Privacy Policy
What we process
- Account: username, email, password hash (we never store readable passwords).
- Watch settings: the location and radius you configure (a location you set yourself — not continuous GPS), filters, notification channels. Third-party tokens (Telegram, SMTP) are stored encrypted.
- Logbook: records of caught aircraft (type, time, aircraft position).
- Payments: handled by Stripe; card numbers never reach us. We keep a customer identifier and subscription state.
- Operational logs: IP address and technical logs for security and rate-limiting (short-term).
Why (legal bases)
Providing the Service (contract), sending alerts and digests you enable (contract / legitimate interest), securing the Service (legitimate interest), accounting (legal obligation), in-browser analytics (consent).
Cookies
Essential cookies are always used: the login session and CSRF protection. Your language choice and your analytics decision are stored locally in your browser (localStorage).
Analytics cookies are set by PostHog, and only after you consent. Until you decide, its script is not even loaded. You can withdraw consent at any time in Settings → Account → GDPR; withdrawing deletes those cookies. We use no advertising cookies at all.
Independently of consent we measure a few operational events on the server, tied to your account number (for example that you opened an alert). They do not leave the EU, are not used for profiling or advertising, and rest on our legitimate interest in keeping the Service working; you may object to it.
We do not track you
We do not link data from this app with third-party data for advertising, we share nothing with data brokers, and we show no ads. There is therefore no App Tracking Transparency prompt. In the iOS app, product analytics is switched off entirely — the analytics script is never loaded there.
Recipients
Stripe (payments), OpenFreeMap/CARTO (map tiles), Planespotters.net (aircraft photos), adsb.lol (flight data), our transactional email provider, PostHog (product analytics, EU hosting). Servers are located in the EU.
Retention
Data is kept while your account exists; the logbook and settings are deleted together with the account. Accounting records as required by law.
Your rights
Access, rectification, erasure (delete your account in Settings → Account or by email), portability (data export), objection, and complaint to the Czech DPA (uoou.gov.cz). Write to [email protected].