Privacy Policy
Version 3.0 · Last updated 27 October 2026
Previous version: 31 July 2026. Summary of changes at the end of this page.
This policy explains how FlightBrief handles your personal data on the website flightbrief.io, in the iOS app and in the Android app (the "Service"). It is designed to meet the information requirements of the EU General Data Protection Regulation (GDPR, Articles 13 and 14) and the Danish Data Protection Act. For the nature and limitations of the Service, see our Terms of Service.
In plain language: what we collect, why, who helps us, how long we keep it, and what you can do about it.
1. Who is responsible (the controller)
Alexma, trading as FlightBrief
CVR 30954580
Markkrogen 8, 2860 Søborg, Denmark
Email: hello@flightbrief.io(use "Privacy" in the subject line)
We have not appointed a Data Protection Officer because we are not required to.
2. The data we collect
| Category | What | Where it comes from | Platforms |
|---|---|---|---|
| Account data | Email address, password (stored only as a secure hash by our authentication provider), account ID, sign-up date | You | Web, iOS, Android |
| Profile data | Display/first name, airline/operator, fleet, unit preference, plan, subscription or licence status, Fleet Commander role | You, your Fleet Commander or operator (for licences), our payment providers (for plan status) | All |
| Flight-preparation data | OFP images you upload or photograph; the values read from them (e.g. registration, route, times, weights, fuel, alternates, and crew names or IDs if they appear on the OFP); generated briefings, verdicts and passenger cards; weather preferences | You; AI processing | All |
| Fleet content | Aircraft profiles and limits you add; crew notes (with you as author); approval decisions | You | All |
| Purchase data | Plan, price, currency, renewal dates, transaction and subscription IDs, store (Stripe, App Store, Google Play), test/live environment. We never receive full card details. | Stripe, Apple, Google via RevenueCat | All (per store) |
| Consent records | Which Terms/statement version you accepted, when, and your browser/app user agent; marketing opt-in and its version | You | All |
| Sign-up and reset security data | Web: a Cloudflare Turnstile token and your IP address. iOS: an Apple App Attest key and assertion. Android: a Google Play Integrity token and verdict. Throttling: one-way hashes of IP address and email address | Your browser or device, Cloudflare, Apple, Google | Per platform |
| Technical and log data | IP address, device and browser type, app version, timestamps, error logs | Automatically | All |
| Analytics data (only with consent) | Pages visited, approximate location, device and browser data, a cookie ID | Google Analytics, only if you click "Accept" | Web only |
| Marketing leads | Email address you enter in a "notify me"/offer banner before you have an account | You | Web |
| Support correspondence | Emails you send us and our replies | You | All |
We do not collect your location, contacts, health data or advertising IDs, and we do not sell personal data or use it for third-party advertising.
3. Why we use it and our legal basis
| Purpose | Data | Legal basis (GDPR Art. 6) |
|---|---|---|
| Create and run your account; provide briefings, passenger cards, offline copies; enforce plan limits | Account, profile, flight-preparation, fleet content | Contract (6(1)(b)) |
| Read OFPs and write briefings with AI | OFP images, extracted values, briefing text | Contract (6(1)(b)) |
| Take payment and unlock your plan across platforms | Purchase data, account ID | Contract (6(1)(b)) |
| Share your name/email and crew notes with your company (section 7) | Profile, fleet content | Contract (6(1)(b)) and our and your company's legitimate interest in shared fleet data (6(1)(f)) |
| Stop fake sign-ups, bots and abuse at sign-up and password reset; keep the Service secure | Security data, logs | Legitimate interest in protecting the Service (6(1)(f)) |
| Keep proof of what you accepted | Consent records | Legal obligation / legitimate interest in proving the contract (6(1)(c) and (f)) |
| Bookkeeping and tax | Purchase data, invoices | Legal obligation (6(1)(c)), Danish Bookkeeping Act |
| Transactional emails (sign-up, password reset, receipts, important service and Terms changes) | Contract (6(1)(b)) | |
| Marketing emails (product news, offers) | Email, name | Consent (6(1)(a)); off by default, withdraw at any time |
| Web analytics | Analytics data | Consent (6(1)(a) and the Danish cookie rules); off until you accept |
| Answer support requests | Correspondence | Contract or legitimate interest (6(1)(b)/(f)) |
| Defend or bring legal claims | Relevant records | Legitimate interest (6(1)(f)) |
Where we rely on legitimate interest you can object (section 11). Where we rely on consent you can withdraw it at any time without affecting earlier processing.
The advisory statement you accept at sign-up is part of our contract with you. It is not "consent" in the GDPR sense.
