Privacy Policy

Overview

Air Boss (“we,” “our,” or “us”) operates the Air Boss web dashboard at air-boss.club and the Air Boss mobile app (collectively, the “Service”). Flying clubs and flight schools use the Service to run their operation; you use it as a member, administrator, instructor or dispatcher of a club. This policy describes what we collect, how we use it, who can see it, and your choices.

Most of the data in Air Boss is your club's operational record. Your club decides who joins, what documents it requires, and who holds the administrator role; we store and process that record on the club's behalf.

Information We Collect

Account and profile. Your name, email address, an optional phone number and profile photo, and the clubs you belong to with your role in each.

Club records you create. Flight logs (meter readings, flight time, dates, cost), aircraft reservations, squawk reports, maintenance entries, club messages and broadcasts, feedback you send us, and the photos described below.

Documents your club requires. Pilot certificates, medical certificates, flight reviews, insurance and similar documents you upload so your club can confirm you are current. These are visible only to you and your club's administrators.

Technical data. The type of device or browser, app version, push-notification device tokens, and error reports (see Error Monitoring below). The mobile app does not collect your device's location.

Billing. Club subscriptions are paid by the club through Stripe, our payment provider. Card details are entered on Stripe's forms and are never stored by us.

Photos and Scanned Pages

Meter photos (optional). When you use the meter scan feature in the mobile app, the photo of the instrument panel is sent securely to our AI processing partner (Anthropic) to read the meter values. Anthropic does not use this data to train its models and retains it only transiently for processing; we do not store photos with the AI provider. The photo is then kept in private storage attached to the flight record, visible to members of your club through expiring, signed links, and deleted automatically one year after capture. Scanned readings are never recorded automatically: you review and confirm every value before a flight is saved. Manual entry is always available.

Fuel receipt photos (optional). Handled the same way by the same AI partner to read the total, gallons, date and vendor, which you confirm or correct before anything is saved. Because receipts can show the last four digits of a payment card or a fuel-account number, they are stored more privately than meter photos: only you and your club's administrators can open them, through expiring, signed links. Receipt photos are deleted one year after the flight is logged.

Aircraft logbook scans. Clubs that use the logbook archive photograph their aircraft maintenance logbooks page by page. Pages are stored privately as a permanent, tamper-evident archive of the paper record and are kept for as long as the club keeps the aircraft record. Where the club turns on entry extraction, page images are sent to the same AI partner under the same terms to draft logbook entries, which a person reviews before anything is recorded.

Squawk photos are stored privately: only active members of the squawk's club can open them, through expiring, signed links. Please still avoid putting personal information in a squawk photo, since everyone in your club can see it.

Aircraft photos, profile photos and club logos are stored in publicly addressable storage: they are not listed or searchable, but anyone who has the exact link can view them.

Aircraft Position

While a club aircraft is in the air, the Service can show its position to members of that club on a map. The position comes from public ADS-B transponder broadcasts collected by a third-party feed (adsb.lol), not from anyone's phone. Because the open flight is attributed to the pilot who started it, other members of your club can see which aircraft you have and where it is while your flight is open. If your club does not want this feature, contact us and we will turn it off for your club.

Map tiles are served by Google Maps (mobile app) and Esri ArcGIS (website); loading a map sends your device's IP address to those providers in the ordinary way. Weather on the home screen comes from aviationweather.gov and sends only the airport code.

Notifications and Email

Push notifications (reservation reminders, squawk alerts, club broadcasts, your pre-flight brief) are delivered through OneSignal, which holds a push token for each device you sign in on. Emails, including club broadcasts and the weekly summary sent to club administrators, are sent through Resend. Every notification type can be turned off in the app's notification preferences, and every non-essential email carries an unsubscribe link that works in one click.

If you subscribe to your reservations in a calendar app, the feed link contains a private token: anyone with the link can read your reservations. You can regenerate or revoke that token at any time from the calendar card on your profile.

Signing In

You can unlock the mobile app with Face ID, Touch ID or your device's fingerprint sensor. The biometric check is performed by your phone's operating system; we never receive your biometric data. The app stores only a random device credential, which you can clear by signing out.

