Privacy Policy

Overview

AVSpot is a personal plane-spotting logbook. This policy explains what information the app collects, how it's used, and how you can delete it. AVSpot does not sell your data, does not show ads, and does not use advertising trackers. It does use Google Analytics for Firebase to understand, in aggregate, how the app is used.

AVSpot is available as an app for iPhone, iPad, and Android, and as a web app at app.avspot.app. This policy covers all of them, and AVSpot Premium, the optional subscription.

Information We Collect

• Account information - your name, email address, and profile photo, provided by Google or Apple when you sign in.
• Sighting data - aircraft registrations, types, airlines, and timestamps you log, the flight an aircraft was on when that's known (flight number, route, and altitude), plus any notes or photos you choose to attach.
• Shared flights - when you share a flight to AVSpot from a flight-tracking app such as Flightradar24, the shared text (the flight number, its route, and a link) is sent to our servers to identify the aircraft. If the share includes an image, AVSpot reads the text in it on your device; only that text is sent, never the image itself. Nothing is logged until you confirm it.
• Location data - the GPS coordinates of where you logged a sighting or spotting session, captured only while you're actively using the app to log something, never in the background. In the web app, your browser asks for your permission first.
• Push notification token - a device identifier used to deliver notifications, such as arrival alerts, if you allow them. When you sign out on a device, the app asks our servers to forget that device's token.
• Home airports and alert history - if you use arrival alerts (AVSpot Premium), the up to three airports you choose from AVSpot's airport list and what each should alert you about, and a record of each alert sent to you: the aircraft, the airport, about how far out it was and when. Alerts are deleted after 30 days. A home airport is a place you pick, not your device's location.
• Purchase information - if you subscribe to AVSpot Premium, a record of your subscription kept with your account: which product you bought, when, when it renews or ends, and the latest change to it (such as a renewal or a cancellation). Your card or bank details are entered with Apple, Google or Stripe and never reach us.
• Crash reports - if the app crashes or hits a serious error, a report of what went wrong: the app version, device model, operating system version, and technical details of the error, tagged with a random identifier for this installation. Crash reports aren't linked to your account and are used only to find and fix bugs.
• Usage data - which screens you open and how often you use the app, along with the app version, device model, operating system, language, and approximate region (country or city, estimated from your IP address), tagged with a random identifier for this installation. Usage data isn't linked to your account, and AVSpot doesn't collect your device's advertising identifier. Screens are recorded by type (for example "a sighting"), never by which aircraft or sighting you viewed. In the web app, usage data is collected only if you allow it: the web app asks on your first visit, and Google Analytics then keeps that random identifier in a cookie. If you decline, the web app doesn't load Google Analytics at all.

How We Use Information

Your account and sighting data are used to build your personal collection - stats, your "Hangar" of spotted aircraft, and your session history. Aircraft registrations you log may be sent to a free public aviation registry (adsbdb.com) to identify the type and airline, or matched against a copy of the public aircraft registry list that we keep on our own servers; only the tail number is used, never anything about you. When you share a flight to AVSpot, its callsign (such as UAL700) may be sent to a live flight data service (adsb.lol, and FlyItalyADSB when adsb.lol can't find it) to find which aircraft is flying it; again, nothing about you is sent.

If you subscribe and choose home airports, our servers regularly ask adsb.lol and FlyItalyADSB which aircraft are flying near each of those airports, compare them with your Hangar, and send you a notification about the ones you haven't logged. Those services are sent only the airport's position (and adsb.lol, to give earlier notice, the callsigns of airline flights near it), never anything about you or your logbook. The count of an airline's aircraft you've logged, and the Premium list of the ones you haven't, are worked out on our servers from your own Hangar and from aircraft data adsb.lol is asked for by aircraft type on a schedule.

Your purchase record decides whether AVSpot Premium is on for your account, on every device where you sign in. We use it for nothing else.

Who Can See Your Data

Your sightings, sessions, photos, saved spotting locations, and collection are private to your account. AVSpot does not currently have any public profile or social features that expose your logbook to other users.

Third-Party Services

AVSpot relies on these services to work. Google Firebase stores your account and logbook on our behalf; none of the others receive your name, email address, or logbook from us. If you subscribe on the web, the checkout page asks for your email address and payment details itself, and they go to RevenueCat and Stripe as described below.

