Flight Kneeboard — Privacy Policy

Flight Kneeboard is built to need as little of your data as possible. There are no accounts and no tracking of any kind — nothing that identifies you, your device, or your session is stored anywhere, and no third-party analytics service is used.

We do keep a small set of counters about the server itself: how many requests each part of the API served, how many bytes went out, how long they took, which chart editions were fetched, and whether the scheduled data refreshes succeeded. These are how we decide what to keep on disk and notice when a government data source breaks. They are totals, not records — see What we count.

The iOS app contains no advertising. The website at flightkneeboard.app may display advertising on wider screens; see Advertising below. Ad code is never loaded inside the app.

Location

With your permission, the app uses your device's precise location to show your position on the moving map and to drive navigation displays (course, distance, terrain awareness, synthetic vision). Location is processed on your device. As you move the map or fly, the app requests charts, terrain, and weather for the surrounding area from our own server; like any web request, those carry your IP address and imply a general area of interest. We do not build location histories or profiles, and nothing is linked to your identity. The server counters described below never record a coordinate, a map area, an individual tile, or a route you enter — not the route itself, not its length, and not the distance it covers.

Motion sensors

The iOS app's flight instrument dashboard reads two of your device's own sensors: the barometer, for pressure altitude, and the accelerometer, for load factor and the backup attitude display. The first time you open the instrument panel, iOS asks for Motion & Fitness access; if you decline, the instruments simply show nothing and the rest of the app is unaffected.

These readings are used on your device, in the moment, to draw the instruments. They are never sent to our server, never stored, and never linked to you. Nothing from the barometer or accelerometer leaves your device.

Sim Connect

The iOS app can take position, altitude and attitude from a portable receiver on the same Wi-Fi network as your device — a Stratux or echoUAT speaking GDL90, or a flight simulator broadcasting X-Plane / ForeFlight position sentences. This is off until you turn it on in Settings → Sim Connect. The first time you do, iOS asks for Local Network access; if you decline, nothing arrives and the rest of the app is unaffected.

When it is on, the app listens for broadcasts on your local network and reads the position they contain. It also broadcasts a short announcement roughly every five seconds — the app's name and the port it is listening on — because some receivers only send to a device that has announced itself. It notes the address of anything that sends to it, so the diagnostics panel can show you what is talking, and those addresses are held in memory only and go when the app closes.

It does not scan the network, probe it, or catalogue what else is on it, and nothing about your network leaves the device. What arrives is used exactly as your device's own GPS would be: shown on the map, fed to the instruments, and never stored as a track. It is not streamed to us: the one case where your position leaves the device is the winds-aloft lookup that draws the glide ring, which rounds it to one decimal place — about six nautical miles — and asks for the winds over that area. We keep no history of those requests beyond the short-lived technical logs described below.

What we store

• On your device: downloaded charts and data for offline use, your settings, and saved flight plans. These never leave the device and are removed when you delete the app.
• In your browser: the website keeps a small amount of local storage for your own choices — the US/worldwide toggle, the map framing, and whether you dismissed the ad strip. It holds no identifier, is never sent to us, and clearing site data removes it.
• Waiting to be sent: if the app cannot reach us when it would normally send the counters described below — you were offline, or the connection was not carrying anything — they wait in local storage instead of being thrown away, and go the next time there is a connection. It is the same handful of counters, nothing more: no identifier, no position, no station you looked at. They are discarded unsent after seven days, and clearing site data or deleting the app removes them.
• On our server: standard, short-lived technical logs (IP address, request path, timestamp) used only to operate and protect the service, plus the aggregate counters described in What we count. We store no user accounts and no personal records.

What we count

From the iOS app, once per launch. When the app opens and has a connection it asks the server for the minimum-supported-version policy — it has always done this — and that same request now also increments two counters: which marketing version of the app it is (1.1, 1.2), and whether the person opening it has a subscription, as one of four words: none, subscribed, founding or unknown. No extra request is made and nothing else rides along. These are daily totals; there is no account, no cookie, and no identifier that persists from one day to the next. We do not send or store the build number, which plan was chosen, what it cost, or when it was bought; Apple holds all of that and we do not ask for it. The two counters exist to answer “is the fleet updating” and “is this still worth running”, and nothing finer.

