Your data in Flytebook.

When you create or use an account, we process your email address, authentication information, name, username, and profile information you provide, such as your aviation role or licence type. We use these to sign you in, maintain your profile, connect your devices, and communicate about your account. Support requests include the information and attachments you choose to send us.

Device management uses an app-generated device identifier, device model, platform, operating-system version, and app version. Purchase records include subscription status and product, customer, and transaction identifiers needed to verify access, restore purchases, and resolve billing issues. Apple, Google, or Stripe processes the payment, depending on where you purchased your subscription.

We store the content you create or upload: flight plans, routes, airports and waypoints, aircraft details and registrations, logbook entries, flight times, landings, remarks, and associated tracks, recordings, photos, and documents. Organization features also process membership, dispatch, training, and financial records entered into the workspace. We use this content to provide flight planning, recording, logbook, replay, and organization workflows.

Information can be stored locally for offline use and synchronized with your account when a connection is available. Saved flight tracks and cockpit audio can be uploaded as part of logbook synchronization. A flight marked private can still be stored in our cloud services; private describes who can view it.

With the required device permissions, Flytebook uses precise GPS position for navigation, nearby information, flight detection, recording, and live sharing. Recorded tracks can contain latitude and longitude, altitude, speed, bearing, timestamps, and accuracy measurements. Recording and automatic takeoff detection can use location in the background when those features and permissions are enabled. Auto-record is off by default.

Watch flight sessions can use GPS, compass, and barometer readings and transfer flight information to your phone. On Apple Watch, Flytebook uses a HealthKit workout session to keep flight recording active in the background; it does not read health metrics through HealthKit. You can change location and other sensor permissions in your device settings. Disabling them can prevent features that depend on them from working.

For personal flights, cockpit audio recording and live audio sharing are separate controls, both off by default. Audio capture requires microphone access. Saved cockpit audio can synchronize to cloud storage, subject to your upload preferences, including the Wi-Fi-only option. Personal saved cockpit-audio archives are restricted to their owner, even when the flight is public. Live audio is shared only when its separate sharing control and broadcast permissions allow it. In organization sessions, recording consent and workspace policy govern audio recording and sharing separately from your personal-flight controls.

Dashcam recording requires camera access. Ordinary dashcam video stays on your device unless you export or share it. Enabling live video sends it to our media provider and creates a cloud recording, even if nobody watches the stream. Live video can include cockpit audio when enabled. Organization recordings follow workspace access and retention settings. Consider the privacy of passengers and others, and obtain any required permissions before recording or sharing them.

Your visibility and sharing choices determine the audience. Private flights do not have public share links. Unlisted flights can be viewed by people with the link, and recipients can forward it. Public flights can appear on the public map or feed and be viewed by people without an account. Live sharing can expose your full-precision position, altitude, speed, bearing, display name, and aircraft type; positions are not blurred.

When you participate in an organization or school, its authorized members and administrators can access information according to their roles and the workspace's sharing rules. This can include flight records, training history, dispatch information, and shared recordings. Ask the organization about its uses and retention of those records. Ending a broadcast stops live transmission. Saved records and cloud archives remain subject to their visibility, access, and retention settings. Changing those settings cannot retrieve copies that viewers have already saved or exported.

We use service providers to operate Flytebook: Supabase for account authentication, databases, and file storage; Cloudflare for network and live-media services, including cloud video recordings; Postmark for account and service emails; PostHog for product analytics and website session replay; and Sentry for diagnostics. Stripe, Apple, and Google handle purchases through their respective payment systems. Providers receive information needed for their role.

Email processing includes addresses, message content, delivery status, and, for some welcome and organization-invitation links, click activity. Network services necessarily receive connection information such as IP addresses. The analytics-specific IP limits below do not apply to every operational service. We may also disclose information when required by law or to address fraud, abuse, security incidents, or threats to people's safety.

We keep account information and saved flight content while needed to provide your account, synchronization, and saved records, unless you delete it or a feature-specific retention setting removes it. Local recordings and downloads remain subject to device storage controls. Signing out alone does not erase offline data.

