When you sign up on our website
The website asks for your name, your email address and what you are (a pilot, a student pilot, a flight school, or just curious) before it opens the app. A flight school is also asked for its name. That is kept as a contact record so we can reach schools that are trying the service, and it is emailed to us as a notification. It is used only for that.
If you sign up as a pilot or a student pilot you also choose a password, and that creates your account (see below). If you are just curious, or a flight school looking around, no account is created.
If you write to us through the contact form
The "Talk to us" form on the home page asks what kind of organisation you are, its name, and (for a flight school, aero club or university) roughly how many students it trains. It asks for your name and email address. Your role, phone number, country, how you heard about us and a message are optional. Please do not put health or other sensitive details in the message.
- Why: to reply to you and, if you want one, to set up a trial. The basis is taking steps at your request before an agreement, and our legitimate interest in answering people who write to us.
- Marketing: the box asking whether we may email you news is separate and unticked. Without it we write to you only about your enquiry. If you tick it, the basis is your consent, and you can withdraw it at any time by telling us.
- Who sees it: the enquiry is saved in our database at Cloudflare and emailed to us through Resend. It is not sold or shared with anyone else, and not used to build a profile.
- How long: an enquiry is deleted 12 months after you send it, sooner if you ask. If you become a customer, the details we need are kept as part of your account instead.
- Not required by law: you do not have to give us these details. Without a name and an email address we cannot reply.
If you just use the map
You do not need an account to track flights, look at weather or plan a route. If you have no account:
- Nothing you do is stored on our servers. Your routes, waypoints, notes, settings and downloaded map areas stay in your own browser, on your own device. Clearing your browser data erases them, and we cannot recover them. (Once you have an account, your saved routes and waypoints and your aircraft are kept in it instead, so they follow you between devices.)
- Our server sees the technical details every web request carries: your IP address, the time, and what you asked for. That is unavoidable when a browser talks to a server. We use it only to answer the request and keep the service working, and we do not build a profile from it.
- We use no advertising, analytics or tracking cookies of any kind. The page on cookies and local storage lists exactly what is stored on your device.
Pilots and students who are not with a flight school
If you sign up as a pilot or student pilot on our website, your account is held in VECTOR SCHOOL, a test-bed school that VectorEFB itself runs. For those accounts VectorEFB is the controller, not a flight school, and the operator of VECTOR SCHOOL can see the records in it: your recorded flights, your logbook, your plans and your aircraft. We use them to run and improve the service and to help you, and for nothing else. They are not sold or shared. Everything else in this notice applies to you in the same way, including the right to download and delete it all.
Your logbook here is a convenience, not your official one. Where the law requires you to keep a pilot logbook, keep it in the form the law asks for.
If your flight school gives you an account
Then your school decides what is recorded about your training, and we store it on its behalf. We hold:
- Your account: the name your school enters, your username, and your password stored as a salted hash that cannot be reversed.
- Contact details, if given: an email address and a phone number. Both are optional. The email is used only to send you a password-reset link you asked for. An instructor's email and phone are shown to everyone at their school as a contact list; a student's are shown only to the school's instructors.
- Other ways you set up to sign in, if any: for a passkey, the public half of the key, the name you gave it and when you added it. The private half never leaves your device. For a linked Google account, Google's identifier for it and its email address. Linking Google only lets you sign in to the account your school already made; it never creates one.
- Your logbook and saved routes, if you keep them in the app.
- Your aircraft and checklists, if you enter them: registration, type, performance figures and checklists. They are kept in your account so they are still there on a new phone.
- A notification address for each phone, if you turn notifications on: the address your phone's push service gave the app, the kind of browser and phone it came from (its user agent), and the time it was added. See Notifications below.
- Planning sessions: the flights you plan and send to your instructor, including route, altitude, fuel figures, aircraft and times.
- Briefing record: that your app requested weather information, when, and for which airports. Not the contents of your screen, and nothing about what else you looked at.
- Recorded flights, if you choose to record one: the positions, altitudes and speeds your device reported while recording, the times, and any fuel figure you enter.
- Instructor reviews: the verdict and note your instructor writes on a plan.
