Your crew data stays under your control.

Feature availability

Chat and message-sharing features are currently limited to development testing and are not included in the public App Store release. The message disclosures below describe data handled when those testing features are enabled. Heart Pings, friend requests, and flight notifications are separate features available in the public app.

Information Boopo handles

• Account and identity: your display name, friend code, home base, country, phone number or email, and identifiers from Apple, Google, or phone sign-in. When you use Sign in with Apple, Boopo stores an encrypted Apple refresh token only so that authorization can be revoked when you delete your account.
• Profile and crew: your profile photograph, friends, a small discoverability thumbnail derived from that photograph, requests, blocks, reports, sharing choices, and Heart Ping activity.
• Roster and flight: files you choose to upload and the duties, flight numbers, airports, dates, times, and trips extracted from them.
• Location: an approximate coordinate and permission state when you allow location access. By default, Boopo updates it while you use the app. If you separately turn on Update between app visits and grant Always location access in iPhone Settings, iOS may also deliver significant location changes while Boopo is not open. Friends receive the stored approximate coordinate only when your global and per-friend sharing choices allow it.
• Messages: messages, chosen photos, stickers, shared flight cards, sender and recipient identifiers, and delivery and read status. Typing activity is temporary. If you choose My location in a conversation, preview the card, and press Send, that message can include a precise coordinate and an Apple Maps link. This is a one-time snapshot, not a live-location subscription.
• Device and service: session records, push-notification tokens, delivery events, request timing, security events, and other operational records needed to operate and protect Boopo. If you separately enable Share diagnostics, Boopo also receives privacy-limited app version, iOS version, feature, result, status, timing, and bounded MetricKit performance or diagnostic-category counts. When Boopo crashes, its crash monitor may receive the app version and build, iOS version, device model, stack trace, and limited technical crash context. Support emails are handled separately through Boopo's support mailbox.

Location updates between app visits

Background location is optional and is not enabled merely because you allow location while using Boopo. To use it, you must turn on Update between app visits in Boopo and separately grant Always location access through iOS. When both are enabled, Boopo asks iOS for significant location changes so an approved friend can see a more recent approximate position after you leave the app—for example, after reaching a layover city. iOS decides when and whether to deliver those updates, so this is not continuous tracking and Boopo cannot guarantee a real-time position.

Boopo rounds the coordinate before publishing it. The app labels recent and older positions by freshness and stops showing a Globe pin once the last shared position is more than 24 hours old. You can stop new background updates at any time by turning off Update between app visits in Boopo, changing Location access to While Using or Never in iPhone Settings, or disabling location sharing globally or for an individual friend.

How Boopo uses information

• Create, authenticate, secure, and support your account.
• Turn roster files into the calendar and flight information you requested.
• Show approved crew, approximate location, and roster-based flight estimates on the Globe.
• Show a small profile thumbnail to signed-in people searching for you or viewing a pending friend request.
• Deliver messages, Heart Pings, friend activity, and notifications you allow.
• Apply sharing restrictions, blocks, abuse limits, and safety reports.
• Diagnose failures, maintain reliability, and prevent misuse.

Friends and sharing

Your global Settings are the maximum you will share. From Friends in the home drawer, the More menu’s Sharing access screen can further restrict Location on Globe and Flight on Globe for an individual friend. Roster access uses a separate request and approval flow, and can be revoked. Blocking removes the crew connection and prevents both people from seeing each other’s Globe location, roster-based flight estimate, roster, or profile photographs, including the smaller friend-search thumbnail.

Where messaging is enabled for testing, messages are available between accepted friends. Photos and Boopo Cards are sent only after you press Send. A shared card is a timestamped copy: changing your roster or Globe sharing settings does not update or recall a message already sent. Recipients can keep their own copies. You can disable read receipts in the conversation menu, report a person, or block further contact. Messages are stored by Boopo to synchronize conversations; they are not end-to-end encrypted. On-device caches allow recent messages and flight cards to appear while the network refreshes them.

Boopo does not sell your personal information or use your roster, location, or profile photograph for third-party advertising.

Private messages and screenshots

Messages are available to the two conversation participants while they remain accepted friends and neither has blocked the other. Screenshot attachments are stored privately and require an authenticated, authorized request. Message content is processed and stored on Boopo's servers; conversations are not end-to-end encrypted. Boopo uses Cloudflare to host this data and Apple Push Notification service for generic message alerts that do not include message text or screenshots.

You can edit or delete your own messages. Deleting a message removes its active content and queues its attachment for storage cleanup. Deleting either participant's account removes the conversation and queues its attachments for cleanup. Unsent uploaded attachments become eligible for cleanup after 24 hours. Cleanup retries when storage is temporarily unavailable. Blocking or removing a friend prevents further conversation access; it does not itself delete stored history. Recipients may have already saved or captured content outside Boopo.

Your iPhone temporarily stores unsent messages and selected screenshots in a protected outbox so you can retry. Boopo excludes this outbox from device backups and clears it when you change or sign out of the account. Selecting a screenshot does not give Boopo access to your entire photo library.