• Google Firebase (Google LLC) - sign-in, and storage of your account data, sightings, and photos. Sign in with Google or Apple is used only to verify who you are. Firebase Cloud Messaging delivers notifications, such as arrival alerts, to your devices.
• RevenueCat (RevenueCat, Inc.) - manages AVSpot Premium subscriptions and tells our servers which plan your account has. The app identifies you to RevenueCat only by your AVSpot account's random user ID, never by name or email address, and sends it the purchases made with that account and the store receipts that confirm them, with technical details such as the app version and platform. For a web purchase, RevenueCat runs the checkout page and receives the email address you enter there. RevenueCat handles this data under its Privacy Policy.
• Apple App Store and Google Play - take payment for subscriptions bought in the iPhone, iPad and Android apps, under their own privacy policies. They tell RevenueCat about the purchase, not your payment details.
• Stripe (Stripe, Inc.) - for subscriptions bought on the web, Stripe sells the subscription to you as the merchant of record, through Link, its checkout service. The payment details and billing information you enter at checkout go to Stripe, which handles them under its own Privacy Policy and sends your receipts. We receive which plan is active and Stripe's reference for the product, never your card or bank details.
• Firebase Crashlytics (Google LLC) - receives the crash reports described above.
• Google Analytics for Firebase (Google LLC) - receives the usage data described above.
• Firebase App Check (Google LLC) - confirms that requests to our servers come from a genuine copy of AVSpot. In the mobile apps it uses Apple App Attest or Google Play Integrity: your device's operating system provides an attestation for the app, which doesn't include your name, email address, or logbook. In the web app it uses Google reCAPTCHA Enterprise, which looks at information about your browser and device and how the page is used to tell people apart from automated traffic; that information is covered by Google's Privacy Policy and Terms of Service.
• Google Maps - shows the maps used to pick and view spotting locations. Google receives the map area being viewed and your device's IP address.
• adsbdb.com - a free public aviation registry. Our servers send it only an aircraft registration to identify its type and airline.
• Mictronics aircraft database (via the tar1090-db list) - a free compilation of the public aircraft registries. Our servers keep their own copy of it, refreshed weekly, to identify an aircraft's type and registered owner when adsbdb.com has no record; nothing is sent to them. Its data is available under the Open Data Commons Attribution License.
• adsb.lol - a free, community-run source of live aircraft positions. When you share a flight to AVSpot, our servers send it only that flight's callsign to find the aircraft flying it. For arrival alerts they send it the position of each home airport that has a subscriber, and the callsigns of airline flights near it; for airline counts they ask it for aircraft by type. None of these requests carries anything about you. Its data is available under the Open Database License.
• Planespotters.net - a placeholder photo for an aircraft is loaded from their servers, so your device's IP address is visible to them when it loads. Only an aircraft registration or ICAO hex code is sent, never anything about you.
• OpenSky Network - when you look up which flight a sighting was part of, your device contacts OpenSky directly with the aircraft's ICAO hex code and the time of the sighting, so your device's IP address is visible to them.

Cookies and Browser Storage (Web App)

The web app at app.avspot.app stores a few things in your browser:

• Your sign-in session and app settings - kept in your browser's local storage so you stay signed in and your preferences (such as light or dark mode) are remembered. These are needed for the web app to work.
• Google Analytics cookies - set only after you choose Allow in the web app's cookie notice. They hold the random identifier described under Usage data, so visits can be counted in aggregate. You can change your choice at any time under Settings > Usage Analytics; turning it off stops collection and deletes these cookies.
• reCAPTCHA - Google's reCAPTCHA may set its own cookies as part of telling people apart from automated traffic.

Upgrade in the web app opens checkout in a new tab on RevenueCat's own site, with Stripe's payment form; those pages set their own cookies under their owners' policies.

AVSpot doesn't use advertising cookies. Signing out ends your session, and clearing your browser's site data for app.avspot.app removes everything stored there.

Data Retention & Deletion

We keep your data until you delete your account. You can delete your account at any time from Settings > Account > Delete Account. Deletion is permanent and erases everything AVSpot holds about you: your profile, every sighting and session, your collection, your saved spotting locations, your notification tokens, your home airports and alert history, your purchase record, and all photos you uploaded (including the resized copies and your profile photo). It normally completes within a minute. Copies held in Google's Firebase backup systems are purged on Google's own schedule.

Deleting your account doesn't cancel an AVSpot Premium subscription; cancel it first, as described on the AVSpot Premium page. Apple, Google, Stripe and RevenueCat keep their own records of a purchase under their own policies, for billing, tax and refunds. RevenueCat's record is filed under your account's random user ID; email us if you'd like it removed after your account is deleted.

Shared aircraft reference data (types, airlines, and registrations) is not personal data and is not deleted, though it no longer counts your sightings.

Children's Privacy

AVSpot is not directed at children under 13, and we do not knowingly collect information from children under 13.

Changes to This Policy

We may update this policy as the app changes. Material changes will be reflected by updating the date at the top of this page.

Contact Us

Questions about this policy? Email contact@sonoranapps.com.