Privacy Policy

1. What we collect

• Account info: name, email, hashed password, profile photo if provided.
• Professional profile: FAA certificate type and number, ratings, role (mechanic / pilot / employer), and any other profile data you choose to provide.
• Usage telemetry: page loads, errors (via Sentry, not currently enabled), feature usage. No third-party advertising trackers.
• Payment info: handled by Stripe; we receive a Stripe customer/subscription ID, never your card number.

2. Why we collect it

• To provide the Service you signed up for.
• To enable cross-app SSO across the myAviationTools ecosystem.
• To bill you for paid plans.
• To diagnose errors and improve the Service.
• To respond to your support requests.

3. Cross-app data sharing

Your account identity (name, email, role, certificate status) is shared across connected apps within the myAviationTools platform (MyAviJobs, Logbook, Marketplace, Hub, Blockchain Explorer, Forum) solely to provide a seamless single sign-on experience. Each connected app receives only the fields it needs to function. We do not sell this data to third parties.

Forum. If you post in the Forum, your post is public. If you post anonymously, the public sees a label such as Anonymous #1, not your name or email, but we keep a private link between the post and your account so moderators can act on abuse. With every Forum post we also store a one-way hash of your IP address and browser; moderators and administrators can read it for abuse handling. Moderators can identify an anonymous author only with a written reason, and every reveal is shown in the public audit trail on the Forum.

4. Where data lives

Our application servers and primary database are hosted on a virtual server operated by netcup GmbH in the European Union. Transactional email is sent through our own mail relay on that server. Uploaded files are stored with Cloudflare R2, and we use Cloudflare for content delivery, so some data may be processed outside the EU. Our websites are served through Cloudflare, and connections to them are encrypted in transit with TLS; TLS 1.3 is supported. Database and file backups are encrypted with age (X25519) before they are stored. Backups are currently taken on the same production server; we do not yet keep an offsite copy, and we are working on one. We never sell or rent your data.

5. Sharing

We share data only with:

• Stripe (payment processing)
• Sentry (error tracking, not currently enabled; if enabled, only after you accept cookies, with a short replay of the page when an error occurs)
• Better Auth (session management — open source, self-hosted)
• Cloudflare (content delivery and R2 file storage)
• Law enforcement when compelled by valid legal process.

We never sell data to advertisers or data brokers.

6. Your privacy rights

• Access: email [email protected] to request a copy of your data. MyLogbook data can also be exported from Logbook Settings → Data.
• Correction: Edit your profile and account details directly in the app.
• Deletion: Close your account from the account deletion page or email [email protected]. When you delete your account, your name and email are replaced with dummy values and you are signed out everywhere. We still keep your original name and email, and your files, so the account can be restored. We do not automatically erase them on a schedule. To have them erased, email [email protected]. Some records are kept where the law requires.
• Portability: JSON export available on request.
• Object / Restrict: Email [email protected].

7. Cookies

We use only essential cookies for authentication (Better Auth session). Optional error tracking (Sentry) is not currently enabled; if we turn it on, it will load only after you accept it on the banner. See our Cookie Policy for the full list.

8. Children

myAviationTools is not directed at users under 18. We do not knowingly collect data from minors.

9. Security

Passwords are hashed via Better Auth's default algorithm (scrypt at time of writing). Sessions use HttpOnly + Secure + SameSite=Lax cookies. We enable TLS 1.3 on all endpoints with HSTS.

10. Changes

Material changes will be announced via in-app notification and email at least 30 days before they take effect.

11. Governing law

This Privacy Policy is governed by the laws of the State of Texas, without regard to its conflict-of-laws provisions. Any dispute will be resolved exclusively in the state or federal courts located in Texas.

12. Contact

Privacy contact: [email protected]. We reply by email, usually within a few days.