Privacy

Privacy by default.

Effective August 31, 2026

Controller

Alec Schneider Solutions, Inhaber: Alec Peter Schneider, Pappelallee 25, 10437 Berlin, Germany. Email: alec@a3.lol.

Onboard flight data

InFlight requests telemetry directly from data endpoints made available by supported aircraft Wi‑Fi systems. The app processes flight numbers, routes, coordinates, altitude, speed, and cabin-pressure readings on your device. By default, this flight telemetry is not sent to us or to our analytics provider.

The airline or onboard connectivity provider operates those endpoints and may receive ordinary network information, such as your device's local network address and request details, as part of providing its Wi‑Fi service. Its own terms and privacy information apply to that processing.

The iPhone app stores flight history locally on your device so you can revisit prior flights. A history entry can include the flight number, origin and destination airports, onboard provider, local departure and arrival times, and sampled altitude and cabin-pressure readings. Device coordinates are not stored in flight history, and the history is not transmitted to us. You can remove all history from the Flight History screen; it otherwise remains until the app's data is removed, for example by deleting the app.

Optional device location

During an active flight, the iPhone app first uses coordinates supplied by the aircraft's onboard flight-data endpoint. If that endpoint does not provide a valid position, the app may ask for permission to use your location while the app is in use. A recent device location and movement course can then place and orient the aircraft marker on the map. If neither source is available, the marker falls back to an estimate based on route progress.

Device location is processed only on your iPhone. We do not store it in flight history or send it to our servers, Discord, PostHog, or another analytics provider. Location updates stop when the live flight view closes or onboard coordinates become available. You can deny or revoke location permission in iOS Settings without losing the other flight-data features.

Optional email updates

You may give us your email address and separately choose (1) InFlight product updates and (2) occasional promotions about other products from Alec Schneider Solutions. Each choice is optional, starts unchecked, and is based on your consent (Article 6(1)(a) GDPR). Signing up is not required to use InFlight.

We are currently collecting preferences only. Records remain unverified and we do not send marketing or product-update email until an email-confirmation process is available. Before any such email is sent to addresses in Germany or elsewhere in the EU, we will require confirmation through a double opt-in process.

The website and apps send your choices through our Vercel-hosted API. The API normalizes and encrypts the email address before storing it in Convex Cloud, together with a keyed pseudonymous lookup value, the selected purposes, consent-copy version, source surface, locale, and timestamps. We do not put email addresses or lookup values in product analytics. Vercel, Inc. and Convex, Inc. act as processors for this feature. The current Vercel function and Convex deployment are hosted in US East; their data-processing terms provide safeguards for international transfers, including the EU Standard Contractual Clauses. See the Vercel Data Processing Addendum and Convex Data Processing Agreement.

You can change the two choices independently by saving the form again. You can withdraw both at any time using “Withdraw this address” in the website or app. Withdrawal does not affect prior lawful processing. On withdrawal, we remove the recoverable encrypted address and retain only the keyed lookup marker and consent history as needed to document and honor the withdrawal. You may request deletion by contacting us.

Website analytics

Optional website analytics remain completely off until you select “Allow analytics.” If you consent, we use PostHog EU Cloud to understand approved page categories, App Store link clicks, email-signup steps, and support or feedback form outcomes. PostHog stores a random pseudonymous browser identifier in local storage and a first-party cookie so we can distinguish new and returning use across visits. The website separately stores your analytics choice so it can honor that choice. Automatic event capture, session recordings, exception capture, advertising profiles, and person profiles are disabled. “Do Not Track” is respected.

We send only a fixed allowlist of event names and properties such as the InFlight product and surface, a deployment version, a broad page label, a fixed placement label, success status, selected email purposes, contact topic, and a coarse error category. We do not send your name, email, form text, full URL or query string, referrer, flight number, route, coordinates, altitude, speed, cabin pressure, or onboard Wi‑Fi name. You can reject analytics initially or withdraw consent at any time through “Analytics choices” in the footer. Withdrawal stops future collection and removes the browser's PostHog analytics identity; it does not affect processing that occurred before withdrawal.

