Privacy Policy

This is the part most pilots ask about, so it goes first. The routes, waypoints, aircraft, fuel figures and notes you enter are saved on your device only. They are not uploaded, not backed up to us, and not synced between your devices. Nobody at FlightPlan can open them, because we do not have them. On your phone they sit inside encrypted storage (see section 6).

That is a deliberate choice, and it has a cost you should know about: if you uninstall the app, wipe the phone or lose it, your plans are gone. There is no copy for us to restore. If your plans matter to you, export a backup file from inside the app and keep it somewhere safe.

One number does reach us. When you save or delete a plan, the app updates a count — how many plans you have, never what is in them — against your account. It is there so a plan limit can be applied fairly, and it is a single integer: 0, 3, 17.

Your account. To sign up you give a username, an email address and a password. We never see the password itself — sign-in is handled by Supabase, which stores only a cryptographic hash of it.

Your pilot profile.Your name and phone number, plus — if you want to fill them in — your pilot licence number, your home airport’s ICAO code and a profile photo. The licence, home base and photo are optional, and the app works perfectly without them.

Anything you write to us. If you use the contact form or ask for your data to be deleted, we keep your message and the email address you gave, so that we can reply and show that we did.

Your location — on the device, never sent. With your permission the app reads GPS to draw your aircraft on the moving map, and only while the app is open. Your position is never transmitted to us and never stored on our servers. The app does not ask for background-location access, so it cannot follow you when it is closed. You are free to refuse the permission: the map still works, it simply will not show where you are.

Motion sensors — also on the device. When GPS drops out, the gyroscope and accelerometer are used to estimate where you have moved since. This happens entirely on your phone.

A random device identifier. The app makes up a random string and keeps it on your phone. It is not a hardware ID and not an advertising ID, and it cannot be used to recognise you in any other app. It exists to keep one account to one device and to hand out the free trial once per phone. It is anti-abuse, not tracking.

Your last sign-in. We keep the IP address you last signed in from, the model of the phone as the operating system reports it (for example OPPO CPH2359), and when that was. Only the most recent one — each sign-in overwrites the last. Without it, “is somebody else using my account?” is a question we cannot answer. We read the model, not the name you gave your phone, because people tend to put their own name in that.

The IP you signed up from is logged for 30 days and then expires. It is there to stop someone creating accounts by the hundred.

Our operators can see the account details in this section and in section 2. All of it is deleted with your account. None of it is used for profiling, advertising or analytics, and none of it is shared.

No analytics, no advertising, no trackers.The app contains no analytics SDK, no ad SDK and no third-party tracker. When something crashes, the details go to your phone’s own log, where they stay.

Everything above stays on your phone. Charts are the exception, and it is worth being clear about it: if you add your own airport chart to your account, that file is uploaded to our storage so it is still there when you reinstall or change phone. It is readable by you and by our operators, by nobody else, and it is deleted with your account.

If you would rather a chart never left the phone, do not add it to your account.

We do not sell your data, and we do not share it for advertising.

Supabase hosts the database, the sign-in system and file storage, on servers in Ireland. Your account, your profile and any charts you upload live there. Your flight plans do not.

Google sees your identity only if you choose to sign in with a Google account.

Kashierhandles payments. You are sent to Kashier’s own checkout page and type your card details there — card numbers never pass through the app or through us. We keep only the order: its reference, which plan, how much, and whether it was paid.

Map and weather providers. Map imagery comes from Esri (ArcGIS), OpenStreetMap and, where enabled, OpenAIP; winds-aloft forecasts come from Open-Meteo. Your phone asks them directly, so those providers can see your IP address and which map areas or coordinates you asked for. Weather reports (METAR and TAF) are fetched through our own server instead, so the weather source never sees your IP.

We would also hand over data if the law required us to. Note what that means in practice for your plans: there is nothing to hand over.

On your phone, your flight plans, aircraft and other sensitive files are encrypted with AES-256-GCM. The keys live in the operating system’s keystore and are never written to disk in readable form. You can also lock the app behind your fingerprint, face or PIN.

Everything that does travel goes over TLS. On the server, each pilot’s rows are fenced off by row-level security, so one account cannot read another’s data even if someone tampers with the app.

You can delete your account whenever you like, from Settings → Account → Delete account in the app. It is permanent: your profile, your uploaded charts, your notifications and your sign-in details are erased.

You can also ask from the web without signing in, at flightplan-operator.vercel.app/delete-account, or through our contact form. We action deletion requests within 30 days.

Your flight plans are not part of that, because we never had them. They are on your phone: delete them in the app, or uninstall it.

Two things outlive the account, and neither one identifies you. Records of payments are kept as long as accounting law demands, but they are cut loose from your account the moment it goes — the amount and the date remain, the link to you does not. And the IP address logged when you signed up expires on its own after 30 days.

One consequence worth knowing: the free trial is granted once per phone. Delete your account and sign up again on the same device and the new account starts without a trial. You are allowed to do it — it just does not reset the free period.

The app is made for pilots and is not directed at children under 13. We do not knowingly collect anything from children.

If we ever change what we collect or who it goes to, this page changes and the date at the top changes with it. Anything material will be announced in the app.

FlightPlan Pro is published by Omar Sameh. Questions about this policy, about what we hold on you, or a request to erase it — all go through our contact form. You do not need an account to use it, and we reply to the address you give us.