iLog · Legal information
Privacy Policy
1. Who is responsible
This notice covers the iLog website at ospreytracker.com, its account portal and the Android implementation reviewed for this draft. Controller: Ahmed Fahim Abajtit and Company. Address: [POSTAL ADDRESS]. Privacy contact: [EMAIL]. These details must be completed before this notice becomes final.
2. Account and profile data
Registration requires your first and last name, email address, password and acceptance of the terms. Passwords are stored as Argon2id hashes. We process account identifiers, verification status, profile updates, optional country and home base, licences and ratings, optional profile photo, and optional medical certificate class and expiry date. Your account profile and photo synchronise between the website and a signed-in Android app. Do not upload medical reports or diagnoses.
3. Purposes and legal bases
Account creation, authentication, requested profile synchronisation and transactional messages serve the account service (Article 6(1)(b) GDPR). Session records, abuse prevention and security audit events serve our legitimate interest in protecting users and the service (Article 6(1)(f)); you may object where this basis applies. Any statutory retention relies on Article 6(1)(c). Medical certificate information may reveal health data: its Article 9 condition, and a separate explicit consent and withdrawal flow if relied on, remain to be confirmed. Acceptance of the terms is not consent to health-data processing or marketing.
4. Cookies and device storage
The website uses the necessary ilog_session cookie to keep you signed in. Normal sessions expire after 12 hours of inactivity; remembered sessions after 30 days, with expiry renewed during use. The normal browser cookie is a session cookie; remembered cookies persist for 30 days. Sessions record IP address, browser/device description and activity timestamps. The portal stores your chosen weather airports in browser local storage (ilog.weather) until you remove them or clear browser data. No advertising or analytics SDK was identified in the reviewed first-party account flow; third-party map and weather services have their own infrastructure.
5. Android permissions and local records
The Android app requests permissions for camera, selected images, location and notifications for the corresponding features. You can refuse or revoke them in Android settings; related features may then be unavailable. Profile data and an authentication token are held on the device. The reviewed implementation keeps scanned pages, documents and flight records locally rather than uploading them through the account API. Local files and any operating-system backups are separate from server-side account deletion. App-specific storage and backup behaviour must be checked against the release version before publication.
6. Weather, maps and external services
The web portal sends location to our API when you request nearby weather; the API sends an approximate area, snapped to a grid of about 5 km, to NOAA aviationweather.gov rather than your exact coordinates. Weather queries are temporarily cached. The Android app requests weather directly from aviationweather.gov, airport data from OurAirports through GitHub, and maps from OpenFreeMap. These direct requests expose your IP address and request details, such as airport queries or map tiles, to those providers. Location permission can be withdrawn; weather may be selected by airport instead.
7. Recipients and international transfers
Our hosting and database infrastructure, authorised support/administration personnel and Brevo for transactional email may process the data needed for their roles. Brevo receives recipient email addresses, message content and verification/reset links; no marketing subscription is created by registration. Hosting provider, processing locations, provider contracts, subprocessors and any safeguards for transfers outside the EEA remain to be confirmed. NOAA and GitHub requests may involve US infrastructure; provider terms and the applicable transfer mechanism must be verified. We do not sell personal account data. Paid offers are planned. Before payments launch, this notice must identify the payment provider, the billing and transaction data processed, purposes and legal bases, recipients, transfer safeguards and statutory retention periods. No card-data handling is claimed for the current account service.
8. Retention and deletion
Account and profile data are held while your account exists. Deleting your account in Security removes the account, profile, photo, email tokens and sessions from the active database. Security audit events remain with their user reference removed; they may still contain IP addresses and device descriptions, so they are not necessarily anonymous. Expiry of a session or email token does not by itself erase its database row. The planned retention limit for remaining personal data after account deletion is 30 days, except where a specific legal obligation requires longer retention. This limit is not yet technically enforced: audit cleanup, log retention and backup rotation must be implemented and verified before this policy is finalised. Statutory retention periods for future payment and invoice records must be determined separately. Cleanup of expired sessions and email tokens during the life of an account also remains to be configured. Copies in existing backups and local Android files are not automatically erased by deleting the server account.
9. Your rights
Subject to the GDPR conditions, you may request access, correction, erasure, restriction and portability, object to processing based on legitimate interests, and withdraw consent without affecting the lawfulness of earlier processing. Contact [EMAIL]. You may complain to the supervisory authority where you live, work or consider an infringement occurred. No automated decision-making with legal or similarly significant effects was identified in the reviewed account service. Required account data are needed to provide sign-in; other profile fields are optional.
10. Updates
We will update this notice when the service or processing changes. Cloud flight storage, OCR services, paid plans and iOS releases require an updated assessment before launch. Draft prepared on 4 October 2026.