Privacy Policy
Last updated 24 August 2026 · Applies to FlightMap for Android and iOS
This policy describes what the FlightMap app actually does. It was written by auditing the code, not adapted from a template, so every claim in it is meant to be checkable against the app itself. If anything here does not match how the app behaves, that is a bug in this document: please tell us and we will correct it.
The short version
- FlightMap is a logbook. You can use all of it without an account, and if you do, your flights never leave your phone.
- FlightMap never asks for or collects your location. There is no location permission in the app on either platform.
- The camera is used for one thing: reading the barcode on a boarding pass, on your device. No photograph is taken, saved, or sent anywhere.
- Your calendar is only ever read, never written to, and only when you turn that feature on.
- We do not sell your data, we do not share it with advertisers, and there is no advertising in the app.
- Usage analytics are switched off, and the typeface ships inside the app, so launching FlightMap sends nothing to Google about you.
Who is responsible for your data
FlightMap is made and operated by Zakaria Ybeggazene, an individual developer, who is the data controller for the purposes of the UK and EU General Data Protection Regulation (GDPR).
You can reach us at support@flightmapapp.com for anything in this policy, including any request to exercise the rights described below.
Using FlightMap without an account
Signing in is optional. There is no sign-in wall: you can install FlightMap, log flights, view your map, statistics and badges, and never create an account.
If you do not sign in, your flights are stored only in a database on your own device. They are not uploaded to us, and we have no way to see them. They are included in your device's own backups if you have those switched on, which is between you and Apple or Google.
In that state the only information that leaves your device is described under flight and airport lookups and analytics and crash reporting below.
What FlightMap stores about a flight
Whether stored locally or synced to your account, a flight record can contain:
- Flight number, airline name and airline IATA code
- Departure and arrival airport codes, cities and countries, and the airports' coordinates
- Departure and arrival times, stored as absolute instants together with the time zone at each end, and a marker recording whether a time is a recorded value or an estimate
- Distance flown and an estimated carbon figure, both calculated on your device
- Aircraft type and aircraft registration
- Seat number and cabin class
- Booking reference (PNR), when you enter one or when one is read from a boarding-pass barcode
- Any free-text notes you write
- How the flight was added (manually, from a boarding pass, or from your calendar), and when the record was created and last changed
You choose how much of this to fill in. A flight needs only its two airports and a date.
If you create an account
An account exists so that your logbook survives losing your phone and can appear on a second device. Creating one is your decision and it can be done at any time, or never.
We store your email address and, if you sign in with Google or with Apple, the account identifier and email address that provider gives us. Passwords are handled by our authentication provider and we never see or store them. If you use Sign in with Apple and choose to hide your email, we only ever receive Apple's relay address.
Once you are signed in, the flight records described above are copied to a database hosted by Supabase and kept in step with your device. Access is enforced at the database with row-level security, so a signed-in account can read and write only its own rows.
Permissions the app asks for, and why
| Permission | Platform | What it is for |
|---|---|---|
| Camera | Android, iOS | Reading a boarding-pass barcode. Nothing else in the app uses the camera. |
| Calendar | Android, iOS | Finding flight numbers in your own calendar entries so you do not have to type them. |
| Internet | Android | Flight and airport lookups, account sync, maps, purchases. |
All of these are optional. Decline the camera and you can still type a flight in by hand; decline the calendar and every other feature works normally.
A note on the Android calendar permission
On Android, FlightMap declares both READ_CALENDAR and WRITE_CALENDAR. The app never writes to, changes or deletes anything in your calendar. The calendar library the app uses requires both permissions to be declared in order to grant read access at all. We would rather explain this than quietly ask for a power we do not use.
Boarding-pass scanning
When you scan a boarding pass, the camera decodes the barcode entirely on your device. No image is captured, stored, or transmitted, and the camera preview is not recorded.
A boarding-pass barcode contains, among other things, the passenger name, the booking reference, the seat, the cabin, the flight designator and the two airport codes.
- The passenger name is discarded. FlightMap reads it as part of decoding the barcode format and then does nothing with it: it is never displayed, never saved, and never sent anywhere.
- The booking reference and seat number are saved to the flight record, because they are useful in a logbook. They are therefore also synced if you have an account. You can clear either of them by editing the flight.
Calendar scanning
If you enable it, FlightMap looks through the calendar entries on your device within a date window and reads each entry's title, description, location and time to spot things that look like flight numbers.
This search happens on your device. The contents of your calendar are not uploaded, and calendar entries that do not look like a flight are simply ignored and not retained.
The check runs in the foreground, once, shortly after you open the app. It is not a background service and it never adds a flight on its own. When you ask FlightMap to confirm a candidate it has found, the flight number and date from that entry are sent to our flight-data provider, exactly as described next.
Flight and airport lookups
When you look up a flight number, search for an airport or an airline, or confirm a flight FlightMap found in your calendar or on a boarding pass, the app sends the search term: a flight number and date, an airport code, or the text you typed. That goes to AeroDataBox, a third-party aviation data service reached through RapidAPI.
