Privacy Policy

Last updated: February 28, 2026

1. Data Controller

AeroTail is developed and operated by Souvik Biswas, an individual developer based in India. For the purposes of the EU General Data Protection Regulation (GDPR) and India's Digital Personal Data Protection Act, 2023 (DPDPA), Souvik Biswas is the data controller (data fiduciary under DPDPA).

Contact: privacy@aerotail.app

2. Data We Collect

Account Information

When you sign in with Apple or Google, we receive your name and email address as provided by the authentication provider. Apple Sign-In users may choose to hide their email. This data is used solely for authentication and is stored in your user profile.

Device Identifier

We generate a random UUID on your device to identify it for settings sync and notification delivery. This identifier is not linked to your name, email, or user account.

Location Data

With your consent, we collect your device's location to show nearby aircraft and deliver proximity alerts. Your last known location is stored on an anonymous device record identified only by the random device UUID. Location data is not linked to your name, email, or user identity. Only the random device ID, FCM push token, and location coordinates are stored together. Location is overwritten on each update; only the latest position is retained.

Push Notification Token

We store your Firebase Cloud Messaging (FCM) token on the anonymous device record to deliver proximity alert notifications.

Usage Counters

We track daily counts of proximity notifications sent and flight details viewed per device to enforce free-tier limits. These counters reset daily and are stored on the device record.

Subscription Status

If you subscribe to AeroTail Pro or Ultra, we store your subscription tier, product identifier, and expiration date to manage feature access. This is stored on both your user profile and device record. All purchases are processed by Apple through the App Store. We do not collect or store payment information.

Crash Reports

We use Firebase Crashlytics to collect anonymous crash reports including stack traces, device model, OS version, and app version. Crash reports are not linked to your identity.

3. Location Data Anonymity

Your location is stored on an anonymous device document that contains only:

A random device UUID (generated locally, not tied to hardware or Apple ID)
Your FCM push notification token
Your last known geographic coordinates
Notification settings and subscription tier

There is no link between this device record and your user account (which holds your name and email). This means your location cannot be traced back to your identity through our database.

4. How We Use Your Data

Display nearby aircraft on the map relative to your position
Send proximity alert notifications when aircraft enter your detection radius
Authenticate your account and sync settings across sessions
Manage subscription tiers and enforce free-tier usage limits
Diagnose crashes and improve app stability

5. Legal Basis for Processing

We process your data on the following legal bases:

Consent (GDPR Art. 6(1)(a) / DPDPA Sec. 6) — for location data collection and push notification delivery. You grant consent via iOS permission prompts and can withdraw it at any time through iOS Settings (Location Services or Notifications). Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.
Contract performance (GDPR Art. 6(1)(b)) — for account management, authentication, and subscription services necessary to provide the app.
Legitimate interest (GDPR Art. 6(1)(f)) — for crash reporting and service improvement, balanced against minimal data collection and anonymization.

6. Third-Party Services

AeroTail uses the following third-party services:

ADSB.lol and airplanes.live — public ADS-B aircraft tracking APIs. We send only geographic coordinates to fetch nearby aircraft. No user identity is shared.
OpenSky Network — aircraft data API. We send only geographic bounds. Credentials are managed server-side. No user identity is shared.
AeroDataBox (via RapidAPI) — flight route and airline information. We send only aircraft callsigns. No user identity is shared.
Firebase (Google Cloud) — provides authentication, Firestore database, Cloud Messaging (push notifications), Cloud Functions, and Crashlytics (crash reporting).
Apple — provides Sign-In with Apple authentication and processes all in-app purchases and subscriptions.
Google — provides Google Sign-In authentication.

No user-identifying information is shared with aircraft data providers. Only geographic coordinates or flight callsigns are transmitted to look up aircraft information.

7. Cross-Border Data Transfers

Your data is processed on Google Cloud (Firebase) servers, which may be located outside India and the European Economic Area. These transfers are compliant with:

DPDPA Section 16 — data is not transferred to any country restricted by the Central Government of India.
GDPR — Google Cloud maintains appropriate safeguards including Standard Contractual Clauses for international data transfers.

8. Data Retention

Location data — overwritten on each update. Only your latest position is stored. No location history is maintained.
Account data — retained while your account is active.
Device records — stale device documents are automatically cleaned up after 30 days of inactivity.
Daily usage counters — reset daily and retained only for the current day.
Crash reports — retained per Firebase Crashlytics default retention policy (90 days).

9. Your Rights

Depending on your jurisdiction, you have the following rights regarding your personal data:

Under GDPR (EU/EEA residents):

Right of access — obtain a copy of your personal data
Right to rectification — correct inaccurate data
Right to erasure — request deletion of your data
Right to data portability — receive your data in a structured format
Right to restrict processing
Right to object to processing
Right to withdraw consent at any time without affecting prior processing
Right to lodge a complaint with your local EU/EEA supervisory authority

Under DPDPA (Indian residents):

Right to access information about your personal data
Right to correction and erasure of personal data
Right to grievance redressal — contact us at the email below
Right to nominate another person to exercise rights in case of death or incapacity
Right to lodge a complaint with the Data Protection Board of India

Under CCPA (California residents):

Right to know what personal information is collected
Right to delete personal information
Right to non-discrimination for exercising your rights
We do not sell personal information

To exercise any of these rights, contact us at privacy@aerotail.app.

10. Account Deletion

You can delete your account and all associated data directly within the app via Settings. You may also request deletion by contacting us at privacy@aerotail.app. Upon deletion, we will remove your user profile, device records, and all associated data. Requests made via email will be completed within 30 days.

11. Children's Privacy

AeroTail is not directed at children. Under India's DPDPA, a child is defined as any individual under 18 years of age. Under the GDPR, the default age of digital consent is 16 (which may be lowered to 13 by individual EU member states). Under US law (COPPA), the threshold is 13.

We do not knowingly collect personal data from children as defined by applicable law. We do not engage in tracking, behavioral monitoring, or targeted advertising directed at children. If you believe a child has provided us with personal information, please contact us at privacy@aerotail.app and we will promptly delete it.

12. What We Do Not Collect

We do not use advertising or ad-tracking SDKs
We do not perform cross-app tracking or use the IDFA
We do not collect browsing history, contacts, photos, or health data
We do not sell, rent, or share your personal data with third parties for marketing purposes
We do not use cookies (AeroTail is a native iOS app)

13. Data Security

We protect your data using industry-standard security measures:

All data in transit is encrypted using TLS (Transport Layer Security)
Data at rest is encrypted by Firebase (Google Cloud) and iOS system-level encryption
Authentication is handled by Firebase Auth via Apple and Google's secure sign-in infrastructure

While we take reasonable measures to protect your data, no method of electronic transmission or storage is 100% secure.

14. Data Breach Notification

In the event of a personal data breach that poses a risk to your rights, we will:

Notify affected users without undue delay via their registered communication channel
Report the breach to the Data Protection Board of India within 72 hours of becoming aware (as required by DPDP Rules 2025)
Notify the relevant EU/EEA supervisory authority within 72 hours where required by GDPR Art. 33

15. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "Last updated" date. Continued use of AeroTail after changes constitutes acceptance of the revised policy. For material changes, we will make reasonable efforts to notify users.

16. Contact

If you have questions about this Privacy Policy, wish to exercise your data rights, or have a grievance regarding data processing, contact us at:

privacy@aerotail.app