Privacy Policy

What we collect

• Location data. Used to show your position on the map, airspace nearby, and terrain, wind and weather relevant to your route. Your position and planned route are sent to our server to look up weather, wind, terrain, NOTAMs and traffic, and are passed on to those data providers without your identity or IP address. Apart from routes, waypoints and flight logs you choose to save to your account (see below), they are not stored with your account. They only appear in short-lived in-memory caches (from about an hour for wind up to about 37 days for terrain) and size-capped server logs. Those logs record only the requested path, not coordinates or other request details, and the client address logged is that of our internal proxy, not yours. We only see aggregate usage counts, never individual positions.
• Account data. If you sign in, we store your email address and the name you enter when you first sign in (in the web app; you can edit it in your profile). You sign in with a one-time code sent by email, or with a passkey. Each sign-in session also stores the IP address and browser or device type it was started from, for security and abuse prevention, until the session expires or you delete your account. To stop sign-in codes being used for spam, the server also counts code requests per email address and per IP address for 24 hours, in memory only.
• Synced data. When signed in, your routes, aircraft, waypoints, settings and flight logs are stored on our server so they sync between your devices. Routes, waypoints and flight logs can contain locations, so these are linked to your account until you delete them or your account.
• On your device. Recent wind and weather readings are cached locally (browser storage or app storage) and kept across restarts, and the app remembers whether your device's GPS altitude needed a sea-level correction. In the Android and iOS apps your sign-in token is kept in the system's secure storage (Keychain / Keystore), and the app's data is excluded from Android cloud backups. If you turn on Log simulated flights (for testing), those logs stay on the device and are never uploaded. Signing out deletes your account's data from the device. Nothing else personal is stored.
• Diagnostics. OpenVFR has no analytics or crash-reporting software. App stores (Google Play, Apple) may collect their own crash reports and statistics under their own policies.

Service providers

• Cloudflare hosts the web app, serves map tiles, and provides DNS and CDN in front of our API.
• Brevo sends sign-in emails, and therefore receives your email address.
• Microsoft Foundry (Microsoft Azure) runs the AI model that reads aircraft manuals (POH) you choose to import, to fill in an aircraft profile. Only the PDF goes there, sent by our server without your identity or IP address, and it is deleted from Microsoft's service right after processing. The extracted performance figures may appear in our size-capped server logs.
• jsDelivr (map fonts and symbols) and Esri (satellite tiles, only when you turn on the satellite basemap) are contacted directly by your device, so they can see your IP address.

What we don't do

We don't sell your data, run ads, or share your location or flight history with third parties for marketing purposes. OpenVFR has no commercial revenue model built on user data. We don't track you across other apps or websites, so no cross-app tracking prompt is shown.

Third-party data sources

The app displays aeronautical, weather, terrain, map and traffic data from third-party providers. Except for the two direct connections listed above, they are reached through our server and do not see your IP address. Their data is governed by their own terms. The full list, with licences and required notices, is on the Data credits page.

Your choices

You can disable location access at any time via your device settings; core map and airspace features will be limited without it. You can delete your account in the app (Profile → Delete account). We email a confirmation link, and once you confirm, your account and all saved data (routes, aircraft, waypoints, settings, flight logs) are permanently deleted. Step by step, and what is kept for how long (backups up to 30 days): Delete your account. You can also contact us on GitHub.

Children

OpenVFR is not directed at children and is not intended for use by anyone under 13.

Store privacy labels

The data categories declared in Google Play's Data Safety section and Apple's App Privacy (Nutrition Label) for OpenVFR reflect what's described on this page. If this policy changes, those declarations are updated to match.

Changes to this policy

We may update this policy as the app evolves. Material changes will be reflected here with an updated date.

Contact

Questions? Open an issue on GitHub.