Privacy Policy
ContractForce · World Encouraged LLC · Effective 5 September 2026
Who we are
ContractForce is published by World Encouraged LLC, 784 S Clearwater Loop Ste B, Post Falls, ID 83854, USA. Questions: contractforceapp@gmail.com.
ContractForce is not affiliated with, endorsed by, or authorized by AFA-CWA, United Airlines, or any airline or labor organization. It is an independent tool.
No account, no sign-up
You do not create an account, and the app never asks for your name, employee number, email address, or password. There is nothing to log into. (The one exception lives on this website, not in the app — see the mailing list below.)
Why we collect anything at all
There are two reasons, and there is no third one.
- To answer your question. Moxie cannot answer a question she has not been sent. That is the whole of it.
- To keep the app and Moxie working properly. When you choose to send feedback, or when something breaks, we find out what to fix.
Neither reason requires knowing who you are, so we never ask. No name, no employee number, no email address, no base, no seniority, no location, no advertising identifier. There is no account to create and no profile to build. Nothing we keep is about you as a person — it is about whether the app worked.
About the word "analytics" on the app store label. Apple and Google both use that single word to cover any use of data to improve a product, including reading the feedback you deliberately sent us. Because reason 2 above is exactly that, we declare it on both store forms rather than reaching for a narrower word that might technically let us avoid it. It does not mean anyone is watching what you do. There is no analytics SDK in this app, no session recording, no third-party tracker, and no measurement of which screens you open or what you tap. Everything that leaves your phone is listed below, field by field, so you can check that for yourself instead of taking our word for it.
What stays on your phone
Stored only in the app's storage on your own device. We cannot see any of it.
- Anything you type into your notes, grievance drafts and saved grievance sheets
- Optional details you choose to enter about yourself, such as base or seniority
- Your crew list entries and any photos you add to them
- App settings, such as your Lineholder or Reserve selection and saved time-zone cities
Deleting the app removes all of it. You can also clear saved grievances from inside the app, and export a copy for your own records.
What leaves your phone
| What | Why | Who receives it |
|---|---|---|
| The text of your conversation with Moxie | To generate an answer. There is no way to answer a question without sending the question. | Our server, then Anthropic PBC, our AI provider |
| A random subscription identifier | To count your monthly deep-dive allowance. It is not tied to your name or your airline. | Our server |
| Your IP address | Automatically, as with any website, to stop abuse and rate-limit requests. Kept briefly, then discarded. | Our server |
| Feedback you send from the Moxie Feedback screen | So the app can be improved. Never automatic — it leaves your phone only when you tap Send feedback. Written out in full below. | Our server |
| A crash code, if something breaks | So we find out the app is failing. See "When something goes wrong" below — you can switch this off. | Our server |
We do not store the content of your conversations with Moxie. Our server passes them to the AI provider and keeps only a record of how much the request cost, so your allowance can be counted. Feedback is the one exception, and only because you chose to send it — feedback that is thrown away is not feedback, so it is kept. Exactly what is kept, and for how long, is set out in full below. Anthropic's handling of API data is described at anthropic.com/legal/privacy.
Please do not type anything into Moxie that you would not want leaving your phone — including another person's name, or anything a third party told you in confidence.
What we never collect
- Your location
- Your contacts. The app can hand a crew member's details to your phone's own "new contact" screen when you ask it to, but it never reads your contact list.
- Your photos. You pick an image, it is stored on your device, and it is never uploaded.
- Advertising identifiers. There are no ads, and no ad networks.
- Behavioral tracking of any kind. We do not measure which screens you visit, how long you stay, what you tap, or what you search for. There is no analytics SDK, no session recording, and no third-party tracker in this app, and nothing watches you in the background. What the app reports about itself is narrow: a crash code when something actually breaks, and the feedback you deliberately chose to send. Each is listed in full below.
- Your payment details. Subscriptions are handled entirely by Apple or Google. We never see your card.
When something goes wrong
If the app fails — a screen goes blank, Moxie times out, a purchase does not complete — it sends a short report so the problem can be found and fixed. It is sent automatically, unlike feedback, which never leaves your phone unless you tap Send.
Here is the entire report. Nothing else is sent.
| Field | Example |
|---|---|
| A code naming what broke | moxie_timeout |
| Which screen you were on | contract-check |
| An error number, if there was one | 504 |
| Your app version and phone's OS version | 1.0.0, iOS 18.2 |
| A random number that lasts until you close the app | s_m4k2p9 |
The code is picked from a fixed list of about twenty words that we wrote. The app cannot invent a new one, and our server refuses any report whose code is not on that list. That is deliberate: it means there is no field in a crash report capable of holding a sentence, so there is no way for something you typed to end up in one, even by mistake.
