Privacy Policy

Who is responsible for your data

FlightTrove is operated by the service provider named on the Legal and provider information page. That page contains the operator name, address, applicable registration and tax details, telephone number, and the support and privacy contacts.

Use the privacy contact for privacy requests and the security contact for security reports. Before we disclose or change account data, we may ask you to verify that you control the account concerned.

Where data comes from

We receive data directly from you, from your device and application, from Firebase Authentication and Google sign-in where used, from Google Play for subscription status, and from technical service providers needed to operate the service.

Aircraft positions, identities and related reference information come from aviation-data providers and public/reference sources. Those aircraft datasets are not treated as proof about the identity, itinerary or conduct of any natural person.

Your account and device

FlightTrove uses Firebase Authentication for anonymous accounts and, if you choose it, permanent sign-in. We process the Firebase user ID, account type and status, supplied email address and display name, confirmed legal country/profile, versioned Terms acceptance and Privacy acknowledgement, and account-lifecycle information.

We also process the installation ID, device label and platform, app version, active-device and Active Spotting Session state, authentication/activity times, push token and delivery state. These details help protect the account, apply device limits, deliver notifications and stop an old session from acting as the current device.

Before you confirm your legal country, Google Play storefront country can be used only as a temporary routing hint. It is not kept as the durable proof of your legal country; the durable record stores your own confirmation.

How location works

A fresh device location is used for nearby Radar, visibility guidance, Best Next, immediate location-based alerts and checking whether a physical Spot can be confirmed. An old location stops being usable for current actions well before the stored coordinates are removed.

For current-device location, FlightTrove keeps only the latest accepted position, not a continuous route or location history. If no new location arrives for 24 hours, scheduled cleanup clears the current latitude/longitude and related accuracy/source fields. Confirming a physical Spot requires a much fresher location than that.

If you start an Active Spotting Session, the app can refresh your current location for up to two hours as part of a user-initiated temporary location session, including while the app is not in the foreground. You can stop it at any time. Extending the session is always an explicit action and starts a new two-hour limit.

If you enable nearby-alert continuity, FlightTrove can keep one temporary alert area derived from your last accepted location so nearby alerts can remain relevant after you leave the app. This is not route tracking, does not prove that you are still there and can never authorize a physical Spot. The default period is 24 hours, but you can turn the feature off or choose 2, 8, 24 or 72 hours; the area can never remain active for more than 72 hours after the real source location. FlightTrove may send a reminder before expiry. “Keep watching” does not collect a new location, while “Update area” requests a new current location from the device.

Saved alert locations are durable places you explicitly choose to monitor for alerts and read-only Radar. They do not mean you are physically there and can never authorize a physical Spot. They remain until you remove them or delete the account.

To estimate nearby weather conditions, FlightTrove may send WeatherAPI.com a coordinate representing a larger area instead of your precise location. We do not attach a FlightTrove account, device or aircraft identifier. Weather only helps estimate and rank expected spotting conditions; it does not prove your presence and can never authorize a physical Spot.

Spots, collection and recommendations

We process the Spots you manually confirm, aircraft and observation references, spotting time, an optional private note, coarse spatial/evidence context and collection progress. FlightTrove V1 does not provide photo upload for Spots. A nearby aircraft never creates a Spot by itself.

Favorites, saved alert locations, alert categories, quiet hours, notification preferences, opportunity decisions and collection history help personalise discovery, rankings and alerts. Ranking can consider factors such as Favorites, what is new to your collection, distance, timing, visibility and prediction confidence.

These recommendations do not make legal or similarly significant decisions about you. FlightTrove does not use the kind of solely automated high-impact decision-making described in GDPR Article 22 for account eligibility, employment, credit, insurance or similar decisions.

Subscriptions and billing

Google Play processes Plus purchases and supplies FlightTrove with purchase/subscription evidence needed to verify entitlement, such as product/base-plan/offer identifiers, purchase-chain information, subscription state, renewal state and relevant timestamps. Purchase tokens are encrypted while operationally needed for verification and are not exposed to other users.

