DutyFlip helps airline crew swap duties with colleagues. To do that we handle your roster and some details about you. This policy explains what we collect, why, who else is involved, how long we keep it and your rights.
Last updated: 29 September 2026
1. Who we are
DutyFlip is run by Vector and Wing Limited, a company registered in England and Wales (company number 17367147), registered office 82A James Carter Road, Bury St Edmunds, IP28 7DE, England (“DutyFlip”, “we”, “us”). We are the data controller for the personal data described here.
DutyFlip is independent. We are not part of, or endorsed by, any airline (including TUI Airways) or RosterBuster, and we don’t share your data with your airline.
2. What we collect
Your account
- Your airline email address, used to sign in with a one-time code. Only approved airline email domains can sign up.
- Your name, crew code (for example DAW), base, crew group, role and fleet.
- Optionally, your mobile number and whether you use WhatsApp.
- Your settings (time display, theme), your referral code, rewards points and free-time claims.
Your roster
- The duties you confirm when you import a roster: dates, duty codes, flights, times, airports, layover stations, hotel names when the roster PDF shows them, and aircraft type.
- If you import from your phone’s calendar: the three-letter crew codes of the other crew on your flights (see section 4).
- Free-text remarks printed on your roster or in calendar event notes (for example delay notices from crewing). These are kept in a private log that is never shown in the app, not even to you. We use them only to diagnose problems with roster imports.
- Where each roster came from (PDF or calendar) and when you imported it.
What you do in the app
- Swap offers, your preferences for what you’d like in return, swap requests, and whether swaps are agreed or completed.
- Messages you send in swap and Onboard chats.
- Days you mark as unavailable, with any private note. Please don’t put health or other sensitive details in these notes.
- Onboard requests (a flight date and route you want to know about) and whether you opt in to being found by Onboard.
Technical data
- A push notification token for your device, if you allow notifications.
- Your consent choices: when you agreed to this policy, whether you want marketing email, and whether you want new-swap notifications.
- Your subscription status: which plan, which store, when it renews or ends. We never see your card or bank details; Apple or Google hold those.
- Basic sign-in records (when you signed up and last signed in).
- Error reports: when the app shows you an error, it sends us the error code, which screen you were on, your phone type and system version, and the app version, with a short technical description (email addresses and phone numbers are removed first). We use these only to find and fix problems.
On this website
- If you join the waitlist: your email address, the page you signed up from, and a one-way hash of your IP address (used only to stop abuse; it can’t be turned back into your IP address).
- Session data needed to run the site securely (see Cookies).
What we don’t collect
- Roster PDFs. Your PDF is sent to our roster reader, read in memory and discarded straight away. Only the duties you confirm are saved.
- Your calendar. If you import from your calendar, DutyFlip reads only the calendar you choose, on your phone. Event notes, including crew surnames, stay on your phone. We never write to your calendar.
- Your location, contacts, photos, or advertising identifiers. We don’t use analytics or advertising trackers.
- Payment card details. If you subscribe, payment is handled by Apple or Google and we receive only confirmation of your subscription.
3. How we use it, and our lawful basis
| What we do | Lawful basis (UK GDPR) |
|---|---|
| Create and run your account, sign you in, check you work for a supported airline | Contract: we need it to provide DutyFlip |
| Import and show your roster, show your offers to colleagues, match swaps and suggested swaps, check flight time limits | Contract |
| Let you chat, call or WhatsApp a colleague you have a swap request with | Contract |
| Onboard: find crew rostered on a flight and pass on your request | Contract, and only crew who opt in can be found |
| Show the crew on a flight on swap cards (calendar imports) | Legitimate interests: helping crew decide on a swap (see section 4) |
| Send push notifications about requests and messages | Consent, which you give and can withdraw in your phone’s settings |
| Send a push notification when a colleague at your base publishes a swap matching your swap preferences | Consent, which you can turn off in Profile › Notifications |
| Email you about your account (for example an important change to the service) | Legitimate interests (running the service) |
| Email you DutyFlip news and offers | Consent, given by a tick box you can untick at any time in Profile, or by unsubscribing in any email |
| Read your phone’s calendar to import your roster | Consent, through your phone’s permission prompt; you can turn it off at any time |
| Free trial, referrals and rewards, including stopping the same person claiming a free month twice | Contract and legitimate interests (preventing abuse) |
| Know whether your subscription is active, so the app works for you | Contract |
| Keep a private log of roster remarks to fix import problems | Legitimate interests (keeping imports accurate) |
| Support: help you with a problem, fix account details at your request | Contract and legitimate interests |
| Receive error reports so we can find and fix problems | Legitimate interests (keeping the app working) |
| Keep DutyFlip secure, investigate misuse, keep staff activity logs | Legitimate interests (security) and legal obligation where it applies |
| Waitlist: tell you when DutyFlip launches | Consent, which you give by joining and can withdraw at any time |
Where we rely on legitimate interests, we have weighed them against your rights and kept what we use to the minimum. You can object at any time (see Your rights).
DutyFlip doesn’t make decisions about you that have legal or similarly significant effects by automated means. Flight time limit checks are indicative only: your airline’s crewing team always makes the decision on a swap.
4. Information about other crew
Rosters imported from a RosterBuster calendar list the other crew on each flight. DutyFlip keeps only their three-letter crew codes, never their surnames, and shows them on swap cards so you can see who you’d be flying with. A crew member who has a DutyFlip account is shown by their DutyFlip name; everyone else is shown only by their code.
