Crew.
Privacy Policy
Last updated: 14 September 2026 · Versione italiana
Crew. connects professionals and YouTube channels in Europe. This policy explains which data we collect, why, and what you can do about it.
Who processes your data
The data controller is the person who runs Crew. You will find the contact details on the Support page.
Which data we collect
| Data | Why | Legal basis |
|---|---|---|
| Email and name | Creating the account and identifying you to the other party | Performance of the contract |
| Profile: bio, roles, skills, country, languages, rate | Showing you to the relevant postings and computing the match | Performance of the contract |
| Portfolio: videos, images, files and links you upload | Presenting your work to the people hiring | Performance of the contract |
| Applications and messages | Letting the two parties of a collaboration communicate | Performance of the contract |
| VAT number, if you choose to verify it | Confirming that you are a registered business | Consent |
What we do not do. Crew. shows no advertising, does not profile users, does not track your activity on other apps or sites, and does not sell your data to anyone. We never post anything on your behalf on the accounts you connect.
Where the data is stored
Data is stored on servers in the European Union. We rely on Supabase as database and storage provider, in an EU region, acting as data processor.
Signing in with Apple and Google
If you sign in with Apple or Google, we receive from the provider your identifier, your email and, the first time, your name. We never receive your password.
Data from your YouTube channel
If you sign in with Google, Crew. asks for permission to read
the public data of the YouTube channel linked to your account. The requested
scope is youtube.readonly: it allows reading only, never editing,
uploading or deleting anything.
What we read. The channel name, description, identifier, picture, and three numbers: subscribers, published videos and total views. Nothing else. We do not read your videos, comments, messages, private statistics or audience data.
Why. Crew. connects channels and professionals. Someone applying to a posting needs to know who they are dealing with, and someone hiring needs to prove the channel is theirs. Those three numbers are public on YouTube, but taking them from the connected account is the only way to guarantee that the channel shown really belongs to the person showing it. Typing them by hand would let anyone pose as someone else's channel.
Where they end up. On your profile, together with the rest of your data, on our servers in the European Union. They are visible to whoever opens your profile inside the app. We do not sell them, do not pass them to third parties and do not use them for advertising or to train models.
The access permission. The token with which Google authorises us to read stays only on your phone, in the system keychain, and is used to refresh the channel numbers once a day. It never passes through our servers and is not stored anywhere else. Removing the connection from the settings, or deleting the account, deletes it.
How to remove it. From the app settings, with Disconnect the channel: the data is removed from the profile. You can also revoke the permission from your Google account, under Security → Third-party apps. Deleting your Crew. account removes it with everything else.
Our use of the data received from Google APIs complies with the Google API Services User Data Policy, including the Limited Use requirements.
With whom we share the data received from Google
With whom we share, transfer or disclose Google user data.
We do not pass it on, sell it or transfer it to any third party for that third party's own purposes. We do not use it for advertising, for profiling, or to train artificial-intelligence models, ours or anyone else's.
The only party that processes it besides us is our infrastructure provider, acting as data processor on our instructions, which cannot use it for its own purposes:
| Who | What it processes | Where | Role |
|---|---|---|---|
| Supabase | Hosts the database and file storage, hence also the channel name, description, identifier, picture and the three public numbers saved on the profile | European Union | Data processor |
Nothing else. In particular, YouTube channel data is not sent to Apple, to analytics services, to advertising networks or to any other provider.
Other registered users see the channel data only when you yourself show that channel on your public profile: that is the function the permission is requested for, namely proving that the channel is yours. If you disconnect the channel, they stop seeing it.
We could be required to disclose data to an authority only in execution of a lawful order. It has never happened, and if it did we would tell you, unless the law forbids it.
How we protect the data
Data protection mechanisms for sensitive data.
- In transit. Every communication between the app and our servers travels over TLS 1.2 or higher. There is no cleartext channel.
- At rest. Database and file storage are encrypted at rest (AES-256) by the infrastructure provider.
- Who can read what. The database enforces Row Level Security: access rules apply row by row and are enforced by the database itself, not by the app. A request that has no right to a row does not receive it, even when querying the API directly.
- The Google token. The token never passes through our servers: it stays in the keychain of your phone and is deleted when you disconnect the channel or delete the account.
- Internal access. Only the controller has access to the infrastructure. There is no support panel showing a user's data, because there is no support staff: the surface from which that data can be read is a single one.
- Deletion. From the app, in one tap, the data is deleted from our servers, not only from the phone.
VAT number verification
If you choose to verify your VAT number, the number is sent to VIES, the European Commission's system, which queries the tax registry of the issuing country. We keep the result, the business name returned and the date of the check. It is an optional feature.
Who sees what
- Your public profile — name, bio, roles, skills, portfolio — is visible to other registered users.
- Applications are visible only to you and to the owner of the posting.
- Messages are visible only to the two participants in the conversation.
- Reviews become visible only when both parties have written theirs.
These rules are not just written in the app: they are enforced directly by the database, row by row.
Reports and moderation
If you report a person, a posting or a message, a person on our team reads that content to evaluate the report: the message indicated and the fifteen messages preceding it in the same conversation, or the text of the reported posting. It serves to understand what happened: a sentence on its own does not tell harassment from a joke between two people who have worked together for months.
We look only at what has been reported. We do not read conversations for other reasons, and we do not use them for any purpose other than evaluating the report. The person reported does not know who reported them.
Reports are reviewed within 24 hours. If the content breaks the rules it is removed and the account can be suspended or closed.
You can also block a person without reporting them: the block works in both directions and neither of you sees the other's content any more. We keep the name you knew them by, so that you can recognise them in the list of blocked people and remove the block whenever you want.
The legal basis for this processing is our legitimate interest in keeping the service safe, and the moderation obligation set by the rules of the stores the app is distributed on.
For how long
We keep the data for as long as your account exists. When you delete it, profile, portfolio, postings, applications, conversations and messages are deleted.
Your rights
You can access your data, correct it, delete it, object to its processing and ask for its portability.
Deletion is in the app. Settings → Delete account and data. Deletion is immediate and covers our servers too, not only your phone. It cannot be undone.
You also have the right to lodge a complaint with the Italian data protection authority (Garante per la protezione dei dati personali) or with the supervisory authority of your country of residence.
Minors
Crew. is meant for people who work and is not intended for anyone under 16.
Changes
If we change this policy in a substantial way, we will tell you in the app before the changes take effect.