Before a new Plus purchase is handed off to Google Play, FlightTrove records a minimal confirmation that the purchaser states they are at least 18 and requests immediate Plus activation after Play verification. We do not collect date of birth for this purpose.

Deleting a FlightTrove account does not cancel a Google Play subscription. Before deletion we provide a route to Google Play subscription management, but account deletion remains available.

Support, email, security and operations

If you contact support, privacy or security, we process the contact details, message content and attachments you choose to provide so that we can investigate and respond. FlightTrove domain addresses are routed through Cloudflare Email Routing to a Google-hosted mailbox used for FlightTrove correspondence.

Operational and security logs may contain bounded identifiers, timestamps, request outcomes and diagnostics. Production container logs are size-rotated. Product telemetry is designed not to include precise coordinates, authentication secrets or free-text personal notes.

Partner applications and sponsored challenges

FlightTrove may show clearly labelled aviation-community partners and sponsored challenges. We do not use third-party ad networks, advertising SDKs, advertising IDs, behavioural advertising or advertising tracking. A partner cannot change Radar data, alerts, aircraft ordering, Best Next recommendations, Spot rules, collection correctness or subscription access.

If you send a partner application, we process the organisation name, contact name and email, optional phone number, website, country, preferred language, requested campaign details, any budget range you provide, your message, submission source and the Privacy Policy acknowledgement time. We use these details to review and administer the partnership request. Sending the form does not create a listing or campaign.

Partner reporting is limited to aggregate challenge-page views, participant counts, badge awards and external partner-link clicks. We never provide partners with user IDs, participant lists, location, Favorites, Spot records, personal notes or user-level profiles.

Why we use each type of data

When we say contract, we mean processing needed to provide a FlightTrove feature you ask for. Consent is used only where stated and can be withdrawn. Legitimate interests cover proportionate needs such as securing, operating, diagnosing and protecting the service. Legal obligation applies only where the law requires us to keep or use a record.

Some information is necessary for a feature to work. Account-backed features need an authenticated account ID; protected account use needs a confirmed legal country and current legal acceptance; Plus needs Google Play purchase evidence. Precise location is optional overall, but current-location Radar, immediate location-based alerts and physical Spot confirmation cannot work without a sufficiently fresh permitted location.

• Account/authentication and legal context — create, secure and administer the account and legal relationship; contract and, for compliance evidence where applicable, legitimate interests/legal obligation.
• Current precise location and Active Spotting Session — provide requested nearby/location features and authorize physical Spots; contract, with Android location permission and your explicit session action where background refresh is used.
• Nearby-alert continuity — provide the enabled feature from one time-limited area derived from the last accepted location; contract. The underlying current location requires Android location permission, reminder delivery requires notification permission, and the continuity feature can be turned off in the app.
• Coarsened geographic weather query — obtain a nearby forecast for the requested visibility estimate and spotting recommendation; contract. The query does not contain a FlightTrove account, device or aircraft identifier.
• Saved alert locations, Favorites, confirmed Spots, personal notes and collection — provide the features you choose; contract.
• Personalized ranking and opportunity recommendations — rank relevant spotting opportunities; contract.
• Push notifications — deliver the notification categories you enable; consent/device permission and contract for requested alerts, withdrawable in app or Android settings.
• Google Play subscription processing — verify, provision, reconcile and support Plus; contract and applicable accounting/consumer-law obligations.
• Security and operational logging — prevent abuse, investigate failures and protect service integrity; legitimate interests.
• Support/privacy/security correspondence — answer requests and protect the service; steps requested by you, contract, legal obligation where applicable, and legitimate interests.
• Partner applications and sponsored challenge administration — review and administer partnership requests, orders and campaigns; steps requested before a potential contract, contract where a partner order exists, legitimate interests in operating a reviewed community-partner programme, and legal obligation for accounting/tax records where applicable.
• Optional app telemetry and website Analytics — product analytics, crash diagnostics and performance monitoring only after the relevant optional choice/consent; consent.
• Legal acceptance evidence — prove which Terms/Privacy versions were presented and accepted/acknowledged; contract, legitimate interests in demonstrating compliance and legal obligation where applicable.

