Data you own and control

Here’s exactly what leaves your device, where it goes, and what we don’t do with it. No hand-on-heart language: the point of this page is to tell you the shape of the data flow in specific enough terms that you can decide for yourself whether it is the shape you want.

Where your syndicate data lives

The primary database is hosted in Ireland and the sync service is configured for the EU. Other providers and their support or subprocessors may process data elsewhere under the safeguards described in the Privacy Policy. The app keeps a local copy on your device, a filtered slice of the relevant data, so it can run without a signal; writes queue locally and push back when you reconnect. The filter is per-membership: you only ever receive data for syndicates you belong to.

The kinds of data that replicate to the device (bookings, usage logs, maintenance, financial transactions, and so on) are listed on Offline capabilities. Some areas are deliberately online-only (invites, notification preferences) because they either need a server-side check or are too sensitive to last-write-wins conflicts. Payments replicate so you can see them without a signal, but making one always goes to the server.

What else leaves your device

Fault diagnostics. On iOS and Android, we ask separately after sign-in whether you want to send crash and error reports. Either answer lets you use the app. The choice belongs to your account on that device; change it in Profile → Security → Crash reporting. Reports include sanitised error categories, stack traces, device/OS/app details, installation and session identifiers and your internal account ID. They help us fix faults and are not advertising or behavioural analytics. Firebase Crashlytics still stores crash information locally when sending is off. We discard reports from unapproved or mixed-account runs; approved reports may be sent at a later app startup under remembered permission, before sign-in finishes. Turning reporting off stops new reporting, but cannot recall an upload already authorised. Google processes reports in the US and other countries. See the Privacy Policy for details.

Push notifications. On a phone, notifications reach you through Firebase Cloud Messaging, also run by Google on our behalf, which on an iPhone hands them to Apple’s push service for delivery. It holds your device’s push token and carries a short fixed alert, the notification’s type and the record identifiers the app needs to open the right screen. The notification’s own text stays in the app.

The web app uses neither Google service.

Exchange rates. When you scan a receipt paid in a currency other than your syndicate’s, the app asks Frankfurter (frankfurter.dev), a free service that publishes the European Central Bank’s reference rates, for that day’s rate so it can suggest the converted amount. The request carries the two currencies and the date and no account data; like any request over the internet, it shows your device’s IP address.

Payment and verification data also goes to the payment provider. The app uses other services for specific features, including public-register and flight lookups; the Privacy Policy describes those recipients. We do not use an advertising or general-purpose behaviour analytics SDK.

Some providers also work on our side rather than on your device: the email delivery service that sends you invitations and notifications, for example, and the host that serves the web app. The privacy policy lists every category of provider that receives personal data, what each receives and why.

What we don’t do

We don’t sell your data.
We don’t train AI models on your data.
We don’t show ads.
We don’t share your data with marketing or advertising partners.

These are commitments, not hedges. The business model is straightforward (see Subscription philosophy) and none of the above is part of it.

Your account and your syndicate

Shared operational records are managed for the syndicate’s responsible organisation or governing members; they are distinct from your personal account and pilot documents. Deleting your account removes your profile and personal documents. Shared aviation, accounting and dispute records may still contain your name or other necessary identifiers. Removing an account link does not necessarily make a record anonymous.

Deleting your account ends your memberships, but does not necessarily erase the shared records other members rely on. Once nothing is outstanding, deletion happens 30 days later and you can cancel any time before then; after that it is irreversible. If something is still outstanding when you request it (an unsettled balance, a payment of yours still being collected, or a syndicate where you are the only admin, for example), the request is put on hold and the 30-day countdown starts only once you have cleared it. A payment still with the bank is the one hold you need do nothing about: it clears itself when the collection settles or fails, usually within a few working days.

If you are the only member of a syndicate, there is no one left whose records depend on yours, and the syndicate can be wound up. If you are one of several, your departure does not erase the syndicate.

How long we keep things, and when they are removed

Your data does not sit around forever once it stops being used. A few automatic rules apply, all with the same aim: keep what the syndicate still relies on, and clear out what has been abandoned.

Idle free syndicates are eventually removed. A free syndicate without recorded booking, flight, expense, maintenance or defect activity for about six months is deleted with its data. Signing in, reading, votes, documents and payments do not reset that clock. Members are emailed a warning well before the date, and again as it approaches, so it never happens unannounced. Any qualifying recorded activity resets the clock, and paid syndicates are never removed this way.
An account with no syndicate is reminded, not removed. If you leave your last syndicate and do not join or create another, nothing happens to your account. Being between syndicates is an ordinary situation and we do not treat it as an abandoned account. What we do instead is tell you: six months after your last membership ends, and once a year after that, we email you to say what is still held on your profile and how to delete your account if you would rather it were gone. Deleting it is your decision, never ours, and joining a syndicate stops the reminders.
A closed syndicate stays recoverable for a while. Closing a syndicate makes it read-only and keeps it reinstatable through a retention window before it is finally removed. See Close a syndicate.
Some financial records outlive the rest. When a syndicate is closed or an account deleted, accounting and dispute records may be retained with restricted access. A closed syndicate’s reduced money trail is kept for up to seven years from closure, then deleted automatically. They are not necessarily anonymous, and customer records are not all Deltatek’s own tax records. A free syndicate removed for inactivity is the exception: after the warning emails it is deleted entirely, ledger included. The Privacy Policy distinguishes the retention purposes and record categories.

Deletion you ask for yourself works differently and is covered above. The timings here can be adjusted over time; the binding version is always the Privacy Policy and Terms of Service (see below).

Your settings, your control

Separately from account deletion, you have fine-grained privacy controls at the syndicate level while you are a member. Three settings (whether member names appear on other people’s calendar bookings, which roles see the financial detail of other members’ usage logs, and whether usage photos are visible across the syndicate) are configured on Privacy & Visibility. Photos attached to usage logs are stored privately and served only via short-lived signed URLs; see usage photo privacy for the exact rules.

None of these settings are feature-gated. They apply equally on the free tier and the paid tier.

Getting a copy of your data

You can download a copy of your personal data at any time, straight from the app: open the Profile tab, find the My data section, and tap Download my data. After you confirm your password, the app hands you a zip file containing your data in a common, machine-readable format, including copies of the pilot documents you uploaded. See Download your data for the steps.

This is your data-portability right under UK GDPR, and it is separate from deleting your account: taking a copy leaves your account and your syndicates exactly as they are. If you would rather not use the app (or no longer can), email [email protected] from the address on your account, and we will handle your request under the applicable data-rights rules, normally within one month, with a permitted extension explained where necessary.

Ask us rather than using the in-app download if you need the records of a syndicate that closed more than 30 days ago. An ordinary member’s access to a closed syndicate ends at that point, so the in-app download can no longer reach it, but relevant records may still be held during the retention window. Support will check your entitlement and which records can be supplied; another member’s private records are not automatically included. Close a syndicate explains the cutoff and how long the data is kept.

Where to read the legal version

This page explains the shape of the policy in plain terms. The legal versions live in-app at Account → About → Terms of Service and Account → About → Privacy Policy. They are also available as public routes (/terms and /privacy) so you can read them before signing up or share a link with a prospective member. The legal text is the binding version; if anything here and there disagree, the legal text governs.