Service providers

Boopo uses providers only where needed to deliver a feature:

• Cloudflare for network delivery, application hosting, storage, and security.
• AeroDataBox, accessed through API.market for flight-number and date lookups, including filling missing schedule details during roster import. Boopo sends the flight number and date from its server for these lookups, rather than your roster PDF, photos, profile, or device location.
• Google Gemini API to extract structured roster information from the redacted copies you approve for that purpose.
• Apple Maps / MapKit to display the map in current versions of Boopo. Older versions used Mapbox, whose embedded SDK may process precise or approximate device location, map interactions, SDK identifiers, usage, performance, and diagnostic data for map functionality and analytics. Boopo does not use that information for advertising or cross-app tracking.
• Apple and Google when you choose their sign-in services. Google Sign-In may process identity, contact, device, usage, and related service data for authentication, app functionality, and service analytics.
• Twilio when you choose phone-number verification.
• Apple Push Notification service to deliver notifications to your iPhone.
• Axiom to store and query privacy-limited server reliability, security, and optional iPhone diagnostic events.
• Sentry to receive and group iPhone crash reports needed to diagnose app failures.

These providers may process information in countries other than your own under their own infrastructure and legal obligations. Boopo limits the data sent to what the selected feature needs.

Diagnostics and monitoring

Boopo records limited server-side reliability and security events needed to operate, protect, and troubleshoot the service. On your iPhone, Share diagnostics is optional, disabled by default, and can be changed at any time in Boopo Settings. Turning it off stops new optional iPhone diagnostic events.

Diagnostic payloads are built from an allowlist. Boopo does not place names, email addresses, phone numbers, profile photographs, contacts, location coordinates, roster content, flight numbers, authentication credentials, raw URLs, or raw error messages in Axiom telemetry. Events may contain random request or app-launch identifiers so related technical steps can be investigated. MetricKit summaries contain only bounded payload counts and categories such as crash or hang. Boopo does not export raw MetricKit JSON, call stacks, device metadata, or signpost content to Axiom.

Axiom telemetry is routed to Boopo datasets in the European Union and retained for 30 days. Apple, TestFlight, and MetricKit remain the primary sources for detailed iOS crash and performance diagnostics; Axiom receives only Boopo's bounded summaries, app events, and client/server request journeys rather than advertising or cross-app tracking.

Sentry is configured as a crash-only monitor in its European Union region. Boopo disables performance tracing, profiling, session replay, screenshots, view-hierarchy capture, app-hang monitoring, request-failure capture, breadcrumbs, and Sentry's generative-AI features. Boopo does not identify a signed-in person to Sentry, and server-side IP storage and data scrubbing are enabled. Sentry's technical crash reports are separate from the optional Share diagnostics setting because they are needed to identify serious app failures affecting the service.

International data transfers

Some providers may process information outside Singapore or the country where you use Boopo. Boopo limits transferred information to what the selected feature needs and uses provider and contractual safeguards intended to provide protection comparable to applicable Singapore data-protection requirements. Axiom diagnostic-event ingestion and datasets are configured for its EU Central region; limited account administration, support, or subprocessor activity may still occur in other countries under the provider's contractual terms. Sentry crash-event storage is configured in the European Union; limited account administration, support, and subprocessor processing may similarly occur in other countries under Sentry's contractual terms.

Retention and deletion

Active account, roster, profile, friendship, and sharing records are kept while your account or the relevant feature remains active. Removing a roster upload takes it out of active use immediately; its superseded or deleted record and parsed roster data are permanently purged within 30 days. Deleting your account removes its active profile, roster, social, sharing, notification, photo, message, and session records.

• Approved, redacted roster pages for background import and retry: up to 24 hours in private storage. Server copies are removed when processing finishes, you discard the import, or the retention period expires. Your iPhone clears its saved copy when Boopo next runs. The original selected PDF or photo is not uploaded by Boopo.
• Messages remain while the conversation and accounts remain active, unless deleted. Deleting a message removes its content from active service; attachment files are queued for removal. Unsent uploaded attachments expire after 24 hours. Copies a recipient has saved outside Boopo cannot be recalled by account or message deletion.
• Expired or revoked sign-in sessions: 30 days.
• Read notifications: 90 days; unread notifications: 180 days.
• Inactive or stale push-notification tokens: 30 days.
• Background refresh diagnostics: 30 days.
• Server reliability and optional iPhone diagnostic events in Axiom: 30 days.
• Sentry iPhone crash events: up to 90 days under the active Sentry plan.
• Authentication and social-action rate-limit counters: 2 days.

Account deletion also removes active block and report records associated with the account. Provider infrastructure logs, recovery copies, and support correspondence follow the relevant provider's configured or contractual retention schedule and may persist after active Boopo records are removed.

Your choices

• Change global choices in Settings and per-friend choices in Sharing access.
• Approve, limit, or revoke roster access person by person.
• Mute, remove, block, or report another user.
• Turn updates between app visits on or off in Boopo Settings.
• Change location, photo, contacts, and notification permissions in iPhone Settings.
• Remove uploaded rosters or permanently delete your account.

See the account deletion guide for the in-app steps. You may also contact support to ask about access, correction, deletion, or another privacy right available where you live.

Privacy questions

Security, age eligibility, and changes

Boopo uses access controls and technical safeguards intended to protect your information, but no internet service can promise absolute security. Boopo is intended only for people aged 18 or older. Do not create or use a Boopo account if you are under 18. If you believe an under-18 user has provided personal information to Boopo, contact us so the account and associated data can be reviewed and removed.

This policy may change as Boopo and its legal obligations change. The current version and update date will remain on this page.