Privacy Policy

1. Data Controller

• Batooldev.com
• Bashrat Ali Iqbal
• c/o flexdienst — #21516
• Kurt-Schumacher-Straße 76
• 67663 Kaiserslautern
• Deutschland

Contact: support@flightcockpit.net. Full contact details are listed on the Impressum page.

2. Overview

FlightCockpit consists of this website, a user account, the FlightCockpit Desktop app for Windows and the FlightCockpit app for Android. This policy explains what each part processes. Live flight data from Microsoft Flight Simulator travels only inside your local network from the Desktop app to your tablet or phone; it does not pass through our servers. The flight logbook (Section 7) is the only feature that stores flight data in your account.

3. Website and Launch List

When you submit the "Notify me at launch" form on flightcockpit.app, we collect:

• Your email address.
• Your plan interest ("Pilot" or "Not sure yet").
• How you arrived at the page (UTM source or HTTP referrer), if available.
• Your browser locale (e.g. de-DE, en-US).
• Your IP address and browser user-agent string, recorded only as proof-of-consent for this privacy policy.
• The hash and label of the privacy policy version you accepted.

We process this data to (a) send you a single welcome confirmation on signup and a single launch-notification email when FlightCockpit ships, (b) measure aggregate waitlist health and pricing interest, and (c) provide proof of your privacy-policy consent. Legal basis: Art. 6(1)(a) GDPR (your consent). You can withdraw this consent at any time — see Section 13. Retention: until you withdraw your consent, and at the latest three months after the public launch of FlightCockpit v1.0 — the launch notification is what the list is for.

This form no longer covers emails about joining the beta. Taking part in the beta works through an application in your account (Section 9). If you signed up through the earlier beta-list form (October 2026) and agreed there to receive emails about joining the beta, we send you one email with the link to apply.

4. Your Account

When you create an account we store your email address and a password hash, or — if you sign in with Google — your Google account ID and email address. We also store your display name and country (for tax purposes), your app settings, and the version of this policy you accepted (with IP address and browser user-agent as proof). Legal basis: Art. 6(1)(b) GDPR (providing the service you signed up for); proof of consent: Art. 6(1)(c) and (f) GDPR. You can delete your account at any time; see Section 11.

5. Plan, Subscription and Payment

If you subscribe, payment is handled by Stripe. We store your plan, its term, and the customer and subscription identifiers Stripe gives us, plus the notifications Stripe sends us about your subscription. We never see your card details. Legal basis: Art. 6(1)(b) GDPR. We keep these payment records for 8 years because § 147 AO (German fiscal code) requires it; they are not deleted when you delete your account — see Section 11.

6. Desktop App, Licence and Device Pairing

The Desktop app requests a signed licence token that states your plan; it is valid for seven days and stored encrypted on your PC. To pair a tablet or phone we store, per device: a device fingerprint, the device name, platform, a public key, when it was last seen and — if your plan's device limit is exceeded — when it was disabled. Pairing tickets are valid for five minutes and are deleted 24 hours after they expire. To protect the service from abuse we keep short-lived rate-limit records (your user ID or IP address) for about five minutes, and log licence issuance and other security-relevant actions (user ID, IP address, user-agent) for 12 months. Legal basis: Art. 6(1)(b) and (f) GDPR (security of the service).

So that your tablet finds your PC again after its address in your home network changes, the Desktop app — while it is running and you are signed in — announces its local network address (for example 192.168.0.23), its port and its version over a private real-time channel that only your own account can read. This information is held only in the memory of the real-time service (Supabase) while the Desktop app is connected and is not stored in a database; it disappears when you close the app. The same private channel tells the Desktop app and your tablet when a paired device is disabled, enabled again or removed from your account. Legal basis: Art. 6(1)(b) GDPR.

7. Flight Logbook

If you use the FlightCockpit Desktop bridge while signed in, it records your flights in Microsoft Flight Simulator and stores them in your account so you can see them in the mobile app. For each flight we store: the date and times (simulator clock and your computer's clock), departure and arrival airport or, where there is none, the coordinates; the aircraft name and, if the simulator provides it, its registration; landings and landing rate; fuel used; a coarse track of the flight (roughly one position every 30 seconds); and whether the flight was complete. This is simulator data, not your real-world location. If you tap "I'm interested" under "Pilot logbook is coming", we store that you did so.

Legal basis: Art. 6(1)(b) GDPR — providing the logbook you use as part of the service. You can switch recording off at any time in the settings of the FlightCockpit app on your phone or tablet ("Record flights"; on by default); the setting belongs to your account and applies to every PC you sign in on. The first time you open the logbook in the app, it tells you that recording is on and lets you keep it or switch it off; while recording is off, the logbook says so and lets you switch it back on. Retention: until you delete a flight or your account; deleting your account deletes all flights. Recipients: Supabase (eu-central-1, Frankfurt).

