MARTIN MAX · M CREW

Privacy policy & account deletion

Effective October 30, 2026.

M Crew is the internal staff app operated by Martin Max for its workforce. Martin Max is responsible for the workplace information described here. For privacy questions, access or corrections, contact your company administrator or hemmy.huang@martinmax.ca. Do not email passwords or chat recovery secrets. You can request account deletion inside the app without emailing us.

Information and purposes

• Account and work information: your name, username or email, role, assigned locations, optional profile photo and schedules support sign-in, company contacts and scheduling.
• Attendance: clock actions, times, workplace, location accuracy and distance checks, correction requests and approvals support attendance records and review. Reports summarize hours; the app does not calculate wages or make employment decisions automatically.
• Communication: messages and attachments, conversation membership, delivery/read information and device notification tokens support company chat and notifications.
• Security and operation: authentication/session records, access changes, deletion progress and limited service logs help protect accounts, diagnose failures and prevent deleted accounts from returning after a restore.

We use this information to provide and secure company services, maintain necessary employment records and respond to requests. M Crew does not sell your data or use advertising trackers.

Location, photos and notifications

Precise location is requested when you clock in or out to check the workplace boundary. M Crew does not continuously track your background location. If permission is denied, the app explains how to enable it; location-dependent clock actions cannot be verified without it. Administrators set workplace coordinates by address lookup using Apple Maps, with OpenStreetMap as a fallback. Their device GPS is not used to set the workplace.

Photos or files you select are used for the avatar or message you choose to send. Notification permission and message previews are controlled by your device settings; previews may be visible on the lock screen.

Who can access information

Administrators manage staff, locations and company attendance/schedules. Managers have the access permitted for their assigned locations. Conversation members receive the messages and attachments shared with them. Access to employment records retained after account deletion is restricted to authorized company administration.

Google Firebase provides authentication, business-data storage and push delivery. Martin Max operates its backend and Matrix chat service on its company Mac server, reached through Cloudflare. Cloudflare R2 stores encrypted disaster-recovery backups. A private company-controlled Google Drive folder holds separate recovery-key material so a lost Mac does not also lose the only recovery key. Apple Maps/OpenStreetMap receive workplace address searches. These providers may process data outside Canada under their service arrangements. We do not claim that all service processing is confined to Canada.

Chat security and recovery

Chat messages and attachments are encrypted in transit (HTTPS) and stored on the company chat server; they are not end-to-end encrypted, so authorised company administrators can access them for business, legal and security purposes. Your device also holds local history and may temporarily hold pending submissions.

Delete your account

After acceptance, access is disabled and a persistent deletion job runs automatically. The app distinguishes a request that was accepted from a network result that could not be confirmed. Keep the request reference if the result is uncertain. Administrators can see the processing status in the web dashboard’s Privacy section.

The job revokes sessions, removes login credentials and personal profile/contact details, notification registrations, company-managed chat recovery material, the account’s uploaded chat media and its future shifts. It redacts messages sent by that account across server rooms, including rooms the account left, and erases/deactivates the Matrix account. Another member’s own messages are not deleted. Account deletion cannot be undone by reactivating the account.

Processing normally starts within seconds, but complete chat cleanup takes longer for larger histories. Temporary failures retry automatically; the dashboard remains Pending until the required live-service cleanup succeeds. We do not show Complete merely because access was disabled. If progress is delayed, contact the administrator using your request reference.

What remains and for how long

• Employment records: necessary name/account linkage, past schedules, attendance and correction/audit facts remain for employment and tax recordkeeping. Precise clock coordinates and accuracy fields are removed during account cleanup. New Brunswick generally requires employment records for at least 36 months after the work; tax-supporting records generally require six years after the relevant tax year. Retained records are marked for review after the six-year period and are not automatically destroyed while a legal obligation or dispute requires them.
• Deletion evidence: a minimal account reference and deletion intent remain to prevent restored backups or old sessions from reactivating a deleted account. They do not contain a password or recovery key.
• Server cleanup: message redaction removes content from normal server responses. Physical removal of redacted event data follows the chat server’s maintenance retention, normally seven days. Necessary room/event identifiers can remain.
• Backups: daily recovery copies rotate on a 30-day schedule after a newer copy has been verified. A failed backup or a required legal hold can delay removal. Backups are not an ordinary way to access deleted account data; the current deletion ledger must be applied before restored services are reopened.
• Recipient copies: deletion cannot remotely erase another person’s screenshots, exports or already downloaded copies. The app signs the deleting account out locally. Previously downloaded history or device caches may remain until the app’s local data is removed; the service cannot remotely erase inaccessible devices on demand.

Access and correction

You can view your account, messages and available work records in M Crew and ask the administrator for access to or correction of company-held information. Attendance corrections are separate auditable records rather than silent edits to original clock facts. Signing out, uninstalling or ordinary account deactivation does not request deletion.

Material changes to this policy will be reflected here with an updated effective date. Questions about this policy can be sent to the contact above.

Installation · Administrator dashboard