Privacy Policy

1. Information We Collect

Data	Source	Purpose
Apple ID email & name	Apple Sign In	Account creation & identification
Crew category, aircraft type, base	You (profile setup)	Filtering patterns to your eligibility
ARMS pattern book PDF	You (upload)	Parsing trip patterns for bid optimization
Bid briefs	You (free-text input)	AI-powered bid sheet generation
Bid sheets	Generated by the service	Optimization results for your review
Subscription status	Apple App Store	Access control and billing
Buddy link data	You (invite/accept)	Connecting you with another pilot for joint bid optimization
Forwarded ARMS roster emails	You (forwarded to your unique @bidcheck.co address)	Parsing your awarded roster into a calendar feed and proactive contact-window reminders
Awarded pattern records (pattern code, week of departure, your seniority number)	Derived from your forwarded roster	Aggregated, anonymized insights into pattern competitiveness for all pilots (e.g. typical seniority cohort that wins a given pattern)
Trip Swap discoverability flag, Qantas work email, employee number	You (Settings & in-app prompts)	Matching you with other pilots for a one-for-one trip swap and CC'ing your swap partner on the ARMS hand-off email
Trip Swap proposals & Port Requests (wishes)	You (Trip Swap screens)	Persisting your active proposals/requests, validating legality against crewing rules, generating the email pilots forward to crewing
Special-meal profile: meal type (dietary/health-related), authority reference, staff number, Qantas work email	You (Settings)	Automatically emailing your approved special-meal request to the relevant catering provider for each departure you operate
Catering email log (recipients, subject, send status — never the email body)	Generated by the service	Showing you what was sent and diagnosing delivery problems
Roster-forwarding recipients: email address and optional label (e.g. “Sarah”) of trusted people you choose	You (Settings)	Emailing a readable PDF version of your roster to the partner/family members you nominate
Roster-forwarding send log (recipient, bid period, send status — never the PDF itself)	Generated by the service	Avoiding duplicate sends, detecting amended rosters, and diagnosing delivery problems

1a. Sensitive (Health) Information

The special meal feature is optional. If you enable it, the meal type you select (for example gluten-free, lactose-free, or low-fat) relates to a dietary or medical requirement and is therefore sensitive information under the Australian Privacy Principles. We collect it only with your consent — given when you enable the feature and save your meal profile — and use it for a single purpose: requesting your approved meal from the catering provider for the flights you operate.

When BidCheck sends a request, your meal type (together with your name, staff number, authority reference, and operating flight details) is disclosed to the relevant third-party catering provider for that port, and you are CC'd on every email. You can disable the feature and delete your special-meal profile at any time in Settings. We never use this information for any purpose other than sending your meal request, and we never share it for advertising or analytics.

If you hold a written meal-approval document, BidCheck does not store or retain that document. The approval document stays on your own device and is never uploaded to our servers. We store only the structured fields you enter — the meal type and the authority reference number — which is all that is needed to send your request.