What is never in a crash report: your questions to Moxie, her answers, your grievance drafts, your notes, your crew list, your name, your employee number, your base, your email, your location, or any identifier that follows you between sessions. The random number in the table above is created fresh every time you open the app and is gone when you close it — it exists so we can tell one phone failing ten times from ten phones failing once, and it cannot be used to recognise you on a later day or to link a crash to your subscription.
Crash reports are counted, not stored one by one. Our server keeps a running total per day per code — "eleven timeouts today" — for thirty days, and then that number disappears. There is no list of individual reports to look through, hand over, or lose.
You can turn this off. Settings › Send crash reports. It is on when you install the app, and turning it off stops the reports immediately. Everything else in the app works exactly the same either way.
Settings also has Copy diagnostics, which puts the last twenty of these codes from your own phone onto your clipboard so you can send them to us if you want to. Nothing is sent unless you paste it somewhere yourself, and it contains the same codes and nothing more.
The feedback you choose to send
The Moxie Feedback tab lets you tell us what is working and what is not. Nothing on that screen is ever sent automatically. It leaves your phone only when you tap Send feedback.
Here is everything that is sent. Nothing else.
| What | Example |
|---|---|
| An overall rating | good, mixed or bad |
| Which topics you marked as working | right_section |
| Which topics you marked as needing work | pay |
| How she got it wrong, if you said so | too_vague |
| Your note, if you wrote one | up to 500 characters, in your own words |
| Your app version | 1.0.0 |
| A random number that lasts until you close the app | s_m4k2p9 |
Every field except the note is picked from a fixed list of words that we wrote, and our server refuses any value that is not on that list. Your conversations with Moxie are never sent here. There is no code in the app capable of attaching them. That is also why the screen offers to let you email a specific chat instead — that goes from your own mail app, and never passes through our server at all. You can do the same from here: show us an actual chat.
What is kept, and for how long. The tap-only answers become counts rather than records — “eleven people said pay is working this week.” Those counts are kept for 120 days and then disappear. Notes are kept separately: the most recent 200, for up to a year. Each note is stored with the date it was sent and nothing else. It is not attached to your random number, your subscription, or any other feedback you have sent, so there is no way to group your notes together or trace one back to you.
The random number does exactly one job: it lets us estimate roughly how many different people said the same thing, so that one person sending ten messages does not look like ten people. It is stored using a method that keeps a mathematical summary instead of a list, so it can answer “about how many?” and can never answer “which ones?”. It is created fresh every time you open the app and is gone when you close it.
The note box is the only place in the whole app where something you type is kept. We ask you on that screen and we ask you again here: please leave out names, employee numbers, and anything a third party told you in confidence. We cannot reliably detect those and we do not try, so the only real protection is that you do not type them.
Sending feedback is entirely optional. The app works identically whether you ever open that tab or not.
Permissions the app may ask for
- Photos — only when you add a picture to a crew entry. The image stays on your device.
- Contacts — only when you tap to save a crew member to your phone. The app fills in your phone's own contact form and you confirm it.
You can decline either one and keep using everything else.
The mailing list on this website
Our support page has an optional sign-up for contract updates. It is the only place we ever ask you for anything, and it is on this website, not in the app — the app never asks for your email and never sends one.
- If you sign up we store the email address you type, and nothing else. No name, no base, no employee number.
- It is used only to send occasional notes about contract changes and new features.
- It is never sold, never shared, and never used for advertising.
- Every email has an unsubscribe link, and you can ask us to remove you at any time.
- The form is handled by Kit, our email provider. Your address is stored with them and nowhere else. No script from Kit runs on this website — the signup box is a plain form, so nothing from them is loaded into the page you are reading.
- You will get one email asking you to confirm. Nothing is ever sent until you click that link, and if you never click it your address is never used.
Signing up is entirely optional. Not signing up changes nothing about the app.
We do not sell or share your data
We do not sell personal information, we do not share it for advertising, and we do not disclose it to your employer, your union, or anyone else — except where we are legally required to, or where it is necessary to protect someone's safety.
Children
ContractForce is a professional tool for working flight attendants and is not directed to children under 13. We do not knowingly collect information from children.
Your choices
- Delete everything by deleting the app, or by clearing saved items inside it.
- Export your saved grievance sheets and notes at any time.
- Ask us anything about this policy at contractforceapp@gmail.com.
Because we hold no account and no name for you, there is generally nothing on our servers to look up, correct, or delete. The one thing we do keep is a feedback note, if you chose to write one — and because it is stored with only a date and nothing that points back to you, we cannot find yours by searching for you. If you want a note removed, email us and quote enough of it that we can recognise it, and we will delete it.
Changes
If this policy changes we will update the date at the top, and note anything significant in the app. Continuing to use ContractForce after a change means you accept the updated policy.