Running this service means deciding what to store and noticing when something upstream breaks. That needs numbers, and the numbers are deliberately shaped so they cannot be about you.

What is counted. For each part of the API: how many requests it served, how they ended (served, unchanged, refused, failed, or cancelled), how long they took, and how many bytes they returned. Alongside that: which chart edition, plate cycle and offline pack were requested, how often a rate limit was hit, which government data source failed, and whether each scheduled refresh succeeded, was skipped, or failed.

Counting devices, without being able to follow one. To answer “how many people used this today” rather than “how many requests were made”, the server derives an eight-byte hash from your network address and browser agent. The key it is hashed with is created fresh each day and destroyed when that day is pruned, so the same device on two days produces two unrelated values that cannot be linked — the count is real, and it cannot become a history. The address and agent themselves are never stored. From the same request we also count, as daily totals only, which app version, which device family (iPhone or iPad), which iOS major version, and which country the request came from.

What is never counted, in any form.

• No IP address is stored, and none is ever written down — not in full, not shortened, and not in a log.
• No cookie, session identifier, or account. Nothing is stored on your device to recognise you, and nothing we keep survives from one day into the next.
• No name, email, or any field you have typed.
• No coordinates, map areas, or individual map tiles.
• No route you type — not the airports, not the route string, not a hash of it, not its length, and not the distance it covers.
• No web address you visited, beyond which part of the API it belongs to.
• No record of any single request. Every figure is a running total for an hour or a day, so there is no row anywhere that corresponds to something you did.

Why that is enough to keep this anonymous. Small totals are the ones that could describe a single person, so they are deliberately destroyed: when an hour or a day closes, any figure below a threshold is merged into a single “low” bucket and the detail is deleted. Anything that reflects what you have downloaded is kept by week rather than by day, because a day-by-day series is a calendar of when a device was in use. Nothing accumulates a lifetime total.

Where it lives. On our own server, in a separate file, reachable only from the password-protected operator console — never from the app or the website. It is not shared, sold, or sent anywhere, and there is no third-party analytics service involved. It is kept for at most 400 days.

Your rights. Because none of it identifies you, there is nothing in it to look up, correct, or delete on your behalf — a request to do so has no record to act on, which is the intended result rather than an evasion. The whole store can be erased at any time from the operator console.

Third parties

Aeronautical and weather data originate from public government sources (FAA, NOAA/NWS, NASA) and open datasets (AWS Terrain Tiles, ESA WorldCover), fetched through our server. When you are online, base-map imagery is loaded from Esri (whose Canvas basemaps carry Esri, HERE, Garmin and OpenStreetMap data); those requests go directly to their servers and carry your IP address, subject to their own privacy policies. No other third party receives anything from the app. We never sell or share data about you — there is nothing to sell.

Advertising

The website may display advertising supplied by Google AdSense: on the guides, calculators and data pages, and as a dismissible strip below the map in the browser version of the EFB. Where ads are shown, Google may set cookies and use your IP address and browsing information to select and measure them; that processing is governed by Google's own policies, and you can review and change your choices at myadcenter.google.com. Ads are never placed over the chart — the strip sits below it and the map controls move up to make room.

The iOS app does not load ad code at all. This is enforced in the page itself, not merely hidden: the advertising script is only requested when the page is running in a browser, so no advertising network ever sees a request from inside the app. We do not share your location or any flight data with advertisers, and we do not use advertising identifiers.

Consent in the EEA, UK and Switzerland

If you are in the European Economic Area, the United Kingdom or Switzerland, a consent message will appear before any personalised advertising runs, using Google's certified consent management platform. You can consent, decline, or open Manage options to choose purpose by purpose — declining is a single click, exactly like consenting. Declining does not restrict any part of this site: every chart, calculator and guide works the same either way, and you may still see non-personalised ads.

To change your answer later, clear this site's data in your browser and the message will appear again on your next visit.

Children

The app is a general-audience aviation utility and does not knowingly collect personal information from anyone, including children.

Changes

If this policy changes, the updated version will be posted at this address with a new effective date.

Contact

Questions: [email protected]