8. Feature Requests and Roadmap

You can submit feature requests and vote on other users' requests. Requests and vote counts are shown publicly without your user ID attached. Legal basis: Art. 6(1)(b) GDPR.

9. Beta Application

If you apply for the beta in your account, we collect:

• The simulators, aircraft and devices you choose, and an optional free-text entry for other aircraft.
• The email address of your Google account for Google Play. It can differ from your FlightCockpit email address; we pre-fill the latter, and you can change it.
• Optionally, one sentence about what you would like to test.
• The status of your application (new, approved or on hold), when and by whom it was approved, whether we have entered your Google address in the Google Play tester list, and whether the approval email was sent.

We use this to choose testers whose setup fits what we need to test, and to give them access: on approval we unlock the Windows download for your account and send you an email with the link to the Android test. We make the selection ourselves; there is no automated decision. Legal basis: Art. 6(1)(b) GDPR — you ask to take part in the beta by applying. There is no consent checkbox because you start the application yourself.

To let you join the Android test we enter your Google account address in the tester list of the Google Play Console. Google processes it for that purpose, and Google Play only lets that account join the test. If your application stays on hold, nothing is passed on.

Retention: until you withdraw the application (possible until it is approved), until you delete your account, and at the latest three months after the public launch of FlightCockpit v1.0 — whichever comes first. After approval you can still change the Google address in your account. The beta access setting on your account is not deleted with the application; it ends when you delete your account.

10. Recipients and Processors

• Supabase (database, authentication and file storage; eu-central-1, Frankfurt).
• Vercel (web hosting).
• Upstash (rate-limit counters for this website — your user ID or IP address, kept for at most one hour; Frankfurt, read replica in Dublin).
• Stripe (payment processing).
• Resend (transactional email delivery).
• Google Ireland Limited (Google Analytics 4, only after you consent via the cookie banner — see Section 13; Google Sign-In; and Google Play for the Android beta test — only the Google account address you give in your beta application, and only if we approve you, see Section 9).

The FlightCockpit Android app also uses Google's ML Kit for barcode scanning during device pairing; this runs entirely on your device, and no scan data is sent to Google or to us.

Downloads and update checks for the Desktop app are served from our storage bucket through our own domain; these requests transmit your IP address to Vercel and Supabase. Where a processor is located outside the EU/EEA, or transfers data there, we rely on the EU-US Data Privacy Framework or Standard Contractual Clauses, as applicable to that provider.

11. Retention and Deletion

Deleting your account removes your profile, settings, paired devices, dashboard layouts, logbook entries, feature-request votes, beta application and consent records immediately. Two exceptions are kept without further reference to your account, because we are legally required to or to protect the service: payment records (8 years, § 147 AO — Section 5) and security/audit logs (12 months — Section 6). Pairing tickets are deleted 24 hours after they expire. Rate-limit records are kept for about 5 minutes. Beta applications are also deleted when you withdraw them and at the latest three months after the public launch of v1.0 — Section 9. Waitlist records are deleted when you withdraw your consent and at the latest three months after the public launch of v1.0 — Section 3; Google Analytics data as described in Section 13.

12. Your Rights

Under GDPR you have the right to (a) access your data, (b) request correction or deletion, (c) restrict or object to processing, (d) data portability, and (e) lodge a complaint with a supervisory authority. Exercise any of these by emailing support@flightcockpit.net.

The supervisory authority responsible for us is the Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz (LfDI RLP). You may also lodge a complaint with any other competent supervisory authority, in particular in the EU member state of your habitual residence, place of work, or the place of the alleged infringement.

13. Withdrawal of Consent / Google Analytics

You may withdraw your waitlist consent at any time with effect for the future. Email us and we'll remove your waitlist record within 30 days.

flightcockpit.app uses Google Analytics 4 (GA4), a web analytics service, with your consent given via the cookie banner shown on your first visit. Google Analytics only sets a cookie and receives data after you click Accept; if you click Reject or do not respond, no analytics cookie is set and nothing is sent to Google.

• Processor: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
• Data categories: page views, session duration, device/browser type, approximate location (city-level, derived from an anonymised IP address), referrer/UTM source, and the custom events download_desktop_click and checkout_started.
• IP anonymization is active — Google truncates your IP address before any storage or processing.
• Retention: 14 months, after which Google automatically deletes the data.
• Withdrawal: click Cookie Settings in the footer at any time to change your choice. Withdrawing consent stops new data collection immediately; it does not delete data already sent to Google.

Legal basis for both the waitlist and Google Analytics 4: Art. 6(1)(a) GDPR (your consent).

14. Changes

We will update this policy as FlightCockpit's features evolve, and will change the version label at the top of this page whenever we do.