This page explains how CampCrew protects your crew's trips, photos, and personal information across the Android app, the iPhone app, the website, and the cloud services behind them.
1. Principles
- No passwords to steal: CampCrew stores no passwords. You sign in with Google or Apple.
- Crew-only access: a crew's data can be read and changed only by that crew's members.
- Encrypted in transit: all traffic uses HTTPS (TLS 1.2 or newer).
- No card data: CampCrew never receives or stores card numbers.
2. Sign-In and Access Control
- Sign-in: Firebase Authentication with Google, plus Sign in with Apple on iPhone. You can link both to one account.
- Signed tokens: each app proves who you are with a signed Firebase ID token. Our server (a Cloudflare Worker) checks the token's signature, expiry, audience, and issuer on every request.
- Controlled sign-ups: a new account can be created only while registration is open or with a valid, unexpired registration pass. If the registration setting is missing, sign-ups stay closed.
- Admin access: only for verified owner email addresses or accounts that were given an admin role. An email domain alone never grants admin access.
- Waitlist: waitlist signups go through our server, which checks format and length, keeps one entry per email address, and limits how often one network can sign up. Only admins can read the list.
3. Database Security (Cloud Firestore)
- Crew boundaries: every record belonging to a crew (trips, campgrounds, amenities, photo folders, ideas, custom categories and cuisines, join requests) carries that crew's ID. Firestore Security Rules allow only that crew's members to read or change it. The rules are covered by an automated test suite that runs against the Firebase emulator.
- Home address: kept in a separate record that only its owner can read, never in the profile your crew can see.
- Server-owned values: a crew's plan and its storage counters can be changed only by our server, never by an app.
- Crew ownership: only a crew's owner can delete it. Ownership moves only through a transfer that the current owner starts and the new owner accepts.
4. Photo Storage (Cloudflare R2)
- Private storage: photos, banners, and maps are stored in a private bucket with no public access.
- Uploads: our server checks your crew's storage limits and chooses where each file is stored; apps never pick their own storage path. The app then receives an upload link that expires after 5 minutes.
- Viewing: apps ask our server for short-lived viewing links, which are issued only for photos in your own crew. No storage keys are built into any app.
- Metadata: photos are re-encoded on your device before upload, which removes embedded metadata such as where the photo was taken.
5. Payments
- CampCrew never receives or stores card numbers or bank details. Shop checkout happens on Stripe's own checkout page.
- Payment notifications from Stripe are verified with HMAC-SHA256 signatures before they change anything.
6. Website
The website is served over HTTPS with security headers that block MIME-type sniffing, prevent other sites from embedding it, limit referrer information, and turn off camera, microphone, location, and payment access.
7. Deletion
- Deleting a photo removes it from storage.
- You can delete your account at any time in Settings. See the Privacy Policy for exactly what is deleted.
- An administrator-run cleanup removes stored files that no longer belong to any crew. It is designed to delete nothing if it cannot confirm the full list of crews.
8. Reporting a Vulnerability
If you find a security problem, please email security@campcrew.camp with a description, steps to reproduce it, and a proof of concept. We will acknowledge your report within 48 hours, and we will not take legal action against researchers acting in good faith.