2. How We Use Your Information

• Bid optimization: Your bid brief and parsed pattern data are sent to Anthropic's Claude API to generate optimized bid sheets. No other purpose.
• Account management: Your Apple ID information is used solely for authentication and account identification.
• Subscription management: Subscription transactions are handled entirely by Apple via StoreKit 2. We store only your subscription status, not payment details.
• Buddy Bidding: When you link with another pilot, your name and crew category are shared with your buddy. During Buddy Sync, the backend reads both pilots' bid briefs server-side to generate buddy-aware bid sheets. Your buddy never sees your bid brief text, raw preferences, personal dates, email, or subscription status — only the resulting schedule overlap (matched patterns, shared slip days).
• Roster ingestion: Rosters you forward to your unique @bidcheck.co address are parsed into day-level structured data, stored against your account, and used to generate your private calendar feed and proactive contact-window reminders (A-day BLH/PLH, RM54 last-duty-free, 15-4 pre-duty call-in).
• Aggregated pattern competitiveness insights: The patterns awarded to you and your seniority number, derived from forwarded rosters, are retained and combined with the same data from other pilots to produce aggregated, anonymized insights about which seniority cohort typically wins each pattern. Individual awards are never disclosed to other users, attributed to you by name, or linked to your identity in any user-facing surface.
• Special Meals: If you enable the optional special meal feature, BidCheck reads your current roster to determine each port you operate a departure from, and emails your approved meal request (your name, staff number, meal type, authority reference, and flight numbers and dates) to that port's catering provider between roughly 48 and 24 hours before departure. You are CC'd on every email and replies route to your nominated work email. We send on your behalf; we never receive catering's response. See section 1a for how we handle the dietary/health aspect of this data.
• Roster Forwarding: If you add trusted recipients (for example a partner), BidCheck re-renders your parsed roster as a readable PDF — a calendar grid plus per-trip detail (flight numbers, ports, sign-on and landing times) — and emails it to each recipient you have nominated. Recipients are double opt-in: an address receives nothing until the person clicks a verification link, and every email carries a one-click unsubscribe. A new or amended roster is forwarded automatically, and you can send on demand from Settings. This data reveals your location and movements, so it is shared only with the people you explicitly choose and verify; you can remove a recipient at any time, which stops all further sends to them immediately. We do not Cc ourselves and we do not retain the PDF.
• Trip Swap: If you are discoverable for swap proposals (on by default — see below), the trips on your current roster become visible to same-base pilots in your aircraft + crew category cohort when they look for a match. They can see the pattern code, sign-on date, credit hours, and your display name + base. They cannot see your bid brief, leave dates, personal preferences, or roster outside the cohort filter. When you propose a swap to another pilot, both of you become visible to each other and the proposal is shared with both. When you post a Port Request, the destination you want and the trips you're offering are visible to out-of-base pilots in your same cohort — those pilots cannot see your wider roster, only what you chose to expose in the request. You can disable Trip Swap discoverability at any time in Settings → Privacy; doing so removes you from match lists and hides your trips from other pilots immediately, though buddies you have explicitly linked still see your trips for swap purposes regardless of the flag.

2a. Trip Swap Default — What Changed

From version 1.13 onwards, Trip Swap discoverability is on by default for all accounts. Previously this setting defaulted off and required an explicit opt-in. We changed the default to make the feature actually usable — a default-off swap directory with a small user base means nobody finds anyone, so the feature dies.

When the change went live, every existing account was flipped to discoverable. The next time you opened the upgraded app, the What's New screen showed you a toggle so you could opt back out in one tap. If you want to opt out at any time, go to Settings → Privacy → Discoverable for swap proposals.

What "discoverable" means and what data is shared is described in section 2 above. Trip Swap is a same-cohort, same-aircraft feature: pilots flying different aircraft or in different crew categories never see each other regardless of the flag.

3. Third-Party Services

• Anthropic (Claude API): Bid briefs and parsed pattern data are sent to Anthropic's servers in the United States for AI-powered optimization. Anthropic's use of this data is governed by their privacy policy. Anthropic does not use API inputs to train their models.
• Apple: Authentication via Apple Sign In and payments via StoreKit 2. Governed by Apple's privacy policy.
• Resend (email delivery): If you use Special Meals or Roster Forwarding, the relevant emails are sent through Resend, an email delivery provider. To send a message, Resend processes the recipient address, your name, and the message content — for Special Meals that includes your staff number, meal type, authority reference, and flight details; for Roster Forwarding it includes your roster PDF attachment (your flying schedule). Resend's servers are located in the United States, so enabling either feature involves a disclosure of your information overseas — including, for Special Meals, the sensitive dietary information described in section 1a. Governed by Resend's privacy policy.
• Catering providers: When you use Special Meals, your meal request is emailed to the third-party in-flight catering provider for each port you operate a departure from (for example dnata, LSG Sky Chefs, Gate Gourmet, Newrest, or SATS). Those providers receive your name, staff number, meal type, authority reference, and operating flight details for the sole purpose of preparing your meal.
• Roster-forwarding recipients: When you use Roster Forwarding, your roster PDF is emailed to the trusted people you nominate and verify (for example a partner). They are not BidCheck users and we assume you trust them with your schedule; they receive only what is in the PDF. You choose, verify, and can remove each recipient, and each recipient can unsubscribe at any time.

