Privacy Policy for FlightRecord

Personal Information

We collect the following personal information when you use our Services:

• Account Information: Username, email address, first name, last name, password (encrypted), phone (optional), birth date (optional), gender (optional)
• Company Information: Company name, company ID, and associated organizational data
• User Preferences: Time zone, app theme preferences, and notification settings
• Authentication Tokens: Secure tokens stored locally on your device to maintain your login session

Credentials and Documents

FlightRecord is designed for operational qualification tracking, not storage of government ID images, ID numbers, Social Security numbers, or bank or direct-deposit details. See our Sensitive Data Policy for full requirements. Additional information can be uploaded by each user to track eligibility and qualifications:

• Professional Credentials: Driver's license and passport eligibility are tracked by dates (and, for a license, issuing state and CDL class). Flight Record does not store the license or passport number, or a scan of a driver's license, state ID, or passport. Pilot certificates, medical certificate images, and other pilot-related credentials may still be stored.
• Document Storage: Documents you upload are stored on secure Amazon S3 servers. Do not upload government ID images, Social Security numbers, or bank account or direct-deposit details.
• Purpose: We use these documents to track eligibility and qualifications. We do not share or intentionally make public any document you upload to your profile

Location Information

With your permission (mobile app only), we collect precise location data (GPS coordinates) when you:

• Perform equipment inspections and checks
• Submit reports that require location verification
• Use location-based features of the mobile app (e.g., clock in/out location stamp)

Location data is used to associate equipment checks with specific geographical locations for operational and safety compliance purposes.

Equipment and Operational Data

We collect and process:

• Equipment Inspection Data: NFC tag IDs (RFID) from mobile app, equipment status, inspection results, answers to inspection questions
• Flight Operations: Commercial operation and flight data is collected when a pilot, driver, or mechanic enters log data
• Notes and Reports: Free-form text notes you add to inspections, daily logs, daily diaries, pilot status reports, and hazard reports
• Time Card Data: Clock-in/clock-out times, work duration, GPS location snapshots captured with clock in/out (when permitted), and associated project information
• Scheduling Information: Flight schedules, assignments, and project details
• Aircraft Information: Aircraft identifiers and related flight operation data

Technical and Usage Data

We automatically collect certain information when you use our Services:

• Device Information: Device model, operating system version, unique device identifiers (mobile app only)
• Login Activity: The last date and time you logged in, the last date and time you logged out, the date and time of your last activity (creating, editing, deleting records)
• App Usage Data: Features accessed, app performance metrics, error logs
• Error reports: Diagnostic data when the web application encounters server or client-side errors (collected via Sentry on our production hosting)
• Network Information: API request data, response times, and connection status
• Analytics: We use Google Analytics for traffic and usage statistics, but this data does not include your specific uses/history

NFC Data (Mobile App Only)

When you use NFC functionality to scan or program equipment tags:

• RFID Tag IDs: Unique identifiers stored on NFC tags attached to equipment
• Tag Programming Data: Information written to NFC tags for equipment identification

What We DON'T Collect

• IP Addresses: We do not persist IP addresses in the FlightRecord database. An IP address may still be sent to or recorded by hosting infrastructure or third-party services we use (for example Google Analytics, Sentry, or server access logs) as part of how those systems operate.
• Behavioral Tracking: We do not allow third-party behavioral tracking

Operational Purposes

• Equipment Management: Track equipment status, inspections, and maintenance history
• Work Tracking: Manage time cards, schedules, and work assignments
• Flight Operations: Support daily logs, pilot reports, and operational documentation
• Safety Compliance: Maintain records required for aviation safety and regulatory compliance
• Credential Verification: Track pilot qualifications, document expiration, and eligibility status

Service Delivery

• Authentication: Verify your identity and maintain secure access to your account
• Data Synchronization: Sync your data between your device and our servers
• Offline Functionality: Store data locally on mobile devices when you're offline and sync when connectivity is restored
• Location Verification: Associate equipment checks with geographical locations
• Personalization: To personalize your experience based on your preferences and permissions

Communication

• Notifications: Send you important updates about equipment status, schedules, and assignments
• Periodic Emails: Send periodic emails pertaining to (but not limited to) user status, document expiration, progress, scheduling, payroll, etc.
• Support: Respond to your inquiries and provide customer support
• Updates: Inform you about application updates, new features, and policy changes

