Privacy Policy

We limit collection to what is necessary to operate the Service.

• Account data: your email address, a chosen username, and a password that is stored only as a salted bcrypt hash (never in plain text). We also record whether your email address has been verified and your account creation date.
• Content you create: the tours, legs, aircraft selections, notes, flight details and preferences (such as distance unit and SimBrief username) that you enter into the Service.
• Communications: messages you submit through the feedback or contact features, together with the account they were sent from.
• Technical and usage data: standard server and reverse-proxy logs, which may include your IP address, browser user agent, requested pages and timestamps. These are generated automatically and retained only briefly for security, abuse prevention and troubleshooting.

We do not knowingly collect special categories of personal data, and we ask that you do not enter such data into free-text fields.

• To create and administer your account and authenticate you.
• To provide the core functionality: planning, logging and sharing tours.
• To send service-related email such as address verification, password resets and collaboration invitations.
• To respond to your feedback and support requests.
• To keep the Service secure, prevent abuse, enforce our Terms and comply with legal obligations.

Under the GDPR we rely on the following legal bases:

• Performance of a contract (Art. 6(1)(b)) — to provide the account and features you sign up for.
• Legitimate interests (Art. 6(1)(f)) — to secure the Service, prevent abuse and improve reliability, balanced against your rights.
• Legal obligation (Art. 6(1)(c)) — where we must retain or disclose data to comply with the law.
• Consent (Art. 6(1)(a)) — where we ask for it specifically; you may withdraw consent at any time.

We use a strictly necessary session cookie to keep you signed in, and a small preference cookie to remember your light or dark theme. We do not use advertising cookies or cross-site tracking. Because these cookies are essential or preference-based, they do not require separate consent under the ePrivacy rules.

Your tours are private by default. If you choose to publish a tour, share a link, or invite collaborators, the relevant content — and your username as its author — becomes visible to the people or public you share it with. You control these settings on a per-tour basis and can change a tour’s visibility at any time.

We share personal data with a limited number of processors who act on our instructions and are bound by appropriate data-processing terms:

• Resend — delivery of transactional email (verification, resets, invitations).
• Cloudflare — DNS, TLS, content delivery and protection against attacks and abuse.
• Our hosting provider — the server infrastructure on which the Service and its database run, located within the EU.

We do not sell your personal data. Weather information (METAR) is retrieved live from public aviation sources and is not stored against your account.

Your data is stored on infrastructure located within the European Union. Where a provider processes data outside the EU, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses.

We keep your account and content for as long as your account remains active. When you delete your account, your account and its associated tours, legs and settings are removed; feedback you submitted is retained in anonymised form (detached from your account). Technical logs are kept only for a short period. We may retain limited data longer where required to comply with legal obligations or to resolve disputes.

We apply appropriate technical and organisational measures to protect your data, including encrypted connections (HTTPS), hashed passwords, access controls and rate limiting. No method of transmission or storage is completely secure, but we work to protect your data and to respond promptly to any incident.

Subject to applicable law, you have the right to:

• access the personal data we hold about you;
• rectify inaccurate or incomplete data;
• erase your data (“right to be forgotten”);
• restrict or object to certain processing;
• data portability, where applicable;
• withdraw consent where processing is based on consent.

You can access and edit most of your data directly in the Service, and you can delete your account from Settings at any time. To exercise any right, contact us via the contact page. You also have the right to lodge a complaint with your local data protection authority; in the Netherlands this is the Autoriteit Persoonsgegevens.

The Service is not directed at children under the age of 16, and we do not knowingly collect their personal data. If you believe a child has provided us with personal data, please contact us and we will remove it.

We may update this Privacy Policy from time to time. When we make material changes, we will update the “last updated” date above and, where appropriate, notify you through the Service. Continued use after an update constitutes acceptance of the revised policy.

For any question about this policy or your personal data, contact Beren Software via the contact page.