We do not sell, rent, or share your personal information with any third parties except as described in this policy. When you use Special Meals, your meal request details are emailed on your behalf to the catering provider(s) for the ports you operate, and routed via the email provider above, as described in sections 1a and 2. When you use Buddy Bidding, your name and crew category are shared with pilots you explicitly link with. You can remove a buddy link at any time from Settings, which immediately stops all data sharing with that pilot. When Trip Swap discoverability is on (the default — see section 2a), your display name, base, crew category, and the trips on your current roster are visible to other pilots in your same-base cohort, and your destination wishes are visible to out-of-base pilots in your same aircraft + crew category cohort. Turning the toggle off in Settings → Privacy removes you from those surfaces immediately. Aggregated pattern competitiveness insights derived from forwarded rosters are shown to other BidCheck users only in anonymized, statistical form — never as individual awards, never attributed to you. We do not use analytics, tracking cookies, or third-party advertising services.

4. Data Retention

• Account data (email, name, profile): retained until you delete your account.
• Bid sheets: retained for 12 months, then automatically deleted.
• Uploaded PDFs: parsed server-side and not retained after parsing is complete. We do not store your pattern book files.
• Buddy links: retained until either pilot removes the link. Removed links are soft-deleted (status set to “removed”) and purged after 90 days.
• Forwarded rosters & derived day-level data: retained until you delete your account, after which they are removed.
• Aggregated award records: the per-award rows (pattern code, week of departure, seniority, trip start date) are retained indefinitely to build historical coverage. When you delete your account, the link back to your identity (pilot_user_id) is set to NULL but the anonymized award row remains in the aggregate dataset.
• Trip Swap proposals & Port Requests: active proposals/requests are retained until accepted, declined, withdrawn, expired, or invalidated by a roster change. Once resolved they are retained for 90 days for support/audit, then deleted. Wishes auto-expire at the end of their bid period or 14 days from creation, whichever is sooner. When you delete your account, all your proposals and requests are deleted immediately; proposals made to you by other pilots are anonymised but retained for the other pilot's history.
• Special-meal profile (meal type, authority reference, staff number, work email): retained until you disable the feature, delete the profile, or delete your account.
• Special-meal approval document: not stored. BidCheck never receives or retains your approval document — it stays on your own device.
• Catering email log: the recipients, subject, and send status of each request (never the email body, which we do not store) are retained against your account so you can see your send history and so we can diagnose delivery problems. They are removed when you delete your account.
• Roster-forwarding recipients (email, optional label, verification/unsubscribe status): retained until you remove the recipient or delete your account.
• Roster-forwarding send log: the recipient, bid period, and send status of each forward (never the PDF, which we do not store) are retained against your account to prevent duplicate sends, detect amended rosters, and diagnose delivery problems. They are removed when you delete your account.

5. Data Security

We protect your data using:

• TLS encryption for all data in transit
• JWT-based authentication with HS256 signing
• Server-side API key management (your device never holds AI service credentials)
• PostgreSQL with connection encryption
• Rate limiting and request size controls

6. Your Rights

• Access: You can view your profile data and bid sheets within the app at any time.
• Deletion: You can delete your account at any time from the app's Settings screen. This permanently removes all your data, including profile information, bid sheets, and optimization history. Account deletion is immediate and irreversible.
• Portability: Bid sheets can be viewed and copied from within the app.

7. Children's Privacy

BidCheck is designed for professional airline pilots. We do not knowingly collect information from anyone under the age of 18. If you believe a child has provided us with personal information, please contact us and we will delete it.

8. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes through the app or by updating the "Last updated" date above. Continued use of BidCheck after changes constitutes acceptance of the updated policy.