is no waitlist form on this site yet. The join page (/join), opened from the Crew app, sends the email you type to our sign-in service (Supabase, below) only to email you a sign-in link; it stores nothing in your browser, and the link hands you back to the Crew app. If you email us, we receive your email address and the information you choose to send, and use it to reply and handle your request.

Your browser contacts the website host to retrieve pages. The host processes connection information needed to deliver them. The waitlist storage policy below concerns our application records, not the network processing needed to serve a website.

When the waitlist opens

We will collect your email, what you use (Claude Code, Codex, both or other), and optional name and company. We also store a plain source label from the invite link, the consent-text version, creation and confirmation times, and unsubscribe status. We use these to manage invitations and understand confirmed interest.

You will confirm your email with a double opt-in link. Each waitlist email will include a one-click unsubscribe/delete link; deleting removes your waitlist row. Only confirmed signups count.

For rate limiting only, we will store a SHA-256 IP hash with a secret salt and delete it after 30 days. We will not store raw IP addresses, user agents, location or referrers in waitlist records. The endpoint will not log email addresses. We do not sell the list.

Accounts and membership

We use your email to sign you in (Supabase's sign-in, in your browser). We store membership status, plan type, customer and subscription identifiers, price identifier, billing-period dates, and an update time so Crew can check access.

To check that a membership belongs to your Mac, Crew uses a key created on your Mac. Its private part never leaves the Mac. With each membership check we receive its public part, to verify the check, and we store only a one-way fingerprint of it. For each Mac we store that fingerprint, the Mac model (for example “Mac14,2”), the macOS version, when we first and last saw it and, if you or we sign that Mac out, when. We use this only to run your membership and to count how many Macs each account uses. Crew does not read or send hardware identifiers (such as serial numbers), and we never sell this data.

Payments are handled by Paddle; we never see card details. We keep payment-event identifiers, event type and times, and a payload hash to process membership updates once and resolve billing issues. Paddle separately processes billing data under its privacy policy.

Your work stays on your Mac

Your projects, conversations and agent data stay on your Mac; we do not collect them into Crew's website, waitlist or membership service. Your AI coding tools may send prompts and project content to the providers you choose, under their own terms and privacy policies. This is separate from Crew's membership records.

Membership lapse makes Crew read-only. Crew never deletes your local work. Deleting your online account does not erase files on your Mac.

Service providers

When Crew checks for an update, your Mac asks our update server whether a newer version exists and, if one does, downloads it. Like any website visit, that server sees your IP address and which version of Crew you have; we use this only to deliver updates.

Your AI providers (for example Anthropic or OpenAI) are not our service providers: you use them under your own accounts and their terms, and we don't receive what you send them.

These services process the information needed for their role. EU database storage does not mean every provider processes all data only in the EU. Before using a provider for a transfer requiring safeguards, we will put the safeguards required by applicable law in place.

Why and how long

We use waitlist consent to send invitations; account and membership data to provide the service you request; and limited security records to prevent abuse. We retain waitlist information while handling your request and invitations, until you unsubscribe or ask for deletion, or the waitlist closes. The rate-limit IP hash has the separate 30-day limit above.

After you join, we may send a few emails about getting started (for example, a check-in a few days in, asking how Crew is going). Each one has a one-click way to stop them; sign-in, account and payment emails still come. We keep account and membership records while you have an account and as needed to handle cancellation, refunds and disputes. You can ask us to delete them. Records required by tax, accounting or other legal obligations are retained only as long as those obligations require. We explain any such exception when responding to a deletion request. Paddle has its own retention obligations.

Your choices and rights

Email support@fift.studio to request access, correction, deletion or a copy of your data, to withdraw consent, or to object to or restrict processing. Withdrawing consent does not undo earlier lawful processing. We may need to verify that a request is yours.

Depending on where you live, the GDPR, UK GDPR or UAE PDPL may give you these rights and the right to complain to the relevant data-protection authority. We respect rights and response periods required by applicable law. We do not use your data for advertising or automated decisions with legal effects.

Updates

We will update this policy when collection changes and explain material changes before new uses begin.