Privacy Policy

Last updated: 4 October 2026

Flighto works without an account. There are no ads, no tracking and no analytics tools. Most of what the app knows about you stays on your device. This page explains what still leaves it, where it goes and how long it is kept.

1. Who is responsible

This policy covers the Flighto app on iPhone and Android and the website flighto.app.

2. On your device

On your device, without sending anything to us, the app stores your My Flights list, the airports, aircraft and flights you recently opened from search, your settings and a randomly generated installation ID (such as anon:3f2b…). The installation ID says nothing about you or your device; it only lets our server and RevenueCat recognise the same installation (sections 5 and 6). All of this is gone when you delete the app.

3. Location

Only if you allow it does the app read your location while it is open, to start the map there. We don't store it, and it is not sent to us. To load the aircraft in view, the app sends the centre of the map to adsb.lol, rounded to two decimal places, which is about one kilometre (section 4). When the map shows your surroundings, that is roughly your location. You can withdraw the permission at any time in your device settings; the map then starts without your location.

4. Map, aircraft and weather

The app loads these features directly from the following services, without our server. Each service technically receives your IP address and the content of the request.

• Google Maps (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, and Google LLC, USA) displays the map. Google receives the map area and data that the Maps SDK collects itself: device model and system version, a device identifier, performance and crash data, and how the map is used. Google also uses this data for its own purposes, such as improving the service. The Google Privacy Policy and the Google Maps Additional Terms of Service apply.
• adsb.lol, an openly accessible community project for aircraft positions (adsb.lol), provides live positions and routes. It receives the rounded map centre and, when you search for an aircraft, your search term (callsign, flight number, registration, transponder code). We don't know where its servers are located or whether requests are logged there. Live aircraft data © adsb.lol contributors, ODbL 1.0.
• aviationweather.gov, the aviation weather service of the US weather agency NOAA, provides weather at airports. It receives the codes of the airports whose weather the app shows.

The legal basis is Art. 6(1)(b) GDPR: without these requests, the app could not show the map, the aircraft or the weather.

5. Flighto Pro and our server

For flight status, notifications, Live Activities, My Flights, route search and airport boards, the app asks our own server. It runs on Cloudflare (section 11) and processes:

• With every such request, your installation ID, to check with RevenueCat whether you can use Flighto Pro (section 6). The server keeps the result for at most five minutes. Plus the request itself, such as flight number and date, the airports of a route, or a registration.
• Flight data from AeroDataBox. Our server fetches the answers from the flight data provider AeroDataBox (via the API.market marketplace). Only flight number, date, airport or registration go there, nothing about you. The server caches the answers briefly, with no link to you.
• For notifications, if you allow them: your device's push token (from Apple or Google), platform, app language, 12- or 24-hour clock and your My Flights list (flight number, date, departure airport, whether you are flying or picking someone up, scheduled departure and arrival time, whether the flight should get a Live Activity).
• For Live Activities (iPhone only): the tokens to start and update them, language, light or dark appearance, 12- or 24-hour clock, whether the app is currently open, and the content last shown.

The legal basis is Art. 6(1)(b) GDPR.

How long: The list on the server mirrors your list in the app. If you remove a flight, it is gone there at the next sync, and every flight drops out 24 hours after it arrives. If you turn off notifications, we delete your device's registration and, unless a Live Activity depends on it, the list. If you delete the app, we remove the registration as soon as Apple or Google report the token as invalid. Anything left after that, such as language and appearance for Live Activities, we delete at your request (section 12).

Logs: For operation and troubleshooting, Cloudflare keeps a technical log of every request to our server: time, requested address, the request headers including IP address and installation ID, and error messages. It is deleted automatically after seven days at most. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is secure and reliable operation.

6. Trial, purchase and subscription

RevenueCat (RevenueCat, Inc., USA) manages the trial and the subscription for us. RevenueCat receives your installation ID, the purchase data from the App Store or Google Play (product, dates, price and currency, transaction identifiers), device and system information and your IP address. Neither RevenueCat nor we receive payment details such as card numbers: Apple and Google handle purchase and payment under their own privacy policies. The legal basis is Art. 6(1)(b) GDPR. The data stays with RevenueCat while you use Flighto; we delete it at your request.

Trial: Every device gets three days of Flighto Pro once. So that nobody gets the trial again and again by reinstalling, we remember that a device has had it:

• On iPhone through Apple's DeviceCheck service. Apple stores two bits for your device and our developer account; we store nothing about it ourselves.
• On Android from the Android ID that the system assigns to the app. We store only a check value derived from it with a secret key (HMAC), from which the ID cannot be recovered.

The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is preventing abuse of the free trial. This marker remains for as long as we offer a trial. The link between the trial and your installation ID on our server deletes itself after three days.

7. Notifications and Live Activities

Notifications and Live Activities are delivered by Apple (Apple Push Notification service) and Google (Firebase Cloud Messaging). They receive the push token and the content, such as "LH 400 departs 35 minutes late". Whether you receive notifications is up to you, in the settings of the app and of your device.

8. App updates

At launch, the app asks Expo's update service (650 Industries, Inc., USA) whether a new version is available. Expo receives your IP address, operating system, app version and a random identifier that Expo uses to count how many devices have loaded an update. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is fixing bugs without a new download from the store.

9. Website

The website flighto.app sets no cookies, loads nothing from third-party servers and contains no analytics tools. When you visit it, Cloudflare processes your IP address and your browser's details to deliver the page and protect it against attacks (Art. 6(1)(f) GDPR). We keep no logs of these visits ourselves.

10. Contacting us by email

If you write to us, we process your email address and your message in order to reply (Art. 6(1)(b) GDPR, for general enquiries Art. 6(1)(f)). Our mailbox is hosted by Google (Gmail). We delete the message once the matter is settled, unless a statutory retention period applies.

11. Service providers and countries outside the EU

The following work on our behalf as processors under Art. 28 GDPR:

• Cloudflare, Inc., 101 Townsend St., San Francisco, USA: runs our server and the website on its global network. Cloudflare is certified under the EU-US Data Privacy Framework.
• RevenueCat, Inc., USA: subscription and trial. Transfers to the US are covered by the European Commission's Standard Contractual Clauses.

Both are contractually bound to protect the data at least as well as this policy describes. Google, Apple, Expo, adsb.lol and NOAA process the data they receive from your device under their own responsibility. Google LLC and 650 Industries (Expo) are certified under the EU-US Data Privacy Framework. NOAA in the US and adsb.lol, whose location we don't know, give no such assurance; protection there may be lower than in the EU.

12. Your rights and how to have data deleted

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can object to processing based on our legitimate interests on grounds relating to your particular situation (Art. 21). Write to iscoresport@gmail.com.

Because Flighto has no accounts, we can only find your data through the installation ID. You'll find it in the app under My Flights → gear → Sources, at the very bottom. Send it to us and we will delete everything for that ID on our server and at RevenueCat. You cancel a subscription through the App Store or Google Play; we cannot delete purchases made with Apple or Google.

You may lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example the one responsible for us: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestraße 2–4, 40213 Düsseldorf, Germany.

13. What we don't do

No ads, no tracking across other companies' apps and websites, no selling of data, no profiles and no automated decisions under Art. 22 GDPR. You don't have to give us any data; without it, some features won't work, for example notifications without a push token.

When the app changes, we update this policy. The version on this page applies.