Optional analytics and diagnostics

Firebase Analytics, Crashlytics and Firebase Performance Monitoring in the app are behind FlightTrove's optional telemetry setting and stay off until you enable it. If the preference cannot be read or saved safely, collection remains off. You can turn it off again at any time.

The website uses Google Analytics 4 only after you choose “Allow analytics”. You can use the site without analytics. Withdrawing consent stops future collection and removes the first-party analytics cookies that FlightTrove can control.

Firebase Remote Config is functional infrastructure used to retrieve service-availability and maintenance settings. FlightTrove does not use it for advertising.

• Google Analytics / Firebase Analytics user- and event-level retention: configured to 2 months for FlightTrove properties.
• Firebase Crashlytics: provider retention for crash traces and associated installation identifiers is 90 days before removal begins.
• Firebase Performance Monitoring: provider retention is 30 days for IP-associated events and 60 days for installation-associated/de-identified performance data before removal begins.
• flighttrove-cookie-consent (localStorage): remembers the versioned website analytics choice for 183 days.
• _ga and _ga_<measurement-id>: Google Analytics first-party analytics identifiers used only after website consent; provider/configuration lifetime may be up to 2 years even though FlightTrove configures user/event-level Analytics retention to 2 months.

Who receives data

FlightTrove uses service providers for specific operational purposes. They may process the technical identifiers and network information needed to provide their service. We do not sell personal data and we do not use advertising or marketing trackers.

Aircraft-data providers may receive the geographic coordinates or area needed for an aircraft-data query. Those requests do not include your FlightTrove account ID.

WeatherAPI.com receives a coordinate representing a larger area and technically necessary network data so it can return a nearby weather forecast. The request does not include a FlightTrove account, device or aircraft identifier.

• Google/Firebase — Authentication, Google sign-in integration, Cloud Messaging, Remote Config and, only when optional telemetry is enabled, Analytics, Crashlytics and Performance Monitoring.
• Google Play — billing, subscription lifecycle, purchase verification and subscription management.
• OVHcloud — production VPS and server infrastructure in Poland.
• Cloudflare — website/CDN/network security and inbound Email Routing for FlightTrove domain contact addresses.
• Google-hosted Gmail — receiving and handling FlightTrove support, privacy and security correspondence routed from the FlightTrove domain.
• OpenStreetMap standard tile service — map tiles; tile requests necessarily expose normal network request information such as IP address to the tile service.
• Reviewed aircraft observation/reference-data providers — supply aircraft and flight information used by Radar and prediction features.
• WeatherAPI.com — supplies a weather forecast from a coarsened geographic query for visibility estimates and spotting-condition ranking.
• Approved aviation community partners — receive only public disclosure placement and aggregate campaign totals for their own approved campaign; no personal-data export or participant list is provided.

How long we keep data

Different data needs different retention because current location, product history, legal evidence and billing evidence serve different purposes. Deleting your account removes account-owned product data; limited pseudonymous evidence can remain only for the periods and reasons listed below.

Where a provider has its own shorter or service-specific deletion cycle, that cycle also applies. We do not intentionally restore deleted live data from a backup back into the active service.

