Privacy Policy

Effective date: June 15, 2026

FlightFlow is a flight tracking service operated by Billion Web Pte. Ltd. in Singapore. This policy explains what data we collect, why, and what we do not do. FlightFlow needs no account, email, or password. Your flights back up to our cloud and return automatically on a new phone via iCloud (iPhone) or Google (Android), using a recovery key stored in your device's platform keychain.

What we collect

• Flight history. The flight numbers and dates you add, plus the derived schedule, status, and timing data we fetch on your behalf.
• Boarding passes (Pro). When you scan or upload a boarding pass, it is stored encrypted on your device only. It is never uploaded to our servers.
• Subscription history. Entitlement state from RevenueCat (plan tier, purchase date). We do not store card numbers.
• Device and usage data. Device model, OS version, locale, and in-app events (Firebase Analytics defaults). Used to debug and improve the app.
• Push token. A Firebase Cloud Messaging token so we can send the flight alerts you turn on, such as gate changes, delays, and cancellations.
• Location data (only for features that use it). In-flight Calm Mode reads on-device sensors (GPS altitude, speed, motion) to show a calming altitude and steadiness display while you fly. Location stays on your device and we do not track you between trips.
• Camera and photos (only when you scan). Used to scan a boarding pass so a flight can be added without typing. Images are processed for the barcode on your device and are not sent to our servers.
• Crash reports. Device state at crash time, via Firebase Crashlytics. Retained 90 days.

How we measure the app

• Usage analytics. Firebase Analytics records in-app events and basic device data so we can fix bugs and see which features matter. This is first-party measurement only: we never use it for advertising and never sell it. To object to analytics processing, email us or delete your account, which removes it.
• Conversion measurement (iOS). To understand which marketing brings new travelers, the iOS app uses Google On-Device Conversion Measurement. This is an aggregate, on-device signal that helps us measure how an ad performed. It does not read the advertising identifier, does not build a profile of you, and is not used to track you across other apps or websites.

What we do not do

• We do not sell your data. Ever.
• We do not show ads or run targeted advertising.
• We do not set tracking cookies on share-link recipient pages.
• We do not fingerprint devices, embed third-party ad SDKs, or share data with data brokers.

Third parties (processors)

These vendors process data on our behalf under Data Processing Agreements and, where applicable, EU Standard Contractual Clauses:

• Firebase and Google Cloud. Auth, Firestore, Cloud Functions, Hosting, Cloud Storage, Crashlytics, Analytics, and Cloud Messaging (push).
• Google. The Google Maps SDK renders the live route map on Android, and Google On-Device Conversion Measurement runs on iOS.
• Apple. Apple MapKit renders the live route map on iOS, and Apple Wallet stores boarding passes you add.
• RevenueCat. Subscription entitlements.
• FlightAware. Flight schedules, status, airport reference data, and aircraft position where available. No account PII transmitted.
• NOAA. METAR, TAF, and aviation weather context. No turbulence forecasts.
• OpenSky Network. Aircraft tail and historical movement context.
• Cloudflare. DNS and CDN.

Your rights

FlightFlow is designed to support the EU and UK GDPR (Arts. 15 to 17, 20), the California CCPA as amended by the CPRA, and Singapore's Personal Data Protection Act (PDPA), covering access, correction, deletion, and export. We do not sell or share your personal information, and we honor Global Privacy Control signals. To exercise these rights:

• In-app: Settings, Account, Export my data or Delete my account.
• Web: flightflowapp.com/data-deletion.
• Email: support@flightflowapp.com (response within 30 days).

Legal bases and supervisory authorities

Where the GDPR applies, we process your data on these bases: performance of our contract with you (tracking the flights you add and sending the alerts you turn on), and our legitimate interests (keeping the service reliable, secure, and improving it). You can object at any time with no loss of features.

You have the right to lodge a complaint with your local data protection authority. In the EU this is your national authority, in the UK the Information Commissioner's Office, and in Singapore the Personal Data Protection Commission. Our Data Protection Officer can be reached at support@flightflowapp.com.

Children

FlightFlow is not directed at children under 13 and does not knowingly collect data from them (COPPA, 16 CFR §312). If we learn we have collected such data, we will delete it.

Retention

Flight history is retained until you delete your account so you can export, audit, or use it for compensation claims. Share links automatically expire and stop working 48 hours after the flight lands, and the share record is deleted when you delete the flight or your account. Crash reports: 90 days. Analytics: 14 months. Account deletion triggers a hard delete after a 30-day soft-delete window, removing your data from our active systems.

International transfers

FlightFlow is operated by Billion Web Pte. Ltd. in Singapore. Firebase, RevenueCat, and other processors may process data in the United States and other countries under Standard Contractual Clauses (Schrems II, C-311/18). The iOS bundle includes the Apple privacy manifest (PrivacyInfo.xcprivacy) declaring APIs accessed and data categories collected.

Changes

We notify you in-app at least 30 days before material changes take effect. Prior versions are archived at /changelog.

Contact

Privacy questions: support@flightflowapp.com.
Data requests: support@flightflowapp.com.