Privacy Policy

This policy is written for visitors in the United States (including California), the United Kingdom, the European Union, Thailand, India, and elsewhere. It is plain language, not a substitute for advice from a lawyer. The controller is Clovis de Bontin LLC, 500 4th St NW, Suite 102, 1329, Albuquerque, NM 87102, United States. Contact: louis@cdb.solutions. EIN: 30-1434698.

What we collect

Account email and Supabase authentication records. At signup you confirm you are 16 or older. We store that confirmation and the time it was made. We do not collect a date of birth or an identity document. Votes, custom pins, spot tips, and content reports store your user id. An optional Telegram handle, if you add one after purchase. Stripe billing data is handled by Stripe, not stored as a full card number here. Server logs may include an IP address for a short time at the host. Vercel Web Analytics is cookieless. We do not run a separate analytics_events store and we do not write raw IP addresses into our database. Rate-limit counters stay in memory for a few minutes and are then dropped.

Why, and the legal basis

We use the account to let you vote, save a pin, send a tip, and manage a subscription (contract, and steps you ask us to take before a contract). We use the age check to keep children off the service (legal obligation and legitimate interests). We use Stripe to take payment (contract). We use host logs to keep the service available and to limit abuse (legitimate interests). Map, weather, and traffic requests are how the product works (legitimate interests, or contract if you are a subscriber).

Processors

Supabase (authentication and database), Vercel (hosting and cookieless Web Analytics), Stripe (payments), Telegram (only if you open the bot or a Telegram Mini App), OpenStreetMap (street tiles), Esri (satellite tiles), RainViewer (optional radar), NOAA Aviation Weather Center (METAR and TAF), datis.clowd.io (US D-ATIS text), and the public ADS-B feeds airplanes.live and adsb.lol. A CARTO dark basemap is in the code and is not requested by the current map switch. Community spot coordinates may come from Wikimedia Commons and OpenStreetMap.

International transfers

These processors may store data outside your country, including the United States and the European Union. Where GDPR or UK GDPR applies, we rely on the provider's standard contractual clauses or an equivalent transfer tool. Thailand PDPA and India DPDP transfers follow the same processor list.

Retention

Account data stays until you delete the account or ask us to delete it. Billing records may remain with Stripe for the period Stripe and tax law require. Server logs follow the host's normal short retention. Anonymous historical pins and tips that have no user id stay readable and are not editable.

Your rights

You can access, correct, export, and delete your data from Account settings, or by emailing louis@cdb.solutions. Export downloads a JSON file. Delete removes or anonymizes the profile, votes, pins, and tips tied to your user id, and asks Stripe to stop the subscription. You may also complain to a supervisory authority. California residents: we do not sell personal information and we do not share it for cross-context behavioral advertising. You can still use the delete and export tools as your opt-out of sale or sharing. We do not offer a financial incentive for personal data.

Children

The service is not directed at children. We do not knowingly create accounts for anyone under 16 (COPPA uses 13 in the United States; GDPR Article 8 uses 16 in the EU unless a country sets a lower age). Signup is blocked unless you check the box: I confirm I am 16 or older. That is a self-declaration. We do not ask for a birth date or an ID. If we learn an account is under 16, we will delete it.

Cookies

See the Cookies page. The only cookies we set on purpose are the sign-in session and, if you use Google sign-in, a short-lived confirmation cookie that is deleted when sign-in finishes. We do not use a consent banner because we do not set non-essential cookies and analytics is cookieless.