01About AwayPay
AwayPay is a mobile app for Australian-based crew, operated by AwayPay Pty Ltd (ACN 659 320 831). This policy explains how we handle personal information in the app and the services that support it. It also covers information about crew who appear in the app without having an AwayPay account.
For privacy enquiries, contact info@awaypay.com.au.
This policy covers AwayPay’s roster, allowance-estimate, crew-overlap, hotel and event features. It does not describe separate lending, payment or other financial services.
02What we collect
We collect information needed to provide the features you use:
- Account details: your work email address, staff number, account identifier, verification and sign-in records, and settings. Your name and relevant crew details can also come from roster and directory sources. You choose an AwayPay password; we do not ask for your airline-system password.
- Crew and roster information: names, staff numbers, base, fleet, rank, relevant directory or seniority details, pattern codes, duty and flight allocations, airports, dates, times, layovers, standby and leave or absence codes, contactability markers, and roster amendments.
- Source files and messages: individual roster files you upload or forward, their contents, and associated email headers, sender details, attachment information and processing records. Source files can contain more information than the app displays, including information about other crew. Please do not send unrelated medical, banking or identity documents.
- Calculated information: allowance estimates, duty and slip breakdowns, expected pay periods, and scheduled overlaps with other crew. These are derived from roster and reference data.
- Choices within the app: saved crew, roster-sharing permissions, requests to remove operational crew listings, event interests and searches, notification settings and read status, and any interest you register in a proposed feature.
- Device and service records: push-notification tokens, installation identifiers, platform information, network and security logs, and records needed to diagnose errors or deliver notifications.
- Support information: messages and files you choose to send when asking for help.
AwayPay’s current features do not require bank-account or card details, access to your contacts, or the phone’s GPS location. A destination or in-port estimate comes from roster information, not live tracking of your device.
03Where information comes from and why we use it
Information comes from you, roster emails you arrange to send to AwayPay, roster and crew-directory information supplied to AwayPay, and your use of the app and its services. Operational crew information may include people who have not registered with AwayPay.
We use this information to verify eligibility and link the correct staff record; show rosters and changes; estimate allowances and expected pay periods; identify scheduled crew overlaps; support voluntary roster sharing; suggest relevant events; display hotel, weather and currency information; deliver notifications; provide offline access; and operate, secure and support the service.
If required account information is missing, we may be unable to create or link an account. Optional features, such as push notifications and roster sharing, remain optional.
We do not sell personal information collected through AwayPay or use it for targeted advertising.
04What other crew can see
Your complete personal roster is not automatically shared with other crew. You can grant roster access to a particular person and withdraw it in My Crew. That access shows schedule information; it does not include your allowance amounts, payment information or private contactability details. Saving a colleague as a favourite does not grant them access to your roster.
Verified, linked crew can see limited operational information through crew searches, operating-crew lists and relevant in-port overlaps. Depending on the feature, this can include your name, staff number, base or rank, pattern reference and scheduled overlap dates. These listings can include people without an AwayPay account.
Roster information, including updates you supply, is used to keep these limited listings accurate. Full-roster sharing is a separate choice: switching it off does not remove operational crew listings. You can separately request removal from operational crew listings, as explained below.
Roster-derived presence is a schedule estimate, not confirmation of a person’s live location. Withdrawing access prevents further authorised access through the service; it cannot retrieve screenshots or copies someone has already made.
05Service providers and external services
We use third-party service providers to support hosting, secure sign-in, data storage, email and push notifications. These providers receive information needed to perform those services. Authorised AwayPay personnel may also access information for administration, roster processing, support and security.
The main services and information involved are:
- Hosting and sign-in: Linode/Akamai hosts our app services, and Supabase provides database and account services. They process the app and account information needed to operate AwayPay.
- Email: Microsoft 365 receives roster emails and attachments. Resend delivers account and service emails, processing recipient addresses and message content.
- Notifications: Google Firebase and Apple process delivery tokens and notification content. The private-preview setting limits what the notification says; more detailed previews may reveal duty or trip information on a device’s lock screen.
- Event search: Ticketmaster receives search terms and event-location or date parameters needed to find results. We do not send it your account identity or full roster as part of those searches.
- Weather and exchange rates: the app requests destination forecasts from Open-Meteo and currency rates from Frankfurter. Weather requests use the destination’s coordinates and relevant dates. Direct requests also reveal ordinary network information, such as your IP address, to the receiving service.
- Maps and event links: opening a hotel location or booking link takes you to the external provider. Its privacy policy applies to your use of that service.
We may also disclose information where required by law or where lawfully necessary to address fraud, security incidents or legal claims. Such disclosures are limited to the relevant purpose.
06Storage and overseas processing
Our primary app servers and roster database are hosted in Sydney, Australia. Some information is processed overseas to deliver email, push notifications and the other supporting services described above.