• Latest current-device coordinates: cleared from the live database after 24 hours without a new received location, subject to the scheduled cleanup interval.
• Temporary area kept for nearby-alert continuity: automatically expires and is deleted at the end of the selected 2, 8, 24 or 72-hour period and can never remain active beyond 72 hours after the real source location. Turning continuity off also removes it.
• WeatherAPI.com forecast and its coarsened query area: only in a reusable time-limited cache, for no more than 24 hours. Durable recommendation history may retain only FlightTrove-derived visibility classifications, explanatory factors, freshness state and provider attribution; it does not retain concrete provider forecast measurements, the raw provider response or query coordinate.
• Temporary delivery records that contain location: coordinates are kept only while needed for reliable delivery or retry. After successful delivery or a terminal failure, the coordinates are removed. The remaining coordinate-free technical metadata can be kept for up to 7 days after successful delivery, or up to 30 days from event creation for a terminal failed event.
• Device installation and push token: kept while the device remains active; a device with no relevant activity for 90 days is deactivated and its push token/current-location fields are cleared.
• Notification history/audit rows: 90 days.
• Favorites, saved alert locations, preferences, Spots, personal notes and collection data: until you remove them where the product provides that control, or until account deletion.
• Pseudonymous deleted-account recreation tombstone: 180 days.
• Registered-account legal acceptance evidence after account deletion: up to 5 years; anonymous/guest legal evidence is deleted with the guest account.
• Abandoned Plus purchase eligibility confirmation: if no purchase completes, the plan-bound 18+ and immediate-performance confirmation is deleted after 7 days. If a purchase completes, the minimum confirmation evidence is attached to the Google Play purchase-chain evidence and follows the billing-evidence lifecycle below.
• Google Play purchase-chain evidence: retained while linked to an account where needed for subscription verification, entitlement, restore and support. After account deletion it is detached/pseudonymized while the chain remains active or financially relevant; once terminal and no longer linked to an account, bounded retention is 8 years. Short-lived RTDN transport/deduplication receipts are retained for 90 days.
• Partner applications that do not become an order: 730 days after the application record was last updated.
• Sponsor orders, invoices and contract/audit evidence: retained for the accounting, tax, contract-performance and claim-limitation periods that apply to the relevant record, then reviewed for deletion or minimisation when no longer required.
• Sponsor aggregate daily metrics: normally 1095 days for campaign reporting, trend review and dispute handling; they do not contain user identifiers.
• Support/privacy/security correspondence: normally up to 24 months after the matter is closed, unless longer retention is needed for an unresolved dispute, security incident or legal obligation.
• Local PostgreSQL disaster-recovery dumps: 14 days. The production backup script automatically removes expired local dumps after a successful backup.
• OVHcloud Standard Automated Backup: one daily VPS backup retained for 24 hours. OVHcloud exports this backup to separate servers in its infrastructure and replicates it within the same datacentre. A manual VPS snapshot is an operational restore point and FlightTrove policy requires it to be removed within 7 days after the maintenance/change it protects has stabilized.

What happens when you delete your account

When you delete an account, FlightTrove removes the product data owned by that account and clears rebuildable runtime data, including current-device location, Active Spotting Session state, any temporary area kept for nearby alerts and saved alert locations. For a registered account, the Firebase identity is deleted after server-side deletion succeeds. If a limited account record must remain for legal evidence, it is anonymised and direct identifiers such as email and display name are removed.

Billing ownership is detached from the deleted account and purchase tokens are redacted from deleted-account processing rows. Minimal purchase-chain evidence may remain for late Google Play lifecycle events and legitimate restore, subject to the retention limits above.

OVHcloud automated backups rotate after 24 hours, so recently deleted information can temporarily remain in a disaster-recovery copy after it is gone from the live database. Manual snapshots follow the separate seven-day operational rule and are not used as an undeclared archive.

International transfers

Some providers may process personal data outside the EEA or make it accessible from outside the EEA. Where a restricted transfer occurs, FlightTrove relies on an applicable lawful transfer mechanism, such as an adequacy decision or approved contractual safeguards including the European Commission's Standard Contractual Clauses, with supplementary measures where appropriate.

Information about the safeguards relevant to a particular provider, and a copy or reference where legally available, can be requested through the privacy contact on the Legal information page.

Your privacy rights

Subject to applicable law, you may request access, correction, deletion, restriction, portability, or object to processing based on legitimate interests. Where processing relies on consent, you may withdraw it at any time without affecting processing that was lawful before withdrawal.

You may lodge a complaint with a competent supervisory authority, including in the EEA country of your habitual residence, place of work or the alleged infringement. FlightTrove's controller is established in Hungary; the Hungarian supervisory authority is the Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH).

Use the privacy contact on the Legal information page. FlightTrove does not treat an unverified email address alone as sufficient proof of account ownership for destructive or disclosure requests.

Age limits and policy changes

FlightTrove is intended for users aged 16 or older. Plus purchase is restricted to users who confirm they are at least 18. FlightTrove V1 is not directed to children under 16.

Material Privacy Policy changes are published with a new version/effective date. Where required, the app requests a new acknowledgement before protected account use continues.