Privacy Policy
Preflio is operated by Václav Sedlatý – IT Consulting, registered in Slovakia. This policy explains what data Preflio collects, how it’s used, and how it’s protected. Preflio has no accounts and no Sign in with Apple — your identity is an anonymous identifier synced through your iCloud, never your name or email.
Your flights stay yours. Your flights, your logbook and your saved briefings are stored on your device and synced through your own iCloud account, in Apple's private database. They are not sent to Preflio's servers, and we cannot read them.
1. Your flight data — never on our servers
Your flights, your logbook and every statistic derived from it, and your saved briefings — including the time you marked one as briefed — are held on your device and synced between your devices through Apple's CloudKit private database, using your Apple ID. That's the same mechanism the app already uses for your anonymous identifier.
Preflio has no access to any of it. We can't read it, export it or delete it, and it isn't part of any backup or breach on our side.
Preflio also keeps a recovery copy in its own folder on your device, so your logbook survives being signed out of iCloud. If you sign out, Apple removes the synced copy from that device; the recovery copy stays so your data can be restored.
2. What we collect
- Stored on your device only: app preferences such as theme, units and briefing display options, plus your anonymous device identifier.
- Sent to our servers when you generate a briefing: your anonymous device identifier (a UUID — no name or email), and the airport codes and departure time of the briefing you asked for. The aviation data that comes back is cached by airport, not against you. Our servers keep no record of which device asked for which airport and no history of where you fly. Your logbook is that history, and it lives only on your device and in your iCloud, where we can't read it.
- Sent only when you choose to send it: feedback — the message you write, the category you choose, your app version and your device identifier. Feedback is text only; Preflio doesn't attach screenshots. Please don't include anything in the message you'd rather not share, as we store it to act on it.
- Subscriptions: Apple handles the payment. We receive the App Store transaction receipt to confirm your subscription is active. We never see your card details, your Apple ID or your name.
- Diagnostics: anonymised crash and error data (device model, OS version, app version, stack trace) via Sentry, to find and fix faults. Not linked to your flights.
- We don't collect: your location, your name or email, your flights or logbook, cross-app tracking, advertising identifiers, or any data for third-party marketing.
3. Legal basis (GDPR)
We process data to perform our contract with you — providing briefings and managing your subscription — and under legitimate interest for anonymised crash reporting, reliability, and acting on feedback you send us.
4. Third-party services
- Apple — subscriptions, iCloud identity sync, and iCloud sync of your flights and logbook in your own private database (held under your Apple ID, not shared with us).
- Supabase — backend infrastructure, entitlements, subscription status and feedback storage (device identifier).
- SkyLink API — NOTAM, weather, PIREP and SIGMET/AIRMET retrieval (airport ICAO codes, no identifier).
- OpenAI — rewriting NOTAMs into plain language (raw NOTAM text, no identifier).
- Sentry — crash reporting (anonymised device info).
Airport codes go to SkyLink and NOTAM text to OpenAI with no identifier attached, so neither provider can tie a request to a device or a person.
5. Data retention
Your flight data is kept for as long as you keep it. It lives in your own iCloud and on your device, so you control it directly — deleting a flight in the app deletes it, and deleting the app removes the local copy. We can't delete it for you, because we never hold it.
On our servers: your device record and entitlements are kept while the app is in use and deleted on request; subscription status is kept while the subscription is active and afterwards only as long as billing and tax records require; feedback is kept until the issue it reports is resolved, and deleted on request; crash reports are kept 90 days.
Cached aviation data — NOTAMs, weather, advisories and airport reference data — is refreshed on a fixed schedule by type, from about 5 minutes for FAA delay data to about 30 days for runway and frequency data, after which it's no longer used to answer requests. It holds no identifier, so it isn't linked to any person. Plain-language NOTAM rewrites are kept up to 14 days after they were last used, keyed by the content of the NOTAM — so a NOTAM that is still being briefed keeps its rewrite.
We also keep basic operational telemetry — which function ran, whether it succeeded, how long it took, and the device identifier — while the service is being developed and monitored.
6. Your GDPR rights
EEA users have the right to access, rectification, erasure, restriction, data portability, objection, and withdrawal of consent. Because there's no account, data requests are handled using the device ID shown under Settings → Account sync. We respond within one month (extendable to two for complex requests).
This covers the data we hold, listed above. Your flights and logbook aren't included — not because they're withheld, but because they aren't ours to produce or erase. They're in your own iCloud, and the app itself is the tool for reading and deleting them.
7. Data security
All communications use HTTPS/TLS. API keys are stored server-side only, and the key shipped inside the app grants no access to data. Our database denies access by default — only our own backend functions can read or write it.
We apply data minimisation by design. The clearest example is that your flights and logbook were deliberately architected to stay out of our systems entirely. We'll notify you of any breach as required by law.
8. International transfers
Our backend is hosted in the EU (Frankfurt). Data may be processed outside the EEA under Standard Contractual Clauses or equivalent GDPR safeguards.
9. Children
Preflio is not directed at users under 18, and we don't intentionally collect data from minors.
10. Changes
Updates are reflected in the "Last updated" date. Material changes are notified in-app.
11. Contact
Data Controller: Václav Sedlatý – IT Consulting, Slovakia
Email: [email protected] — for privacy questions or data requests.