4. Who we share data with (processors and providers)
We use the following providers. Processors handle data only on our instructions under a data processing agreement. Apple and Google act partly as independent controllers for their store and account services.
| Provider | Role | Data | Location | Transfer safeguard |
|---|---|---|---|---|
| Supabase, Inc. | Database, authentication, file storage | All account and service data | EU (Ireland, eu-west-1) | Data stored in the EU; SCCs / EU-US DPF for any access from outside the EU |
| Vercel Inc. | Web hosting and server functions | Requests, IP address, logs | Functions in EU (Dublin); edge network global | EU-US DPF / SCCs |
| Anthropic, PBC | AI reading of OFP images; generating briefing and passenger text | OFP images (which may contain crew names/IDs), extracted values, briefing text | USA | EU-US DPF and/or SCCs. Not used to train models. Anthropic keeps API data only for a limited period under its commercial terms, then deletes it. |
| Stripe (Stripe Payments Europe Ltd.) | Web payments, Customer Portal | Email, purchase data, payment details | EU/USA | SCCs/DPF |
| RevenueCat, Inc. | Processes in-app purchases on iOS and Android | Account ID, purchase and subscription data, store, environment | USA | EU-US DPF / SCCs |
| Apple | App Store, In-App Purchase, App Attest | Purchase data (Apple), device attestation key/assertion | USA/EU | Apple's terms; DPF |
| Google Play Billing, Play Integrity, Google Analytics (with consent) | Purchase data, integrity token and verdict, analytics data | USA/EU | Google's terms; DPF / SCCs | |
| Cloudflare, Inc. | Turnstile bot check on web sign-up and password reset | IP address, browser signals | Global | EU-US DPF / SCCs |
| Resend (Plus Five Five, Inc.) | Sending emails | Email address, email content | EU (Ireland, eu-west-1); US company | EU-US DPF / SCCs |
| SkyLink API | Weather, METAR/TAF, SIGMET, NOTAM, ADS-B, aircraft data | Airport/route identifiers only - no personal data | Not applicable (no personal data is sent) | Not applicable |
| Aviation Edge | NOTAM data | Airport identifiers only - no personal data | Not applicable (no personal data is sent) | Not applicable |
| NOAA aviationweather.gov (US government) | Weather data | Airport identifiers only - no personal data | USA | Not applicable |
| Wikidata / Wikimedia | Airport images and airline logos | Airport/airline identifiers only - no personal data | USA | Not applicable |
We also share data:
- with your company as described in section 7;
- with authorities where we are legally required to;
- with a buyer if the Service is sold, under this policy.
5. International transfers
Our database is in the EU. Some providers above are based in, or can access data from, the USA or other countries outside the EU/EEA. Where that happens we rely on the EU-US Data Privacy Framework (for certified companies) or the European Commission's Standard Contractual Clauses, with additional safeguards where needed. You can ask us for a copy of the relevant safeguards.
6. In the apps (iOS and Android)
Camera and photos. The iOS app asks for camera access and lets you choose photos only to capture OFP pages. The Android app does not currently ask for camera access. We do not access any other photos. Photos are sent to our servers and to Anthropic for reading, and are not stored by FlightBrief after the values have been read; only the extracted values are kept in your briefing.
Device attestation. To stop fake and automated sign-ups, the iOS app uses Apple App Attest and the Android app uses Google Play Integrity. They are used only at sign-up and password reset, for abuse prevention. They confirm that the request comes from a genuine copy of our app on a real device. The Play Integrity token is sent to Google for checking. The App Attest key we store is not linked to your account.
Stored on your device.
- Your sign-in session is stored encrypted (iOS Keychain; Android Keystore-sealed file).
- Briefings you save for offline use, and passenger cards, are stored in the app's local storage.
- Some app settings (e.g. that you have seen the intro) are stored locally.
- Offline briefings are removed when you sign out or delete your account.
- On iOS, passenger cards you save are kept in their own store on your device. They are not deleted when you sign out or delete your account; delete them in the app.
- On the web, passenger cards you save are kept in your browser. Passenger cards saved in a web browser are removed when you delete your account; they stay in the browser after a plain sign-out.
- On Android, app data is excluded from cloud backup and device transfer.
No location, no tracking.The apps do not request your location and do not track you across other companies' apps or websites.
7. What others in your company can see
If you belong to a company (fleet) in FlightBrief:
- All pilots in your company can see your first name and email address (for example in the Fleet Commander list and as the author of crew notes).
- Crew notes you submit are visible to your Fleet Commander while pending and, once approved, to all pilots in your company with your name as author.
- Fleet Commanderscan see pending crew notes and manage your company's aircraft profiles.
- If your access comes from an airline licence, your operator can see that you have activated it.
Your briefings, OFPs and passenger cards are private to you. Passenger cards have no public link.
8. Cookies and analytics
We use:
| Name / type | Provider | Purpose | Duration | Needs consent? |
|---|---|---|---|---|
Authentication cookies (sb-*) | Supabase / FlightBrief | Keep you signed in | Until you sign out or the session expires | No, strictly necessary |
| Turnstile | Cloudflare | Bot check on sign-up and password reset | Session | No, strictly necessary for security |
| Cookie-choice record | FlightBrief | Remember your analytics choice | 12 months | No |
_ga, _ga_4Y7J3NNZJ5 | Google Analytics 4 | Count visits and see which pages are used | Up to 2 years | Yes |
Google Analytics loads only after you click "Accept"in the cookie banner. If you click "Reject", it does not load. You can change your choice at any time via Cookie settings in the footer. We use Google Analytics with IP truncation enabled by Google and without advertising features or Google signals.
