Privacy Policy

Last updated: November 2, 2026

This policy explains what data the PlaneSpy app for Android and this website process, why, and what your choices are. We keep it short and plain on purpose.

Who is responsible

The controller for the data described here is Philip Lindner, Donaufelder Strasse 150/227, 1220 Vienna, Austria ("we", "us").

Contact for privacy questions: philip.lindner2@gmail.com.

The short version

PlaneSpy uses your device location to show real aircraft around you.
We use Firebase Analytics to understand how the app is used and Firebase Crashlytics to find and fix crashes.
Subscriptions are handled by Google Play and RevenueCat. We never see your payment details.
If you ask to be notified about the launch, we store your email address until we have sent that one email.
We do not sell your personal data.

What data we process

Location

The app needs your location to center the map and show aircraft around you. To load nearby aircraft, the app sends your location to our own backend, which returns the flights in that area. Our backend does not forward your location to any third-party service, and your location is never stored, neither on our servers nor as a location history. The map is drawn from OpenMapTiles and OpenStreetMap data, and the map tiles are delivered by OpenFreeMap. Loading the map requires requesting tiles for the area you are viewing, so OpenFreeMap can see your IP address and which tiles are requested.

Usage data (Firebase Analytics)

We use Google Firebase Analytics. It collects data such as an app-instance identifier, device model, operating system version, app version, language, approximate region derived from IP address, and events like app opens, screens viewed and settings or themes selected. These are collected only if you agree in the consent prompt. It helps us understand which features are used and improve the app.

Crash and diagnostic data (Firebase Crashlytics)

We use Google Firebase Crashlytics. If you agree in the consent prompt, then when the app crashes it sends a crash report with stack traces, device model, operating system version, app state at the time of the crash and an installation identifier. This helps us fix bugs and keep the app stable.

Subscriptions and purchases

Subscriptions are billed through Google Play, which processes your payment details. We use RevenueCat to manage subscriptions and trials. RevenueCat identifies you only through an anonymous user ID that it generates itself. We do not send RevenueCat your name, email address or any other personal data. To work, the RevenueCat SDK processes that anonymous ID together with purchase and subscription status, and technical data such as your IP address and basic device and app information. We use this solely to confirm that your subscription or trial is active. Our backend also receives your anonymous user ID so that it can check your subscription status with RevenueCat, and it may store that ID to verify your status.

Website

This website does not use advertising or tracking cookies. It is delivered through Cloudflare, which we use as a content delivery network (CDN) and security provider. When you visit, Cloudflare processes your IP address and technical request data (such as browser type and the pages requested) to deliver the site quickly, protect it against attacks and abuse, and keep it available. Cloudflare may keep short-term technical logs for these purposes. Cloudflare may set a strictly necessary security cookie (__cf_bm) that helps it identify and mitigate automated bot traffic. It is not used for tracking or advertising and expires after a short time (about 30 minutes). Because it is strictly necessary to protect the website, it does not require your consent. We use Cloudflare Web Analytics to understand how many people visit the site and which pages they view. It is cookieless: it does not store anything on your device, does not track you across websites and does not build individual profiles.

Launch notification (email)

While the app is not yet available, you can leave your email address on this website to be notified when it launches. We store your email address, the time you signed up and the consent text you agreed to in a database at Cloudflare (Cloudflare D1). We use it only to send you one email when PlaneSpy launches. We do not use it for advertising, we do not share it with anyone else, and we delete it after that email has been sent. You can ask us to delete it earlier at any time.

Why we process it and on what basis

For users in the European Economic Area, the United Kingdom and Switzerland, we rely on the following legal bases:

Providing the app (location, subscription status through Google Play and RevenueCat): performance of a contract, Art. 6(1)(b) GDPR.
Usage analytics (Firebase Analytics) and crash reporting (Firebase Crashlytics): your consent, Art. 6(1)(a) GDPR. We ask for it in the app when you first open it, and nothing is collected until you agree. You can withdraw it at any time in the app settings, which does not affect processing that happened before.
Launch notification by email: your consent, Art. 6(1)(a) GDPR, which you give by submitting the form. You can withdraw it at any time by emailing us, and we will delete your address.
Delivering and securing this website through Cloudflare (CDN, security and performance) and measuring website traffic with cookieless Cloudflare Web Analytics: our legitimate interest in a fast, secure, available and well-run website, Art. 6(1)(f) GDPR.

Who receives your data

Firebase Analytics and Firebase Crashlytics are services of Google (Google Ireland Limited for users in the EEA and UK, Google LLC elsewhere). Google acts as our processor for this data. Data may be transferred to and processed in the United States and other countries; Google relies on the EU-U.S. Data Privacy Framework and Standard Contractual Clauses for such transfers. See Google privacy information for Firebase at https://firebase.google.com/support/privacy.

RevenueCat, Inc. (United States) acts as our processor for subscription management and relies on the EU-U.S. Data Privacy Framework and Standard Contractual Clauses for transfers; see https://www.revenuecat.com/privacy. Cloudflare, Inc. (United States) acts as our processor for the website CDN and security services, processes visitor IP addresses as described above, and relies on the EU-U.S. Data Privacy Framework and Standard Contractual Clauses for transfers; see https://www.cloudflare.com/privacypolicy/. Google Play processes subscriptions under its own privacy policy. OpenFreeMap delivers the map tiles and, as described in the location section above, can see your IP address and the tiles requested. Your location is not shared with any third party.

We do not sell your personal data and do not use it for advertising.

How long we keep data

Crash reports are kept by Firebase Crashlytics for 90 days. Analytics data is kept for the retention period set in Firebase, which we have configured to 2 months, after which it is deleted automatically. We do not keep your location. Anonymous user IDs stored by our backend to verify subscription status are kept only as long as needed for that purpose. Email addresses collected for the launch notification are deleted after the launch email has been sent, or earlier if you ask us to.

Your rights

Depending on where you live, you may have the right to access, correct, delete, restrict or export your personal data, to object to processing, and to withdraw consent at any time. You can also lodge a complaint with your data protection authority; in Austria this is the Datenschutzbehörde (https://www.dsb.gv.at).

Because the app does not ask you to create an account, we usually identify your data only through app identifiers. You can withdraw your analytics and crash reporting consent at any time in the app settings. To exercise your other rights, contact us at philip.lindner2@gmail.com.

If you are a California resident, you have the rights described in the CCPA/CPRA, and if you are in Japan, the rights under the APPI. We do not sell or share personal data for cross-context advertising.

Children

PlaneSpy is not directed at children under 16 and we do not knowingly collect their personal data. If you believe a child has provided data, contact us and we will delete it.

Security

Data is transmitted over encrypted connections. No system is perfectly secure, but we take reasonable measures to protect your data.

Changes to this policy

We may update this policy, for example when we add features or services. The date at the top shows when it last changed. Material changes will be announced in the app or on this page.

Contact

philip.lindner2@gmail.com