Privacy Policy

Flight Path Training ("we", "us", "our") is operated by Edward Radford, England and Wales. This policy explains what personal data we collect, why we collect it, how it is used, and your rights under UK GDPR and the Data Protection Act 2018.

1. Data We Collect

• Account information: name, email address, and password (hashed by Firebase Auth).
• Profile information: aircraft type, total hours flown, current exercise number.
• Lesson data: scheduled and completed flight lesson records, including ratings, quiz scores, instructor notes, personal reflections, weather data, and AI-generated debrief content.
• Exercise progress: per-exercise status, attempt count, best rating, and spaced-repetition due dates.
• Device token: Firebase Cloud Messaging (FCM) token for push notifications.
• Usage data: Firebase Analytics events (e.g. screen views, quiz completions). Analytics data is aggregated and not linked to individual users beyond your Firebase UID.
• Crash reports: anonymised crash data via Firebase Crashlytics.
• Voice audio: microphone input captured temporarily during RT Practice sessions for speech recognition. Audio is processed on-device and is not transmitted to or stored by Flight Path.
• Speech transcriptions: text transcribed from your RT Practice radio calls via the device's built-in speech recognition (Apple SFSpeech / Android SpeechRecognizer). Transcriptions are used only to evaluate your call within the session and are not retained.
• METAR weather data: ICAO airfield codes are sent to avwx.rest to retrieve live METAR reports. No personally identifiable information is transmitted.

2. How We Use Your Data

• To provide the app — storing and displaying your lesson history, progress, and exercise content.
• AI coaching — your lesson data (ratings, notes, quiz score) is sent to the Anthropic Claude API to generate personalised post-lesson feedback. This data is not used to train Anthropic's models.
• Push notifications — lesson reminders, spaced-repetition prompts, and inactivity nudges sent via FCM.
• Subscription management — your Firebase UID is shared with RevenueCat to verify purchase status.
• RT Practice — microphone input and speech transcriptions are used solely to evaluate your simulated radio calls within the RT Practice feature. No audio or transcription data is stored after the session ends.
• Live weather briefings — ICAO codes are sent to avwx.rest to fetch METAR data for the METAR Training and weather briefing features. No personal data is included in these requests.
• Improving the app — aggregated, anonymised analytics and crash data help us identify and fix bugs.

3. Legal Basis for Processing

We process your data on the basis of:

• Contract — to deliver the services you have signed up for.
• Legitimate interests — app analytics and crash reporting to maintain a reliable service.
• Consent — push notifications (you may withdraw consent at any time via device settings or Settings → Notifications in the app).

4. Third-Party Processors

• Google Firebase (Firebase Auth, Firestore, FCM, Analytics, Crashlytics) — Google LLC, USA. Covered by Standard Contractual Clauses.
• RevenueCat — RevenueCat Inc., USA. Processes your Firebase UID and purchase events only.
• Anthropic (Claude API) — Anthropic PBC, USA. Receives lesson data for AI debrief generation. Data is not retained for model training.
• OpenWeatherMap — OpenWeather Ltd, UK. Receives GPS or manually entered airfield ICAO codes for weather briefings.
• AVWX (avwx.rest) — StreetLearn Inc., USA. Receives ICAO airfield codes to return live METAR data for METAR Training and weather briefing features. No personal data is transmitted.
• Apple SFSpeech / Android SpeechRecognizer — on-device speech recognition provided by Apple Inc. and Google LLC respectively. Audio is processed locally; no audio data is sent to Flight Path Training servers.

5. Data Retention

Your data is retained for as long as your account is active. If you delete your account (Settings → Delete Account), all your data — including lessons, exercise progress, share links, messages, and your user profile — is permanently deleted from our systems within 30 days. Firebase Auth credentials are deleted immediately.

6. Your Rights

Under UK GDPR you have the right to:

• Access — request a copy of the personal data we hold about you.
• Rectification — correct inaccurate data via Settings → Edit Profile.
• Erasure — delete your account and all associated data via Settings → Delete Account.
• Portability — export your lesson data as a PDF via Progress → Share Progress.
• Restriction — request that we restrict processing of your data while a dispute is resolved.
• Object — object to processing based on legitimate interests.

To exercise any right not available directly in the app, contact us at [email protected]. We will respond within 30 days.

7. Local Storage

The app stores exercise content, offline lesson drafts, and notification preferences locally on your device using Hive and SharedPreferences. This data never leaves your device except as part of normal Firestore sync.

8. Children

Flight Path Training is not directed at children under 13. We do not knowingly collect personal data from children under 13. If you believe a child has provided us with personal data, please contact [email protected].

9. Changes to This Policy

We may update this policy from time to time. Material changes will be notified via the app's "What's New" section. Continued use of the app after changes constitutes acceptance of the updated policy.

10. Contact

Data controller: Edward Radford
Email: [email protected]

If you have concerns about how we handle your data, you may also lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

11. Governing Law

This policy is governed by the laws of England and Wales.