Live audio uses a short rolling buffer, separate from saved cockpit-audio archives. Cloud recordings of live video expire under the retention period set for the service or your organization; organization administrators can configure their recording retention. These limits do not apply to every saved logbook entry or audio archive. Contact us if you need the retention period for a particular recording or workspace.

Shared organization history may remain after an individual deletes their account, including training and financial records with the person's name and historical attribution. We also retain restricted billing and deletion-reconciliation records where needed to resolve transactions, finish erasure requests, or meet applicable recordkeeping obligations. Removing an account link does not make these records anonymous. Their retention depends on that purpose and any applicable legal requirements.

To delete your account, use Settings → Danger Zone → Delete Account in the app, or the account-deletion page on the website. This removes personal account records, personal flight records, and personal cloud track and cockpit-audio files. Cloud-video removal follows separate media-retention and provider-cleanup processes; account deletion does not immediately erase those archives. Deletion from the app also attempts to remove its local account data and recordings. If local cleanup fails, the app reports a warning; copies on other devices or exported to other people may need separate removal. An organization owner may need to transfer ownership before deleting their account. Shared organization records and the restricted records described above are handled separately.

Account deletion does not automatically complete erasure in our analytics and diagnostic services. Contact us to request deletion there; this requires a separate support process. Deleting your Flytebook account also does not cancel a paid subscription. Before deletion, cancel it through the store or service where you subscribed to stop future renewals.

You can stop recording or live sharing in the app, revoke camera, microphone, or location permissions in device settings, and use the analytics controls below. Stopping future collection does not by itself delete previously stored information. For access, correction, a copy of your data, deletion, or questions about withdrawing permission, email support@flytebook.com. Include your account email and the scope of your request, but never your password. We may verify your identity before acting and will explain any information we need to retain and why. Available rights depend on applicable law.

PostHog receives page and screen names, successful or failed feature outcomes, coarse count and distance buckets, app/build version, and subscription tier/status so we can understand which workflows work and where people get stuck. Analytics can also include city, region, country, and time zone derived from your IP address at ingestion; the IP address and latitude/longitude fields are discarded from analytics. Signed-in activity uses the internal Flytebook account UUID so app and web outcomes can be understood together. Names, email addresses, usernames, and device models are not sent as analytics properties.

Website replay records only the home, privacy, fleet, plans, and planner pages (/, /privacy, /fleet, /billing/plans, /plan). The home, privacy, fleet, and plans pages are recorded as shown, except subscription choices and account-related messages are masked. The planner stays masked: text is obscured, images and maps are blocked, and only layout and interactions are visible. Anything you type is masked on every recorded page. Sessions on those pages are recorded rather than sampled, and recordings shorter than 15 seconds are discarded. Mobile session replay is disabled.

Product analytics excludes precise coordinates, routes, airport or waypoint identifiers, plan names, logbook details, tail numbers, callsigns, searches, images, charts, camera feeds, account fields, and payment identifiers. Those exclusions apply to analytics; operational flight features process the information described earlier in this policy. Raw errors and stack traces go to the separate diagnostic service, not product analytics.

Product events are retained for up to 12 months and website session replays for up to 30 days. Account-linked analytics can be located for access or deletion using the internal account UUID.

Sentry receives technical diagnostics such as error types and stack traces, page paths with query strings and fragments stripped, browser and OS names, the app release, and the internal account UUID to help us detect and fix problems. Diagnostic reports exclude coordinates, routes, airport identifiers, cookies, form contents, and session recordings. Crash reporting stays on independently of product-analytics preferences. Error events are retained for 90 days.

Flytebook uses browser and device storage for sign-in sessions, preferences, and offline content. Analytics state lives in this browser's localStorage and in a PostHog cookie (names prefixed ph_) set for flytebook.com and its subdomains, holding a random analytics identifier, not your name or email. Clearing site data removes these local values and may sign you out or reset preferences; it does not delete cloud account data. The controls below stop analytics collection without requiring you to clear site data.

We update this policy as Flytebook's features and data practices change. The date above identifies the latest version. Privacy questions and requests can be sent to support@flytebook.com.