CruiseLink privacy

Last updated 16 October 2026 · contact: max@youellsystems.co.uk

CruiseLink lets a family or group message each other on a cruise without buying ship internet. It has no accounts, no phone numbers and no advertising.

What stays on your phone

• Your name as you typed it, your group's messages, pings, meets, check-ins and plan, and the group key from the invite code.
• Diagnostics: timings and which route each message took, never message text or names. They stay on your phone unless you turn on Send diagnostics automatically, or export them, or tap Send diagnostics. The switch is in the Me tab and you can turn it off at any time, which also deletes anything waiting to be sent.

What other phones see

• Phones in your group can read your group's messages. That is the point.
• Other CruiseLink phones nearby can carry your group's messages if relaying is on (the Me tab). Messages are sealed with your group's key, so they can't read them. They can see a short group tag, a random member ID, and the size and ID of each sealed message. Carried messages are deleted after 24 hours.
• Bluetooth adverts contain only CruiseLink's service ID, not your name.

The internet relay

When your phone has internet, it can swap sealed messages with CruiseLink's relay (a Cloudflare Worker run by Youell Systems Ltd, company number 17464004, which publishes CruiseLink), so messages reach your group even when you're far apart. The relay stores:

• sealed messages it cannot read, filed under a mailbox ID derived from your group key, for 14 days;
• when each arrived;
• a push notification token for each phone in the group that uses the relay, so the relay can wake that phone when a new sealed message arrives. The token identifies the phone to Apple or Google's notification service, not to us. It is replaced when it changes, and deleted once your group's mailbox is empty and your phone has not checked in for 14 days.

Cloudflare processes connection details such as IP addresses to run the service, and short-lived service logs (kept for a few days, for fixing problems) may include them. Nothing is sold or shared. You can turn the internet relay off in the Me tab, and then your phone never contacts it.

Diagnostics

Diagnostics reach us in one of two ways: you tap Send diagnostics to the CruiseLink team in the Me tab, or you turn on Send diagnostics automatically, which sends them in the background whenever the phone has internet. In test versions (installed through TestFlight or Google Play testing) that switch starts on, because the people installing them have agreed to help test, and the first screen says so. In the app from the App Store or Google Play it starts off, and nothing is sent unless you turn it on. Either way you decide, and the switch is in the Me tab. Turning it off stops sending and deletes anything queued. What is sent is the same in both cases: a random install ID (not linked to your name or group), your phone model, iOS or Android version, app version, the ship, line and sailing labels your group entered, timings, which route each message took (Bluetooth, Wi-Fi, internet or other phones), whether phones were locked, whether the phone allowed CruiseLink to run in the background and why it last stopped, when CruiseLink showed its own warnings, whether CruiseLink was open or in the background, how fast the battery drained (overall and while the phone was locked), how many of each kind of item (message, ping, receipt and so on) the phone is holding, the kind of each item it sent, and short random codes standing in for group members. It never includes message text, names or your group's key. Sent diagnostics are kept for up to 180 days.

Deleting data

Deleting the app deletes everything on your phone. Messages on the relay are deleted automatically after 14 days, whether or not your group uses CruiseLink again: the relay clears out everything past that age once a day. Email the address above to have a group's mailbox removed sooner.