The apps do not use cookies or Google Analytics.
9. Marketing emails
We send product news and offers only if you have opted in (the box is unticked by default at sign-up and in your account). Every marketing email has an unsubscribe link, and you can also withdraw consent by emailing us. Withdrawing does not affect your account. If you entered your email in an offer banner before creating an account, we use it only to send what you asked for, and you can unsubscribe at any time.
Service emails (e.g. password reset, receipts, important changes to the Service or these documents) are not marketing and are sent regardless.
10. How long we keep data
| Data | How long |
|---|---|
| Account, profile, briefings, passenger cards on our servers, weather preferences, OFP parse records | Until you delete your account; then deleted immediately |
| OFP images | Not stored by us after reading (processed in memory). Anthropic keeps API data only for a limited period under its terms, then deletes it |
| Crew notes | Until you delete them or your account |
| Aircraft profiles you added to a fleet | Kept for your fleet after you delete your account, without your name |
| Consent records (what you accepted, and marketing opt-in) | While your account exists, and for 3 years after you delete your account or withdraw consent, to document what was agreed in case of a legal claim |
| Pre-signup marketing leads | Until you unsubscribe, or until we no longer need them for the offer you asked for |
| Purchase and invoice records (Stripe, our bookkeeping) | 5 years from the end of the financial year (Danish Bookkeeping Act) |
| Store records (Apple, Google, RevenueCat) | Kept by those companies under their own policies |
| Sign-up throttling hashes | 1 day |
| Server and hosting logs | Kept for a short period by our hosting and database providers under their terms, then deleted automatically |
| Google Analytics data (only with consent) | 14 months |
| Support emails | Until your request is handled and we no longer need them |
| Data on your device | Until you sign out (offline briefings), delete your account or delete the app. Passenger cards saved in a web browser are removed when you delete your account; on iOS they stay until you delete them in the app (section 6) |
| Backups | Deleted data disappears from backups when our database provider's backup cycle overwrites them |
11. Your rights
You have the right to:
- access your data and get a copy;
- correct inaccurate data;
- delete your data ("right to be forgotten");
- restrict processing;
- data portability - receive data you gave us in a machine-readable format;
- object to processing based on legitimate interest, and always to direct marketing;
- withdraw consent (marketing, analytics) at any time;
- not be subject to a decision based solely on automated processing that has legal or similarly significant effects. FlightBrief's verdicts are advisory and do not make decisions about you.
To use your rights, email hello@flightbrief.io. We may ask you to confirm your identity. We reply within one month (extendable by two months for complex requests, in which case we tell you why).
You may complain to the Danish Data Protection Agency: Datatilsynet, Carl Jacobsens Vej 35, 2500 Valby, Denmark, www.datatilsynet.dk, dt@datatilsynet.dk - or to the authority where you live or work. We would appreciate the chance to sort it out first.
12. Deleting your account
- iOS app: Settings -> Delete account.
- Web: sign in at flightbrief.io -> Account -> Delete account.
- Without the app or a login: email hello@flightbrief.io from the address on your account. Full details on our public page: flightbrief.io/delete-account.
Deleting your account deletes your profile, briefings, passenger cards on our servers, weather preferences, crew notes, airline requests and OFP parse records, and removes passenger cards saved in your web browser. We keep a record of the Terms you accepted for 3 years (section 10). Aircraft data you added to a fleet stays without your name. Accounting records are kept as required by law.
Subscriptions: deleting your account cancels a web (Stripe) subscription immediately, without a refund for the rest of the current period. It does not cancel an App Store or Google Play subscription - cancel those in your Apple ID settings or in Google Play.
13. Security
We use encryption in transit, encrypted storage on your device, row-level access controls in our database, hashed passwords, device attestation and bot checks at sign-up, and access limited to people who need it. No system is perfectly secure. If a personal-data breach is likely to put your rights at risk, we will notify Datatilsynet within 72 hours and tell you without undue delay where the law requires it.
14. Children
FlightBrief is for adults. You must be at least 18 to use it. We do not knowingly collect data from anyone under 18. If you believe a child has created an account, email us and we will delete it.
15. Changes to this policy
We will update this policy when the Service or the law changes. The version and date are at the top. For material changes we will tell you by email and/or in the app before they take effect.
Changes in version 3.0 (27 October 2026): added the iOS and Android apps; camera/photos, App Attest, Play Integrity, on-device storage; RevenueCat, Apple, Google, Cloudflare, Aviation Edge, NOAA, Wikidata; Google Analytics with consent; marketing emails; sharing within your company; a retention table; account deletion; controller details.
16. Contact
Alexma, Markkrogen 8, 2860 Søborg, Denmark, CVR 30954580 - hello@flightbrief.io