App analytics

Analytics in the iPhone and Apple Vision Pro apps are off until you explicitly enable them. If enabled, the apps send the same fixed allowlist of product-interaction events and properties, including app launch, connection attempts and outcomes, first flight data received, demo use, email-signup outcomes, contact-form outcomes, the app surface, and app version. PostHog stores a random pseudonymous device identifier so events can be grouped across app sessions. We do not attach your name or email, create a person profile, or send flight numbers, routes, coordinates, onboard network names, sensor measurements, or free-form text. You can turn analytics off again in the app; doing so stops future collection and clears the analytics identity on that device.

Hosting, analytics, and legal basis

Vercel, Inc. hosts this website and its API and may process ordinary request and security logs. Analytics data is processed by PostHog, Inc. in its EU Cloud region. Vercel and PostHog act as our processors. Because they are US companies, limited support or administrative access may involve a transfer outside the EEA under their data-processing terms and applicable safeguards, including Standard Contractual Clauses. Website hosting and security are based on our legitimate interest in operating and protecting the service (Article 6(1)(f) GDPR). Website and app analytics are based on your consent (Article 6(1)(a) GDPR and Section 25(1) TDDDG).

Support and feedback

If you use a support or feedback form, we process your message, category, app surface and version, and any name or reply email you optionally provide. The website API delivers this information to a private support or feedback channel in Discord. Discord, Inc. acts as a processor. We use support details to respond to your request (Article 6(1)(b) or (f) GDPR) and feedback to improve InFlight (Article 6(1)(f) GDPR). Do not include booking references, payment details, or other sensitive travel data. Discord's data-processing terms provide safeguards for transfers outside the EEA, including Standard Contractual Clauses. We review and delete submissions when they are no longer needed, normally within 12 months, unless a longer period is required for an unresolved request or legal obligation.

Optional flight diagnostics

In TestFlight builds and signed private preview builds only, if you explicitly enable flight diagnostics, InFlight sends a raw response from the active onboard flight-data supplier, together with the supplier name, app version, a random diagnostic-session identifier, and the time of capture, through our Vercel-hosted API to a private diagnostics channel in Discord. Depending on the aircraft supplier, the raw response can include the flight number, route, aircraft-supplied coordinates, aircraft or tail identifiers, altitude, speed, heading, and timing information. It does not include device GPS location, your name, email address, booking details, payment information, app analytics identifier, request headers, cookies, or full endpoint URL. Diagnostics are unavailable in public App Store installations.

This private-beta troubleshooting feature is off by default, uploads at most once per minute while enabled, and can be turned off at any time. We process diagnostics only to investigate the flight-data issue you chose to share (Article 6(1)(a) GDPR). Vercel, Inc. and Discord, Inc. act as processors; their data-processing terms provide safeguards for transfers outside the EEA, including Standard Contractual Clauses. We delete diagnostic snapshots after the troubleshooting purpose is complete and no later than 30 days after receipt.

If you contact us by email instead, Google Workspace, provided by Google, processes your email address, message, and any information you choose to provide. We retain email correspondence only as long as needed to resolve the request and meet applicable legal obligations, then delete it under our normal mailbox cleanup process.

Retention

We retain an active email address and its preference history while at least one email purpose remains selected. After withdrawal, the recoverable address is removed and the minimal consent record is reviewed and deleted when it is no longer needed to demonstrate compliance or honor the withdrawal. You may request earlier deletion. PostHog product events are configured for a 12-month retention period. Website analytics consent and the pseudonymous browser identifier remain on your device until you withdraw, clear site data, or the browser expires them. Native analytics consent and the pseudonymous device identifier remain on your device until you change the setting or remove the app's data. Local flight history remains until you clear it in the app or remove the app's data. Vercel, Convex, and Google Workspace operational and security logs are retained for the limited periods used by those services and our account configuration.

Children

InFlight is not directed to children for marketing purposes. If you are under 16, do not submit the optional email form without authorization from a parent or guardian where required. A parent or guardian may contact us to request deletion of an address submitted by a child.

Your rights and complaints

You may request access, correction, deletion, restriction, data portability, withdraw consent, or object to processing where applicable. Withdrawal does not affect earlier lawful processing. Because analytics is pseudonymous and not linked to an account or contact information, we may be unable to associate a data point with you. Contact alec@a3.lol. You may also complain to the Berliner Beauftragte für Datenschutz und Informationsfreiheit or another competent supervisory authority.