- Safety reports, if you file one or are given an action: what you write about what happened (when, where, which aircraft), your name only if you chose to give it, and the school’s follow-up: a risk rating, any actions given to an instructor with their dates, and the note written when the report is closed. A report filed without your name stores no name at all. Only the school’s safety manager sees all of them, and a named reporter sees their own. VectorEFB’s administrator accounts cannot open a school’s safety reports in the app.
Your school can see all of that. So can VectorEFB's own platform administrators — the small team that runs the service itself, not your school — for account support, troubleshooting a school's setup, and keeping the service running. That access is not automatic for every member of that team: it is limited to the administrator accounts set up for this purpose, and used for support and operation of the service, never to read your training record out of curiosity, never sold, and never used for anything beyond what this notice lists. Nobody else sees it: not other schools, not other students, not the map you look at, your notes, your private waypoints or your calculations.
Bug reports
If you send a bug report from the app, we receive what you write, up to a few screenshots you choose to attach, the page you were on, the app version, the kind of browser and phone you use (its user agent) and, from your account, your name, email address, role and school. Screenshots can show anything on your screen, so check them before you send. We use a report only to find and fix the fault and to reply to you. The basis is our legitimate interest in fixing faults. Reports are seen by the platform administrators, are deleted 12 months after they are sent or sooner if you ask, and are deleted with your account.
Access requests, enquiries and other records about people who are not yet users
The details people give us on the website (the contact form, the request-access forms and the sign-up form) and the platform records we keep about them (name, email address, role, school and the terms accepted) are kept for as long as we need them to answer or decide, and in any case no longer than 12 months after the last contact, unless the person has become a user. Approved requests are kept while the account exists. You can ask us to delete any of it earlier.
The Learning hub and News pages
The Learning hub and News pages are public and set no cookies. The lessons and calculators run in your browser and send nothing to us. The News page lists headlines from public sources and links to them; opening a link takes you to that site, which has its own privacy rules. Videos load from YouTube only after you press Play, as described under Who else sees the data.
Flight recording
Recording is under your control. It starts only when you press record, the app shows that it is recording while it runs, and it stops when you stop it. A recorded track is location data about you, so it is treated as the sensitive thing it is: shared only with your flight school, never sold, never used for anything else, and deletable on request.
Who is responsible for what
Your flight school is the data controller: it decides what is collected about your training and why. We are the processor, acting on the school's instructions under a written agreement — which is also the basis on which our own administrators can access school records directly, for support and operation of the service. If you want your data changed or deleted you can ask either of us; where the school is the controller, we act on its instruction.
Notifications
Notifications are off until you turn them on, from your name at the top of the map. When they are on, we send lesson reminders, changes to your lessons, plan reviews and new work from your instructor, and a reminder if a flight you recorded has not been sent yet. We store the address your phone's push service (Google, Apple or Mozilla, depending on your phone) gave us, the kind of browser and phone it came from (its user agent), and nothing else about the phone. The message itself is encrypted so that the push service can deliver it but cannot read it. Turn them off in the same place, or by signing out, and the address is deleted.
Legal basis
For school accounts, the processing is necessary for the training the school provides and for its legitimate interest in supervising flight safety. Where consent is the basis, most obviously for recording a flight, you can withdraw it at any time by not recording and by asking for existing recordings to be deleted.
Who else sees the data
- Cloudflare hosts the app and the database. The school database is located in Eastern Europe.
- GitHub stores the encrypted nightly backups and runs the scheduled jobs (reminders and backups). It cannot read the backups.
- Google, Apple and Mozilla run the push services that deliver notifications to phones. They receive the address of your phone and an encrypted message.
- YouTube (Google) serves the optional videos on the Learning hub pages, only after you press Play. Google then receives your IP address, your browser details and the video you chose, and may set its own cookies. Until you press Play nothing is requested from YouTube.
- Vercel runs a small relay that fetches public flight positions. It never receives your account data.
- Resend sends our emails: password-reset links, invitations and approval messages, and the notices to us that someone signed up, wrote to us through the contact form or asked for access. It receives the address the email goes to and the email itself.