These requests carry no account identifier, no email address and no device identifier. They are not linked to you by us. As with any internet request, the provider will see the originating IP address. Results are cached on your device so that the same lookup is not repeated.
If you never use a lookup, typing your flights in by hand instead, no flight information is sent to this provider at all.
Analytics and crash reporting
FlightMap uses Google Firebase Crashlytics to find out when the app has crashed. It is switched off entirely in development builds.
Usage analytics are currently switched off. Measuring how an app is used means writing an identifier onto your device, and under the ePrivacy rules that needs your permission first, not merely a good reason. We have not built the screen that asks you, so rather than collect it on a technicality, we collect nothing. If that changes, you will be asked, the answer will default to no, and you will be able to change it in Settings at any time.
What crash reporting does not include is as important as what it does:
- No user identifier is ever attached. The app never sets a user ID on the crash reporter.
- No custom events are recorded. The app does not log a single event of its own: no flight, airport, route, email address or booking reference is ever sent.
- A crash report is a stack trace and the technical state of the app, plus the device model and operating system version.
- There is no advertising identifier, and nothing in FlightMap tracks you across other apps or websites.
We keep crash reporting on because an app that crashes on your logbook and never tells us is worse for you than a stack trace is. If you would rather it were also a choice, say so and we will make it one.
Fonts
The app's typeface, Inter, ships inside the app. It is not downloaded, so no request is made to Google's font servers and Google does not receive your IP address when you launch FlightMap.
This is worth spelling out because it is not the default. Left alone, the toolkit we build with fetches that typeface on first launch, which would hand Google your IP address before you had done anything in the app. We bundled the font instead, and the app is configured so that it cannot fetch one at runtime even by accident.
Maps and purchases
Google Maps renders the 2D map. Displaying a map involves requesting map data from Google, which necessarily reveals which part of the world you are looking at and your IP address. FlightMap only ever centres the map on the airports in your logbook, never on you. The app does not know where you are.
RevenueCat manages the FlightMap Pro subscription and one-time unlock, recording purchase and entitlement state. If you are signed in, your account identifier is passed to RevenueCat so that a purchase follows your account to a new device; if you are not signed in, an anonymous identifier is used instead. Payment itself is handled entirely by Apple or Google. We never see your card details, and no payment information reaches us or RevenueCat.
Everyone we share data with
| Service | What it receives | When |
|---|---|---|
| Supabase | Email address, account identifier, your flight records | Only if you create an account |
| AeroDataBox (via RapidAPI) | A flight number and date, an airport code, or a typed search term. No identifier. | Only when you look something up |
| Google Firebase (Crashlytics) | Crash diagnostics: a stack trace, device model and OS version | In the released app, when it crashes |
| Google Maps | Map region requested, IP address | When you open the map |
| RevenueCat | Purchase and entitlement state, your account identifier or an anonymous one | If you open the paywall or purchase |
| Apple / Google | Payment and subscription handling | If you purchase |
We do not sell personal data, we do not share it for advertising, and FlightMap contains no advertising.
Why we are allowed to process this (GDPR legal bases)
| What | Basis |
|---|---|
| Storing and syncing your flights when you have an account | Performance of a contract: this is the service you asked for |
| Your account and email address | Performance of a contract |
| Reading your camera or calendar | Consent: the device permission prompt, which you can withdraw in system settings at any time |
| Flight and airport lookups | Performance of a contract, at your request |
| Crash reporting | Legitimate interests: keeping the app working for you |
| Usage analytics | Consent, and until we can ask for it properly, this is switched off |
| Subscription and entitlement | Performance of a contract |
How long we keep it
- Flights on your device stay until you delete them or uninstall the app.
- Flights in your account stay until you delete them or ask us to delete the account. Deleting a flight marks it deleted immediately on every device; the row is then removed.
- Cached lookup results live on your device and expire on their own.
- Crash reports are kept for the retention period set in Firebase, currently the service default. No analytics data is being collected to retain.
Where your data is
Our providers are US-headquartered and may process data outside the European Economic Area. Where that happens, transfers rely on the European Commission's Standard Contractual Clauses or an equivalent safeguard offered by that provider. If you use FlightMap without an account, no flight data leaves your device to be transferred anywhere.
Children
FlightMap is not directed at children and we do not knowingly collect data from anyone under 16. If you believe a child has created an account, write to us and we will delete it.
Your rights, and how to delete your account
If you are in the UK or the EEA, you have the right to access your data, to correct it, to have it erased, to restrict or object to processing, to data portability, and to withdraw consent where consent is the basis.
To delete your account and everything in it, email support@flightmapapp.com from the address you signed up with, asking for deletion. We will delete your account and all flight records held against it, and confirm when it is done. We aim to act within 30 days and usually much sooner.
There is no in-app delete button yet; it is planned. Until it exists, the email above is the route, and it is the one we will honour.
You can remove the data on your device at any time without contacting us, by deleting flights in the app or uninstalling it. Uninstalling removes local data but does not by itself delete an account.
Any request under this section is free. You also have the right to complain to your local data protection supervisory authority.
Changes to this policy
If this policy changes in a way that matters, we will change the date at the top and, for a significant change, say so in the app. The English version of this policy is the authoritative one.