These codes are seen only by crew who can already see that duty: the person who imported it, colleagues in the same pool looking at an open offer, and people in a swap involving it. If you’re a crew member and want your code removed from DutyFlip, or want to object to this, contact us (see section 13) and we’ll act on it.
If you have a DutyFlip account, your name will appear to colleagues who have you on a flight they’re looking at in DutyFlip.
5. Who can see what
- Your full roster: only you.
- Duties you offer for swap: crew in your pool (same airline, base and crew group), plus your name, crew code, role and fleet.
- Your mobile number: only a colleague you have a swap request with.
- Messages: only the people in that chat.
- Unavailable days: colleagues can see that you’re unavailable; your note is private to you.
- Onboard: crew you match with see your name, role and note, never your roster.
- DutyFlip staff: a small number of staff use a secure admin panel, protected by two-factor authentication, to support users and keep the service running. Staff can’t read your messages, your private roster remarks or your unavailable-day notes. Every staff action is logged.
We don’t sell your data and we don’t share it with your airline, advertisers or data brokers. We may disclose data if the law requires it, or to protect the safety of users or others.
6. Companies that help us run DutyFlip
These companies process data for us under contracts that require them to protect it and use it only on our instructions.
| Company | What they do | Where |
|---|---|---|
| Supabase | App database, sign-in and sign-in emails | Data stored in London (UK) |
| Fly.io | Runs the roster reader that reads PDFs in memory | London (UK) |
| Expo (650 Industries) | Delivers push notifications and app updates | USA |
| Apple and Google | App stores, push notification delivery, and taking subscription payments (we never see your card details) | USA and elsewhere |
| Google (Google Analytics) | Website analytics, only if you accept analytics cookies: page views, approximate location from a shortened IP, browser type | USA (EU data terms in place) |
| RevenueCat, Inc. | Links your subscription in the App Store or Google Play to your DutyFlip account and tells us when it starts, renews or ends. Receives your DutyFlip user ID and the store’s purchase record, never your name or roster | USA |
| Amazon Web Services (Lightsail) and Laravel Forge | Hosts this website and the waitlist | London (UK) |
| Cloudflare | Protects and speeds up this website | Global network |
| Brevo (Sendinblue SAS) | Holds our email list (your email, first name, base and consent choices) and sends account and, with your consent, marketing email | EU (France) |
7. International transfers
Your account and roster data is stored in the UK. Some providers above are based in, or may access data from, the USA or other countries. Where personal data leaves the UK, we rely on UK adequacy regulations (including the UK Extension to the EU–US Data Privacy Framework) or the UK International Data Transfer Addendum to the EU Standard Contractual Clauses.
8. How long we keep it
- Your account, roster, offers, requests, messages and remarks: while you have an account. When you delete your account in the app (Profile › Delete account), they are deleted straight away.
- Backups: deleted data can remain in encrypted database backups for up to [7] days before it is overwritten.
- Free-trial record: to stop the same person claiming a free month twice, we keep a one-way hash of your email address and crew code after you delete your account, for [2 years]. It can’t be turned back into your details.
- Roster PDFs: never stored.
- Waitlist: until DutyFlip launches and we’ve told you, or until you ask us to remove you, and no longer than [12 months] after launch.
- Error reports: 90 days, then deleted automatically. Deleted straight away with your account.
- Staff activity logs: [2 years], for security.
- Website sessions: 2 hours of inactivity.
9. Security
Data is encrypted in transit and at rest. Database access rules mean each person can only read what they’re allowed to see, and staff access is limited by role, protected by two-factor authentication and logged. No system is perfectly secure. If a breach puts your rights at risk, we’ll tell you and the Information Commissioner’s Office (ICO) as the law requires.
10. Your rights
Under UK data protection law you can:
- ask for a copy of your personal data (access);
- ask us to correct it (you can edit most details yourself in Profile);
- ask us to delete it (you can delete your account yourself in the app);
- ask us to limit how we use it (restriction);
- object to uses based on legitimate interests;
- ask for the data you gave us in a portable format (portability);
- withdraw consent at any time, for example by turning off notifications or calendar access, or leaving the waitlist. This doesn’t affect anything we did before.
Email us to use any of these rights. We’ll reply within one month, and we may need to confirm it’s you first. It’s free unless a request is clearly unfounded or excessive.
11. Cookies
Essential cookies. This website sets a session cookie and a security token that protects the waitlist form. The session records your IP address and browser type for security and expires after 2 hours of inactivity. These don’t need consent.
Analytics (optional). If you accept analytics in the cookie banner, we use Google Analytics to see which pages are visited and roughly where visitors come from, with IP addresses shortened. It sets the _ga cookies (up to 2 years). Until you accept, no analytics cookie is set and Google receives only cookieless, non-identifying page counts. You can change your mind by clearing the site’s data in your browser, which brings the banner back. Google is listed as a processor in section 6. The app itself doesn’t use cookies; it keeps a copy of what you last viewed on your phone so it works without signal.
12. Other things you should know
- Age: DutyFlip is for working airline crew aged 18 or over.
- Your phone: the app stores a cached copy of your roster and swaps on your device so it works offline. Deleting the app removes it.
- Changes: if we change this policy in a way that matters, we’ll tell you in the app before it takes effect. The date at the top shows the latest version.
13. Contact and complaints
Email [email protected], or write to Vector and Wing Limited, 82A James Carter Road, Bury St Edmunds, IP28 7DE, England.
If you’re unhappy with how we’ve handled your data, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner’s Office: ico.org.uk/make-a-complaint or 0303 123 1113.