Resend, which delivers our account and service emails, processes information primarily in the United States. Apple also operates internationally and generally stores the personal information it collects in the United States. See Resend’s processing terms and Apple’s privacy policy.
Google Firebase notifications use global infrastructure, and Microsoft 365 may involve authorised access by staff overseas. Their published processing or support locations include the United States, Singapore, Japan, Taiwan, India, the Philippines, the United Kingdom, Ireland, Germany and the Netherlands, among other countries. The locations involved depend on the service and operational needs; this does not mean every user’s information is sent to every listed country. Further location information is available in Firebase’s privacy information and Microsoft’s overseas access locations.
We use measures such as authenticated access, restricted administrative permissions and encrypted network connections. The iPhone app encrypts its saved offline snapshots and uses device-protected storage. No system can guarantee absolute security.
07Offline copies and saved passwords
The app saves selected information automatically so it can remain useful without a connection. This can include your roster, calculated allowances, notifications, previously loaded crew-overlap information, hotels and events. Offline information can become out of date. Shared full rosters are excluded from the offline snapshot.
Offline snapshots are no longer used once they are more than 90 days old. That limit is a freshness rule, not the server’s retention period. Signing out clears the app’s account cache on that device. A disconnected device cannot receive a remote deletion immediately.
Apple Passwords and any other password manager you choose control their own saved credentials. Removing an AwayPay account does not itself remove a password saved in a separate password manager. AwayPay does not receive your Face ID biometric data.
08Retention and account deletion
We keep information only while it is needed for the purposes explained here or a specific legal obligation. We do not need to keep a former member’s private roster history simply because they once had an account.
For routine retention, original roster emails and files are kept until 90 days after the roster’s coverage period ends, or 90 days after we receive them, whichever is later. This covers the full roster period and allows time to resolve later corrections. Active members keep their own roster and allowance history while their account remains open. A confirmed deletion request takes priority over this routine retention schedule.
You can request deletion through Settings → Account & privacy → Delete account. The app explains the consequences and asks you to confirm your identity and decision. Deletion removes your account and associated personal app data, including private preferences, saved crew and interests, sharing permissions, notification registrations, personal roster uploads and revisions, and the estimates derived solely from those uploads. Cleanup includes the associated intake messages, attachments and archive copies held by AwayPay.
You can choose to remove your operational crew listings as well as your account. The deletion screen explains this choice before you confirm. If you choose account deletion only, operational crew information held independently of your account can remain in crew and in-port listings.
You can also request removal from operational crew listings while keeping your account. We remove the operational information held about you independently of your account, remove you from crew searches, operating-crew and in-port listings, and prevent later roster imports from adding you back. Your own roster remains available to you while you keep your account; any full-roster sharing you deliberately enable remains controlled by your separate sharing settings. Removal does not delete other crew members’ records or the flight schedule itself.
To honour your choice, we retain a minimal protected exclusion record used only to prevent your information from being reintroduced. This record is not a retained roster or a visible crew profile. It remains in place until you withdraw the exclusion request; creating a new account alone does not withdraw it. After account deletion, we also retain a protected identifier to stop forwarded personal rosters recreating your deleted private history. A new verified, active account can receive its own rosters again.
The app provides this choice in its privacy settings and during account deletion. People without an account can request the same removal by emailing info@awaypay.com.au. We verify the requester’s identity before removing someone’s information.
We aim to complete removal from active systems within 30 days of a confirmed request and will email confirmation. Account access and sharing are revoked when account deletion is requested; listing-removal requests hide the affected crew listings while preserving your own account. Restricted recovery copies may remain until their verified expiry, which we confirm as part of the cleanup process. Deletions and exclusions must be reapplied before a restored backup is put back into service. Any exceptional legal retention is limited to the information and period required.
Deleting information from AwayPay does not delete records held by your airline or other original providers. Please also stop any automatic roster forwarding you have set up. Information already saved on another device may remain available while that device is offline. The app clears or updates affected saved information when that device next connects.
09Access, correction and privacy concerns
You can review and change available settings in the app. To request access to or correction of other personal information, request removal from operational crew listings, or raise a privacy complaint, email info@awaypay.com.au. This is available to both members and non-members.
We may ask for reasonable evidence of identity before releasing or changing personal information. We will explain any information we cannot provide or change and the reason. If the issue comes from a source roster, we will explain how it can be corrected in AwayPay and whether the original supplier also needs to update it.
We aim to respond to privacy requests and complaints within 30 days, and will explain if more time is needed. If you remain dissatisfied, you may contact the Office of the Australian Information Commissioner, which can explain whether it can consider your complaint.
10Changes to this policy
We will publish the current policy with its effective date and bring material changes to users’ attention. If a new feature requires additional information or a new use of personal information, we will explain it and obtain any consent required before that use begins.