App Improvement

• Performance Monitoring: Track app performance and identify technical issues
• Error reporting: Diagnose and fix web application errors and exceptions (via Sentry)
• Analytics: Understand how users interact with our Services to improve functionality
• Feature Development: Guide development of new features based on usage patterns

Server Storage

• Data is contained within a secure database stored on 3rd party servers. We do not maintain our own servers.
• Your data is transmitted securely to our servers using HTTPS/TLS encryption (SSL technology)
• Documents and images are stored on secure Amazon S3 servers
• Server-side data is stored in access-controlled databases operated by our hosting providers
• Hosting and network: Production runs on managed cloud infrastructure (for example Heroku and Amazon Web Services). We do not operate our own datacenter or firewall appliances; network isolation and perimeter protections are provided by those platforms
• Authentication: Using the Services requires sign-in with individual account credentials. Passwords are stored using one-way encryption. The mobile apps connect to our API using authenticated tokens tied to your account
• Authorization: After sign-in, what each user can view, add, edit, or delete is limited by role- and permission-based rules in the application (see Access Controls below)
• Database backups are encrypted and stored securely by our hosting providers
• Operational access: Direct access to production systems—hosting and database administration (for example Heroku), file storage (Amazon S3), and related cloud consoles—is limited to authorized Flight Record personnel who need it for hosting, security, troubleshooting, and customer support. Access uses individual accounts (not shared logins), is granted on a least-privilege basis, and personnel with access are required to keep customer data confidential

Local Storage (iOS and Android Apps)

The mobile apps store data on your device to support offline use and faster access. Details differ by platform:

iOS (FlightRecordApp)

• Operational and offline data is stored locally using SwiftData (Apple's on-device database framework)
• Authentication tokens and credentials are stored in the iOS Keychain, which uses hardware-backed encryption when available and is protected by your device passcode or biometrics
• Local app data is protected by iOS file protection when your device is locked

Android (FlightRecordApp)

• Offline sync queues and cached reference data are stored locally in a Room (SQLite) database on your device
• Authentication tokens and session information are stored using EncryptedSharedPreferences (AES-256 encryption with keys held in Android Keystore)
• Local app data is protected by your device's lock screen and Android full-disk encryption when enabled

Access Controls

• Information displayed on pages is protected by permissions that prevent users who are not authorized from viewing certain information
• Flight Record defines the roles and permission rules available in the product; your company assigns those roles to users—Flight Record does not decide who in your organization holds each role
• Permissions are unique to each user, determined by company-assigned user roles
• Permissions decide who can add, edit, view, or delete specific records
• Permissions can also limit access to certain pages or even parts of pages

Data Retention

How long we keep information depends on the type of data and your organization's relationship with the Service. Retention is not one-size-fits-all: structured records in the database (times, payroll, logs, and similar), account information, and uploaded files can follow different rules. This section summarizes retention across those categories. See our Data Retention page for the same overview plus the detailed attachment schedule (tiers, timelines, and inactive-company purge notice).

• While you use the Service: We retain account and profile information (for example name, email, and role assignments) for as long as your user account is active and your company uses FlightRecord
• Structured operational data: Database records such as daily logs and activity entries, time-clock punches, payroll calculations, invoice lines, equipment inspection results, and qualification or training dates typically remain longer than uploaded files—often for the life of your company's use of the Service or as needed for tax, payroll, and operational history. These rows are governed by this Privacy Policy and your service agreement, not by the attachment schedule alone
• Uploaded files and images: Attachments are classified and deleted on defined schedules—for example Standard uploads (project files, operational photos) may be eligible for cleanup after about three years, Regulatory uploads (SMS and training evidence, maintenance records, expense or fuel receipts, signatures) after about seven years, and equipment photos for as long as that equipment record exists. Inactive or locked companies follow a shorter attachment window. See Data Retention for full attachment tiers, examples, and notice before purge
• Expired credential scans: Issued dates, expiration dates, and status stay on the qualification or training record; the uploaded scan may be removed after the expiration date while the record row is kept
• Legal and compliance retention: We retain certain information when required by law or legitimate business needs—for example aviation safety and maintenance documentation, tax and payroll records, fraud or security investigations, or responding to valid legal process—even after an individual account is deleted or a company stops using the Service
• After account deletion: We remove or anonymize personal information where we can, but some operational records your company created (for example timesheets or logs you submitted as part of a job) may remain visible within your organization according to company retention and administrator actions, and backups may retain copies for a limited period
• Technical logs: Crash reports and anonymized usage analytics may be retained for a limited time to diagnose errors and improve the Services

