CrewHelix — Trust & Privacy

TL;DR

Your project data stays yours to access and export.
Built for real construction crews and contractors — no data brokers, no surveillance.
Your workstyle, wellness, and personal data are private by default.
We make money from subscriptions, not ads.

Our data commitment

Your data is yours. You can export everything you and your crew create at any time, and we don’t sell your personal or raw project data. To make CrewHelix better — and to power features like the Attention & Demand Engine — we may use anonymized, aggregated data, including to train models in future. Anonymized data can never identify you, your company, or a specific project.

Your data, your control

✓We only use your name and email for sign-in. That’s it. No phone-number harvesting, no contact-list scraping.
✓Your project files, jobsite photos, daily logs, and workstyle data are yours. They’re stored in encrypted storage. No business process accesses your content, all storage access is logged and audited, and we will never sell it.
✓You can export all your content. Your account page lets you download everything you and your crew have created.
✓You can delete everything associated with you. Account deletion permanently removes your data (GDPR-compliant). Where a record was shared with other parties — for example an RFI, document, or daily log a GC and a subcontractor both worked on — each party keeps their own copy of what was shared with them.
✓Data breach response: If our systems are ever compromised, we notify affected users within 72 hours.
✓Data retention: When you delete your account, your data is purged within 30 days, including backups.
✓Full-quality storage: Jobsite photos and documents are stored at full original quality — ready for records, disputes, or closeout. We never downscale your files.

What we do with project data

✓Personal & crew content (photos, daily logs, comments, workstyle data) — yours. We don’t sell it or hand it to third parties, and your workstyle and wellness data is never used to profile you.
✓Anonymized, aggregated data — We may use anonymized, aggregated data to improve the product and, in future, to train features like the Attention & Demand Engine. It can never identify you, your company, or any project.
✓Hard line: Personal information, private content, and identity data are NEVER shared with or accessible to anyone.

Photo authenticity (Content Credentials)

Jobsite photos in CrewHelix can be signed with C2PA Content Credentials — a tamper-evident cryptographic seal that records when and where a photo was captured and proves it has not been altered since. That matters for records, disputes, and closeout: a signed photo is verifiable evidence, not something generated or edited after the fact.

Content Credentials are an open industry standard (used by Adobe, Nikon, the BBC, and others). The credential travels with the photo, so anyone can verify it.

Our values & content policy

We believe in no surveillance of your crew, no incentivized behavior, and keeping workstyle and wellness data private by default. We use AI to help you get work done — like the Attention & Demand Engine that triages your day — never to fabricate content or profile your people.

Crew & worker privacy

✓CrewHelix is a workplace tool for adults — you must be 18 or older to hold an account.
✓Workstyle, mood, and wellness data is strictly private. It is never merged into social or shared models, and never shown to employers, GCs, or other crew members without the individual’s explicit action.
✓We do not sell or share any worker’s personal data with data brokers, insurers, or advertisers.
✓Crew members control their own profile visibility and can export or delete their data at any time.

Accountability

✓We are a bootstrapped team with no outside investors. If that ever changes, we’ll announce it publicly before any deal closes.
✓If CrewHelix is ever acquired, these commitments transfer to the new owner — or we give users 90 days to export all their data before any changes take effect.
✓An independent third-party security audit is planned once we secure funding. Until then, our infrastructure follows AWS security best practices with encryption at rest and in transit.
✓Accessibility: We’ve published our WCAG 2.1 AA compliance roadmap and are actively working through it.

Cookies & tracking

We believe in being explicit about what runs in your browser:

No third-party analytics. We do not use Google Analytics, Facebook Pixel, Hotjar, or any third-party tracking scripts.
No cross-site tracking. We do not track you across other websites. We have no tracking pixels, no fingerprinting, no retargeting.
Essential cookies only. We use a single authentication token stored in localStorage to keep you logged in. No advertising cookies, no preference-tracking cookies from third parties. We have no plans to add any additional cookies.
No data brokers. We never share, sell, or provide your data to data brokers, ad networks, or any third-party for profiling purposes.
Anonymized product metrics. We may use anonymized, aggregated usage metrics to improve the product and train features like the Attention & Demand Engine. They can never identify individual users or companies.

Email & marketing communications

We follow the CAN-SPAM Act for every commercial email we send. Here is exactly what that means for you:

Marketing email comes from CrewHelix, a product of Ghostbytes, LLC.

✓Accurate sender and headers. Every email accurately identifies CrewHelix in the From, Reply-To, and routing information. We never disguise who a message is from.
✓Honest subject lines. Our subject lines reflect the actual content of the message. No bait-and-switch.
✓Marketing is clearly labeled. Promotional email is identifiable as promotional, and is separate from transactional email (sign-in, project notifications, security alerts) that keeps your account working.
✓What the early-access form collects. Just your email address, used only to send the CrewHelix updates you asked for — nothing is sent until you confirm your address, and the address is never sold, shared, or used for anything else.
✓One-click unsubscribe. Every marketing email includes a clear unsubscribe link. You can also manage preferences in your account notification settings, or email privacy@crewhelix.com.
✓We honor opt-outs fast. We stop marketing email promptly — always within 10 business days of an unsubscribe — and never sell or transfer an address that has opted out.
✓Opting out leaves a suppression record. To make an opt-out stick, we keep the opted-out address on a do-not-email list — that record is what blocks future sends, so it is retained after the unsubscribe itself. To have it erased entirely, email privacy@crewhelix.com.
✓Our physical mailing address. Every marketing email includes a valid physical postal address.
✓We never sell or rent your email. And if a third party ever sends email on our behalf, we remain responsible for CAN-SPAM compliance and monitor them.

Our mailing address: 14917 Copper Ridge LN, Austin, TX 78734-4370, United States

Security & responsible disclosure

We take security seriously. If you discover a vulnerability, please report it responsibly:

security@crewhelix.com — for reporting security vulnerabilities

Do not publicly disclose the vulnerability until we have had a chance to address it.
We will acknowledge receipt within 48 hours and provide an initial assessment within 5 business days.
We will not take legal action against researchers who report vulnerabilities in good faith following these guidelines.
All data is encrypted at rest and in transit using industry-standard encryption. We take security very seriously and follow current best practices for data protection.

Tell us what we’re getting wrong. Use the in-app feedback system or email us at hello@crewhelix.com.

This is our plain-language commitment to you. Formal Privacy Policy and Terms of Service are being finalized and will be linked here before public launch.

How we treat your data, your privacy, and your team

Questions about your data?