Privacy Policy

Who is responsible for your data

The FlightTrove service-provider identity, address and privacy contact are listed on the Legal page.

Account and device information

FlightTrove uses Firebase Authentication for anonymous accounts and, where chosen, registered sign-in. We process the Firebase user identifier, account status, email and display name where supplied, versioned legal acceptance, and account lifecycle state.

We also process installation identifiers, device labels and app version, active-device state, push notification tokens, session generation and recent authentication/activity timestamps. These protect account ownership, bind physical actions to an active device, and deliver notifications.

Location

A fresh current-device location powers nearby Radar, visibility guidance, Best Next Sighting and authorization of a physical Spot. Ordinary current context expires after a short freshness window. FlightTrove V1 does not continuously collect background location by default and does not keep a location trail.

If you explicitly start an Active Spotting Session, the app can keep the current-device location fresh in the background for up to two hours. You can stop it at any time. Extension is explicit, resets the two-hour limit, and is never automatic.

Optional saved alert locations are durable remote contexts for alerts and read-only Radar. They do not represent your current presence and can never authorize a Spot. The freshest current-device location always controls physical actions.

Spots, collection and personalization

We process the Spots you manually confirm, aircraft identity and observation references, time, optional note or photo reference, coarse spatial evidence, and collection progress. A Spot is never generated merely because an aircraft was nearby.

Favorites, saved locations, alert categories, quiet hours, notification preferences, opportunity decisions and collection history are used to personalize discovery and alerts. Subscription state and Google Play purchase evidence determine server-authoritative Free or Plus capabilities.

Support, security and operations

If you contact support, we process the contact details and message you provide to investigate and respond. Operational and security logs may contain bounded identifiers, timestamps, request outcomes and diagnostics. Metrics should not contain precise coordinates or secrets.

Purposes and legal bases

The principal processing activities, purposes and legal bases are mapped below. Contract means processing needed to provide the FlightTrove service you request. Consent is used where stated and can be withdrawn. Legitimate interests mean the proportionate interests in securing, operating and improving the service, subject to your rights. Legal obligation applies only where law requires evidence to be kept.

You can deny location permission. Account management, Favorites, history and subscription controls remain available, while current-location discovery and physical Spot confirmation pause until a fresh authorized location is available. Notification permissions and categories can also be changed.

• Account and authentication — create and secure your account, sign you in and manage its lifecycle; contract.
• Device and session security — bind actions to an active installation, prevent abuse and investigate incidents; contract and legitimate interests.
• Current precise location — provide nearby discovery and authorize physical Spots when you request location features; contract, with your device permission.
• Active Spotting Session — keep current location fresh for the explicitly started, time-limited session; contract, with your device permission.
• Saved alert locations — provide remote Radar and alerts at places you choose; contract.
• Confirmed Spots and collection — save manual observations and collection progress; contract.
• Favorites and personalization — apply preferences and rank relevant opportunities; contract.
• Push notifications — deliver categories you enable; consent/device permission, withdrawable in app or system settings.
• Google Play subscription and billing evidence — verify entitlements and handle purchase-related records; contract and, for records law requires, legal obligation.
• Security and operational logging — keep the service reliable, diagnose failures and prevent misuse; legitimate interests.
• Support contact — investigate and answer your request; contract or steps requested by you, and legitimate interests in support and security.
• Optional website Analytics — understand website use; consent only.
• Legal acceptance and compliance evidence — record the version and time of required acceptances and retain mandatory evidence; contract and legal obligation.

Website analytics and cookies

Only if you choose “Allow analytics”, FlightTrove uses Google Analytics 4 through the Firebase Analytics web integration. It may process page views, session and use information, traffic or referrer information, browser/device category, approximate geographic information, and first-party analytics identifiers or cookies. We do not claim this information is anonymous.

Analytics is optional and is off by default. You can refuse it without losing access to the website, or change your choice at any time through “Cookie settings” in the footer. If you withdraw consent, we disable further Analytics collection and remove the first-party Analytics cookies we can control.

• flighttrove-cookie-consent (localStorage) — FlightTrove; remembers the versioned analytics choice; expires after 183 days, after which a new choice is requested.
• _ga — Google Analytics; distinguishes analytics clients after consent; typical maximum lifetime: 2 years.
• _ga_<measurement-id> — Google Analytics; maintains analytics session state after consent; typical maximum lifetime: 2 years.
• Firebase Authentication browser storage on Delete account — Firebase Authentication; maintains the temporary authenticated deletion session; browser-session scoped and cleared when the session ends under the configured SESSION persistence.

Service providers and recipients

FlightTrove currently relies on Google Firebase Authentication and Firebase Cloud Messaging; Google Analytics 4 / Firebase Analytics only where you consent; Cloudflare for website delivery, CDN, network security and related request handling; aircraft observation and reference-data providers; OpenStreetMap standard tiles for maps; Google Play Billing if purchases are enabled; and infrastructure providers used to operate the API, database, queues and cache.

We do not sell personal data. This website does not use advertising or marketing trackers, and analytics consent does not enable advertising storage, ad user data, or ad personalization.

Retention and deletion

Current hot location and push state is short-lived and is cleared or invalidated on relevant session, device and account events. Favorites, preferences, saved locations, Spots and collection data remain while the account exists unless removed earlier through product controls.

When you delete an account, FlightTrove removes account-owned product data and purges rebuildable runtime projections. A registered Firebase identity is deleted after the server-side deletion succeeds. A minimal deletion marker and pseudonymized billing, legal or security evidence may be retained where required or justified under applicable law.

Deleting a FlightTrove account does not cancel a Google Play subscription. If billing is still active or otherwise financially relevant, FlightTrove warns you before deletion and links to Google Play subscription management. You may still delete the account without cancelling the subscription.

Backups are not claimed to be erased instantly. They are handled on a separate, documented lifecycle and deleted data is not restored into the active service from backups.

International transfers

Some providers may process data outside Hungary or the European Economic Area. Where a restricted international transfer occurs, FlightTrove uses the transfer mechanism and supplementary safeguards required by applicable data-protection law. Provider roles and safeguards are assessed for the service and processing concerned.

Your rights

Under applicable data-protection law, you may request access, correction, deletion, restriction, portability, or object to certain processing. Where processing relies on consent, you may withdraw it without affecting earlier lawful processing. You may complain to the competent supervisory authority; in Hungary this is the Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH), whose official website and contact routes are at https://www.naih.hu/.

Use the privacy contact on the Legal page. We may need to verify that you control the relevant account before acting. FlightTrove does not offer an email-only deletion endpoint because an email address alone is not sufficient proof of account ownership.

Children and policy changes

FlightTrove is intended for users aged 16 or older. Material policy changes will be published at this stable URL with a new effective or updated date; where required, the app will request a new acknowledgement.