When you sign up on our website
The website asks for your name, your email address and what you are (a pilot, a student pilot, a flight school, or just curious) before it opens the app. A flight school is also asked for its name. That is kept as a contact record so we can reach schools that are trying the service, and it is emailed to us as a notification. It is used only for that.
If you sign up as a pilot or a student pilot you also choose a password, and that creates your account (see below). If you are just curious, or a flight school looking around, no account is created.
If you just use the map
You do not need an account to track flights, look at weather or plan a route. If you have no account:
- Nothing you do is stored on our servers. Your routes, waypoints, notes, settings and downloaded map areas stay in your own browser, on your own device. Clearing your browser data erases them, and we cannot recover them. (Once you have an account, your saved routes and waypoints and your aircraft are kept in it instead, so they follow you between devices.)
- Our server sees the technical details every web request carries: your IP address, the time, and what you asked for. That is unavoidable when a browser talks to a server. We use it only to answer the request and keep the service working, and we do not build a profile from it.
- We use no advertising, analytics or tracking cookies of any kind.
Pilots and students who are not with a flight school
If you sign up as a pilot or student pilot on our website, your account is held in VECTOR SCHOOL, a test-bed school that VectorEFB itself runs. For those accounts VectorEFB is the controller, not a flight school, and the operator of VECTOR SCHOOL can see the records in it: your recorded flights, your logbook, your plans and your aircraft. We use them to run and improve the service and to help you, and for nothing else. They are not sold or shared. Everything else in this notice applies to you in the same way, including the right to download and delete it all.
Your logbook here is a convenience, not your official one. Where the law requires you to keep a pilot logbook, keep it in the form the law asks for.
If your flight school gives you an account
Then your school decides what is recorded about your training, and we store it on its behalf. We hold:
- Your account: the name your school enters, your username, and your password stored as a salted hash that cannot be reversed.
- Contact details, if given: an email address and a phone number. Both are optional. The email is used only to send you a password-reset link you asked for. An instructor's email and phone are shown to everyone at their school as a contact list; a student's are shown only to the school's instructors.
- Other ways you set up to sign in, if any: for a passkey, the public half of the key, the name you gave it and when you added it. The private half never leaves your device. For a linked Google account, Google's identifier for it and its email address. Linking Google only lets you sign in to the account your school already made; it never creates one.
- Your logbook and saved routes, if you keep them in the app.
- Your aircraft and checklists, if you enter them: registration, type, performance figures and checklists. They are kept in your account so they are still there on a new phone.
- A notification address for each phone, if you turn notifications on: the address your phone's push service gave the app, and the time it was added. See Notifications below.
- Planning sessions: the flights you plan and send to your instructor, including route, altitude, fuel figures, aircraft and times.
- Briefing record: that your app requested weather or NOTAM information, when, and for which airports. Not the contents of your screen, and nothing about what else you looked at.
- Recorded flights, if you choose to record one: the positions, altitudes and speeds your device reported while recording, the times, and any fuel figure you enter.
- Instructor reviews: the verdict and note your instructor writes on a plan.
Your school can see all of that. So can VectorEFB's own platform administrators — the small team that runs the service itself, not your school — for account support, troubleshooting a school's setup, and keeping the service running. That access is not automatic for every member of that team: it is limited to the administrator accounts set up for this purpose, and used for support and operation of the service, never to read your training record out of curiosity, never sold, and never used for anything beyond what this notice lists. Nobody else sees it: not other schools, not other students, not the map you look at, your notes, your private waypoints or your calculations.
Flight recording
Recording is under your control. It starts only when you press record, the app shows that it is recording while it runs, and it stops when you stop it. A recorded track is location data about you, so it is treated as the sensitive thing it is: shared only with your flight school, never sold, never used for anything else, and deletable on request.