Within Your Organization

• Data is shared with other users in your company as necessary for operational purposes and FlightRecord functionality
• Your company administrators will have access to your data related to company operations
• Equipment checks, time cards, reports, and credentials may be visible to authorized personnel in your organization based on role-based permissions

Third-Party Services

We use the following third-party services that may have access to your data:

• Amazon S3: Secure storage for documents and images you upload
• Google Analytics: Traffic and usage statistics (does not include personally identifiable information)
• Sentry: Error monitoring for the FlightRecord web application (hosted on Heroku) that collects diagnostic data such as error messages, stack traces, request context, and browser or server environment details. Sentry Privacy Policy

Important: We do not sell, trade, or otherwise transfer your personally identifiable information to outside parties. We do not include or offer third-party products or services on our website. We have not enabled Google AdSense on our site but may do so in the future.

Legal Requirements

We may disclose your information if required to do so by law or in response to:

• Valid legal processes (subpoenas, court orders)
• Protection of our rights, property, or safety
• Investigation of fraud or security issues
• Enforcement of our Terms of Service
• Compliance with aviation safety regulations

Business Transfers

If Flight Record, LLC is involved in a merger, acquisition, or sale of assets, your information may be transferred. We will provide notice before your information is transferred and becomes subject to a different Privacy Policy.

Access and Correction

• You can access and update your account information through the Settings page (web) or App Settings (mobile)
• You can request a copy of your personal data by contacting us
• You can review and edit much of your information directly in the app (subject to your company's roles and permissions). If you cannot change something yourself, you may contact us or your company administrator for help correcting inaccurate or incomplete data

Location Permissions (Mobile App)

• You can enable or disable location access in your device Settings > Privacy > Location Services > FlightRecordApp
• Disabling location may limit certain features that require location data—for example clock in/out location stamps and location captured with equipment inspections

NFC Permissions (Mobile App)

• You can control NFC access through your device settings
• NFC tag scanning and programming are optional conveniences—not required for equipment workflows. You can open equipment in the app and complete inspections and related tasks without scanning an NFC tag

Account Deletion

• You can request deletion or deactivation of your account by contacting your company administrator or our support team
• Your activity and records in FlightRecord are part of your company's operational data—for example schedules, inspections, project statistics, and aircraft logs. Because your user is linked to those records, full account deletion is often not possible without breaking data integrity for your organization
• When deletion cannot be completed, we or your company administrator may instead remove or obscure personal information (such as contact details) while retaining the operational history tied to your user ID
• Any removal or anonymization is still subject to legal retention requirements, your company's needs, and backup retention for a limited period

Marketing Communications

• You can opt out of promotional communications by adjusting your notification settings
• Operational communications (e.g., schedule updates) cannot be opted out while maintaining an active account—your employer (the FlightRecord customer company) controls these communications to its users, not Flight Record marketing

If you are located in the European Economic Area (EEA) or United Kingdom, you have rights under the General Data Protection Regulation (GDPR):

• Right to Access: Obtain confirmation of data processing and access to your personal data
• Right to Rectification: Correct inaccurate or incomplete personal data
• Right to Erasure: Request deletion of your personal data
• Right to Restriction: Restrict processing of your personal data
• Right to Data Portability: Receive your data in a structured, machine-readable format
• Right to Object: Object to processing of your personal data
• Right to Withdraw Consent: Withdraw consent at any time

Our legal basis for processing your data includes:

• Contract Performance: Processing necessary to provide the service you requested
• Consent: Processing based on your explicit consent (e.g., location data, document uploads)
• Legitimate Interests: Processing necessary for our legitimate business interests
• Legal Obligation: Processing required by law (e.g., aviation safety regulations)