Sign-in, sign-up and password-reset forms on the website are protected against bots by Cloudflare Turnstile, which evaluates browser signals and may set a cookie for that purpose. Social sign-in (Apple, Google) shares only your name and email address with us.

How We Use Your Information

We use the data we collect to run your club's operation in the Service, send the notifications and emails described above, process club billing through Stripe, keep the Service secure, fix problems, and comply with applicable law. We do not sell your personal information, and we do not use it for advertising.

Who Can See Your Data

Within your club, flight records, reservations, squawks and aircraft status are visible to other members according to the roles your club administrator has configured. Your required documents and fuel receipts are visible only to you and your club's administrators. If you join more than one club, each club sees only its own records.

Outside your club, we share data only with the service providers that run the platform, each under its own confidentiality terms: Supabase (database, file storage and authentication, hosted on Amazon Web Services in the United States), Vercel (website hosting), Stripe (billing), Resend (email), OneSignal (push notifications), Sentry (error monitoring), Anthropic (photo and page reading, as described above), Cloudflare (bot protection), and the map and weather providers named above. We may disclose information if required by law or to protect the rights and safety of our users.

Data Retention and Deletion

We keep your information while your account is active. Meter and fuel receipt photos are deleted one year after capture; logbook archives are kept with the aircraft record. You can delete your account from the mobile app (Profile → Delete Account) or by emailing us. Deleting your account removes your profile, sign-in credentials, documents and photos. Flight, billing and maintenance entries you created remain in your club's records, because they are the club's operational and financial history, but they are no longer linked to your name. Database backups are kept for seven days, so deleted data leaves our backups within a week.

Security

All connections are encrypted, access is enforced row by row in the database according to your club membership and role, and private files are reachable only through time-limited, signed links. No method of transmission or storage is completely secure; we cannot guarantee absolute security.

Your Choices

You can update your profile and notification preferences in the app at any time, revoke your calendar feed token from your profile, and delete your account as described above. To request a copy of your data, or to ask a question about it, contact us at support@air-boss.club.

Children

The Service is for members of flying clubs and flight schools and is not directed to children under 13. We do not knowingly collect personal information from children under 13; if you believe a child has created an account, contact us and we will delete it.

Cookies and Tracking

Essential — The website sets a sign-in session cookie so you stay signed in, and uses browser local storage for preferences such as your cookie choice. These are required for the Service to work and are not used for tracking.

Vercel Analytics — We use Vercel Analytics to understand aggregate page-view traffic. Vercel Analytics is cookieless and does not set any browser cookies or collect personally identifiable information.

Vercel Speed Insights — We use Vercel Speed Insights to collect anonymous Core Web Vitals data (page-load performance). This service is also cookieless and does not track individuals.

Meta Pixel (optional, consent required) — The site is integrated with the Meta Pixel to measure the effectiveness of marketing campaigns on Facebook and Instagram. The Meta Pixel sets third-party cookies and sends event data to Meta Platforms, Inc. This tracking is disabled by default. It is only activated after you explicitly click “Accept” in the cookie banner shown on your first visit. You can withdraw consent at any time by clearing the airboss_cookie_consent key from your browser's local storage, which will cause the banner to reappear on your next visit.

Sentry (error monitoring) — When something goes wrong on the website, in the mobile app, or on our servers, a technical error report is sent to Sentry so we can find and fix the problem. A report includes the error itself, the page or screen it happened on, and the type of browser or device. On the website, we configure Sentry not to collect cookies, form contents, or IP addresses, and we remove one-time links and codes from page addresses before a report is sent. In the mobile app, a report from a signed-in member includes only that member's account ID, never a name, email address or phone number. Sentry does not set cookies, is not used for advertising, and does not record your session.

No other analytics, advertising pixels, session-recording tools, or fingerprinting services are in use at this time.

Changes to This Policy

We may update this policy from time to time. When we do, we will revise the “Last updated” date above. Continued use of the Service after changes are posted constitutes your acceptance of the revised policy.

Contact

Questions about this policy? Reach us at support@air-boss.club.