Who is responsible for what
Your flight school is the data controller: it decides what is collected about your training and why. We are the processor, acting on the school instructions under a written agreement — which is also the basis on which our own administrators can access school records directly, for support and operation of the service. If you want your data changed or deleted you can ask either of us; where the school is the controller, we act on its instruction.
Notifications
Notifications are off until you turn them on, from your name at the top of the map. When they are on, we send lesson reminders, changes to your lessons, plan reviews and new work from your instructor, and a reminder if a flight you recorded has not been sent yet. We store the address your phone's push service (Google, Apple or Mozilla, depending on your phone) gave us, and nothing else about the phone. The message itself is encrypted so that the push service can deliver it but cannot read it. Turn them off in the same place, or by signing out, and the address is deleted.
Legal basis
For school accounts, the processing is necessary for the training the school provides and for its legitimate interest in supervising flight safety. Where consent is the basis, most obviously for recording a flight, you can withdraw it at any time by not recording and by asking for existing recordings to be deleted.
Who else sees the data
- Cloudflare hosts the app and the database. The school database is located in Eastern Europe.
- GitHub stores the encrypted nightly backups and runs the scheduled jobs (reminders and backups). It cannot read the backups.
- Google, Apple and Mozilla run the push services that deliver notifications to phones. They receive the address of your phone and an encrypted message.
- Vercel runs a small relay that fetches public flight positions. It never receives your account data.
- Resend sends password-reset emails and the notification that someone signed up on our website. It receives the address the email goes to and the email itself.
- Google is involved only if you choose to link a Google account. You sign in on Google's own page, and Google tells us your Google identifier, name and email address. We keep the identifier and email, not the name. Google learns that you signed in to VectorEFB.
- Public aviation and weather data services. Most are asked through our server, so they see our server and not you: live traffic (adsb.lol, adsb.fi, OpenSky), aviation weather (NOAA), airspace (openAIP) and aircraft photos (Planespotters). A few are asked directly by your browser, so they receive your IP address and the map area or point you are looking at: forecast winds and cloud (Open-Meteo), radar (RainViewer), satellite and storm imagery (EUMETSAT), the base map (CARTO, and EOX for the satellite layer), terrain (Amazon Web Services) and airline route lookups (adsbdb). We do not send them your name or account details.
These providers are in the United States and process data under the standard safeguards for international transfers. A current list is kept with this notice.
How long it is kept
Your school sets a retention period; the default is two years. Records older than that are deleted, after the school has been shown what will go. Delete your own account and everything belonging to it goes at once. If someone at your school erases your account, it is closed immediately and deleted for good after 14 days, in case it was a mistake.
Backups
To protect your records from being lost, an encrypted copy of the whole database is made every night and kept for up to 90 days in a private repository at GitHub. The copy is encrypted before it leaves our server, with a key GitHub does not have, so GitHub holds only unreadable files. Sessions, reset links and notification addresses are not included. Because these copies expire on their own, something you delete disappears from the live service at once and from these backups within 90 days.
Your rights
Under the GDPR you can ask for a copy of your data, correction of anything wrong, deletion, a machine-readable export, restriction of processing, and to object to processing. You can also complain to your national supervisory authority, which in Romania is the ANSPDCP.
In the app, under Settings, you can download everything we hold about you and delete your account and its data yourself. Both work immediately.
Security
Passwords are hashed with a per-user salt and never stored in readable form. Password-reset links work once and expire, and only a digest of them is stored. Sessions use a signed, HTTP-only cookie, and only a digest of the session token is stored. Everything travels over HTTPS. Access to a school records is limited to that school.
Children and young people
Student pilots may be under 18. A school must have the appropriate parental consent in place where its national law requires it, which in Romania is for those under 16, before creating an account for them.
Changes
If this notice changes in a way that matters, the app will tell you and ask you to read it again.
Contact
Questions, or a request about your data: write to [email protected], or ask your flight school. If you are unhappy with the answer you can complain to the data protection authority in your country; in Romania that is ANSPDCP (dataprotection.ro).