Legal

Privacy Policy

Last updated October 9, 2026

Your flight data is yours. This policy describes what AeroLog collects, why, and what we do — and don't do — with it.

1. What we collect

Account data

  • Email address, display name, profile photo (if provided).
  • Certificate level and endorsements you enter during onboarding.
  • Authentication identifier (Firebase UID).

Logbook data

  • Flights, aircraft, currency settings, files you upload, scheduled events, messages you send within AeroLog.

Device data

  • Browser type, coarse location (country-level from IP), and referrer — used only to keep the service running and debug issues.

Payment data

  • We do not store card numbers. PayPal processes payments and returns only a subscription reference.

2. What we do with it

  • Operate the Service — sync your logbook, render your dashboard, send verification emails.
  • Enforce plan limits and process subscription events.
  • Respond to support requests.
  • Detect abuse (e.g. impossibly rapid account creation).

3. What we don't do

  • We don't sell your data to anyone.
  • We never use, train on, or monetize your logbook or flight records.
  • We don't share your flights with advertisers or data brokers.
  • We don't read your messages or file contents except when you specifically ask support to.

4. Third-party services

We use these providers to run AeroLog. Each receives only the data needed for its function. A current list lives on our subprocessors page.

  • Google Firebase (Google LLC, US) — authentication, database, file storage.
  • Vercel (Vercel Inc., US) — web hosting, plus Vercel Analytics and Speed Insights: aggregate page views, a short list of funnel events (sign-up started, sign-up completed), and page-load timing. No cookies, no cross-site identifier.
  • Google Analytics (Google LLC, US) — product analytics: which pages and menus people use, scroll depth, filter choices, and searches. Search text is sent only for public aviation data (airport identifiers, NOTAMs, news); for logbook, files, people and documents only the length of the search is sent. It never receives logbook entries, file contents, or anything you copy. Google signals and ad personalization are turned off, so it is not used for advertising.
  • PayPal (PayPal Inc., US) — subscription billing. PayPal is the PCI-DSS processor; we never see your card number.
  • Google Ads (Google LLC, US) — conversion tag. Reports that a sign-up or subscription happened after a Google ad click, and sets Google advertising cookies. It receives no logbook data.
  • aviationweather.gov (US NOAA/NWS) — METAR, TAF, and NOTAM lookups. Only airport identifiers are sent.
  • airplanes.live and adsb.lol (community ADS-B aggregators) — live flight positions near your location, requested by our server. Only coordinates are sent.
  • AeroLog ATC receivers (our own equipment, reached through Cloudflare) — when you play live ATC audio or open the transcript, your browser connects to the receiver directly, so it sees your IP address like any web server. Nothing from your account is sent.

5. Cookies and analytics

  • Vercel Analytics and Speed Insights count page views, a short list of funnel events, and page-load timing. They set no cookies.
  • Google Analytics sets first-party cookies (_ga, _ga_*) that tell repeat visits apart, and reports how the site is used: pages, navigation, scroll depth, filters, and searches on public aviation data. It is not used for advertising.
  • The Google Ads conversion tag loads on every page and sets Google advertising cookies. It reports that a sign-up or subscription happened; it never receives your logbook.
  • Sign-in state, theme, and offline data are kept in first-party storage on your own device.

Blocking advertising cookies in your browser, or opting out in Google's Ads Settings, stops the ad tag. Google's Analytics opt-out add-on or a content blocker stops Google Analytics. Nothing else about AeroLog changes.

6. Data retention

  • Active accounts — we keep your data as long as your account exists.
  • Canceled accounts — your logbook remains exportable for 30 days, then is deleted from production systems. Backup snapshots roll off within 90 days.
  • Support emails — retained for 2 years.

7. Your rights

You can, at any time:

  • Export your logbook as CSV or PDF from the Logbook page.
  • Edit or delete entries directly in the app.
  • Request full account deletion by emailing team@aerolog.us — we'll confirm within 7 days.

Residents of the EU, UK, and California: you have additional rights under GDPR and CCPA/CPRA, including access, rectification, erasure, portability, and objection. Contact us to exercise them — no fee, no account restriction for doing so.

California "Do Not Sell or Share" notice: AeroLog does not sell your personal information. The one advertising tag we run is Google Ads conversion tracking, which measures whether an ad led to a sign-up or subscription. To opt out, block advertising cookies in your browser or use Google's Ads Settings. Google Analytics runs with its advertising features turned off, so it is not used for cross-context behavioral advertising. See our Your Privacy Choices page for details.

8. Children

AeroLog is not directed to children under 13. If you believe a child has created an account, contact us and we'll remove it.

9. International transfers

AeroLog is operated from the United States. By using the Service, you consent to the transfer of your data to the US and its processing there.

10. Changes

Material changes to this policy will be announced in-app at least 14 days before they take effect.

11. Contact

Privacy questions: team@aerolog.us.