Privacy Policy

What we collect

Your account (name, email, password hash), your pilot profile (certificate number, ratings, medical and currency dates — optional, entered by you), your flight records (bookings, check-ins, logbook entries, and — when a flight is shared or auto-logged — its route and ADS-B track positions), aircraft data you enter, images you upload, and organization membership. We collect what the product needs to work — nothing more.

What we don't do

We don't sell your data. We don't share it with advertisers. We don't train AI models on your personal records. Your logbook is yours — export it any time as .txt or PDF.

Who can see what

Organizations you join can see your name, role, and the flight records created through that organization (bookings, check-ins, charges). Your personal logbook entries, profile, and currency data are private by default — visible only to you. Charges are visible to you and your organization's billing roles.

Some features let you opt in to sharing: a public logbook share, a live "follow my flight" link, or listing your club in the public directory. When you create one of those, the specific data you chose to include becomes visible to anyone with the link. You control what's shown and can revoke a share at any time.

Third-party services

We use a small set of processors to run the product, and share only what each needs:

• Stripe handles all card payments and payouts. Card numbers go directly to Stripe — we never see or store them; we keep only a charge record and a token.
• Anthropic (Claude) and Voyage AI power the optional POH copilot and AI digitization. When you use them, your question and the relevant handbook text are sent to generate an answer. Per their API terms, this content is not used to train their models.
• Weather comes from AviationWeather.gov and Open-Meteo; map tiles from OpenTopoMap / MapLibre. Retrieving a forecast or chart sends the relevant coordinates.
• Live flight tracking (when you share a flight) matches your aircraft against public ADS-B feeds keyed by tail number.
• Resend delivers transactional and newsletter email.
• The landing page may look up your approximate location by IP (ipapi.co) purely to demo local airport weather — it is not stored.

Cookies

One session cookie keeps you signed in. Theme and layout preferences live in your browser's local storage. No advertising or cross-site tracking cookies.

Your rights

Export your data (logbook exports are built in), correct it (it's editable in the app), or delete your account and personal data yourself under Account → Delete account (financial records are retained for accounting). You can also email support@taxiwaybravo.com and we answer within 30 days.

Security

Passwords are hashed (scrypt), traffic is TLS-encrypted, database access is restricted, and backups run nightly. No system is perfect; report concerns to the address above.