- Google is involved only if you choose to link a Google account. You sign in on Google's own page, and Google tells us your Google identifier, name and email address. We keep the identifier and email, not the name. Google learns that you signed in to VectorEFB.
- Public aviation and weather data services. Most are asked through our server, so they see our server and not you: aviation weather (NOAA), airspace (openAIP), the search for an aircraft photo (Planespotters), forecast winds and cloud (Open-Meteo) and the radar frame list (RainViewer). A few are asked directly by your browser, so they receive your IP address and the map area you are looking at: the aircraft photo itself (Planespotters), radar images (RainViewer), satellite and storm imagery (EUMETSAT), the base map (CARTO, and EOX for the satellite layer) and terrain (Amazon Web Services). Live traffic is different: your browser asks our relay at Vercel, which receives your IP address and the map area and asks adsb.lol on your behalf, so adsb.lol sees the relay and not you. We do not send them your name or account details.
These providers are in the United States and process data under the standard safeguards for international transfers. A current list is kept with this notice.
How long it is kept
Your school sets a retention period; the default is two years. Records older than that are deleted, after the school has been shown what will go. Delete your own account and everything belonging to it goes at once. If someone at your school erases your account, it is closed immediately and deleted for good after 14 days, in case it was a mistake. Safety reports are the exception to the retention period: the school keeps them for as long as its own safety manual says, and if your account is erased the reports stay, with your name removed.
Backups
To protect your records from being lost, an encrypted copy of the whole database is made every night and kept for up to 90 days in a private repository at GitHub. The copy is encrypted before it leaves our server, with a key GitHub does not have, so GitHub holds only unreadable files. Sessions, reset links and notification addresses are not included. Because these copies expire on their own, something you delete disappears from the live service at once and from these backups within 90 days.
Your rights
Under the GDPR you can ask for a copy of your data, correction of anything wrong, deletion, a machine-readable export, restriction of processing, and to object to processing. You can also complain to your national supervisory authority, which in Romania is the ANSPDCP.
In the app, under Settings, you can download everything we hold about you and delete your account and its data yourself. Both work immediately.
Security
Passwords are hashed with a per-user salt and never stored in readable form. Password-reset links work once and expire, and only a digest of them is stored. Sessions use a signed, HTTP-only cookie, and only a digest of the session token is stored. Everything travels over HTTPS. Access to a school's records is limited to that school.
Children and young people
Student pilots may be under 18. A school must have the appropriate parental consent in place where its national law requires it, which in Romania is for those under 16, before creating an account for them.
Your acceptance, and what we record about it
Every account is asked to read this notice and the terms of use and to tick a box saying it has done so, before the account can be used. We keep a record of the version you accepted and when. The basis is our legitimate interest in being able to show that you were informed (GDPR Article 6(1)(f)). If a version changes in a way that matters, you are asked again.
Access is personal, and the service is protected
VectorEFB's software, design and content are protected by copyright and other law, and your account is personal to you. The terms of use (clause 9) forbid copying or recreating the service or its content, scraping it, using it to train artificial intelligence models, and passing on non-public information about features that are not yet released. While VectorEFB is in private pre-launch, you have been given access personally and by invitation, and what you see is confidential in the same way.
Our own database does not store the IP address of the people who use the service. A short-lived counter in the memory of the server limits repeated requests, and our hosting provider (Cloudflare) may keep its own standard server logs, which we do not use to profile anyone. If we suspect a breach of the terms we may use what the provider holds, and the account concerned, to investigate it or to bring or defend a legal claim (our legitimate interest, Article 6(1)(f)). If you object, you can tell us; we will weigh your reasons against our need to protect the service.
While VectorEFB is in private pre-launch, the details you give when you ask for access (your name, email address, role, school and which terms you accepted) are used only to decide on your request and, if it is approved, to set up your account.
Changes
If this notice changes in a way that matters, the app will tell you and ask you to read it again.
Contact
Questions, or a request about your data: write to contact@vectorefb.com, or ask your flight school. If you are unhappy with the answer you can complain to the data protection authority in your country; in Romania that is ANSPDCP (dataprotection.ro).