Privacy policy

Protecting your data matters to us. This policy explains what Skytrails collects, why, who it is shared with, and what rights you have.

Skytrails is built around data minimisation. We run no advertising networks and no third-party analytics or tracking SDKs.

1. Controller

StagWorks
Benjamin Seeger und Maximilian Rosnauer GbR
Beinsteinerstraße 40
71394 Kernen im Remstal
Germany

Email: info@stagworks.de

2. Account data

When you create an account we process your email address, display name and — if you set one — your profile photo. Sign-in runs through Firebase Authentication, either with email and password, with Google Sign-In or with Sign in with Apple. If you use Google Sign-In, Google supplies us with your email address, name and profile picture. If you use Sign in with Apple, Apple supplies a name and an email address, which can be Apple's private relay address if you choose to hide yours. When you delete your account, we also revoke the Apple sign-in token.

Your profile photo is stored as a compressed image inside your user document, not in a separate file store.

Legal basis: Art. 6(1)(b) GDPR — performance of the contract with you.

3. Flight logs and GPS tracks

The core of Skytrails is your logbook. We process:

• Flight entries: date, departure and destination airport, aircraft registration, duration, distance, and any notes you add.
• GPS tracks. When you record a flight, the app samples your position, altitude and time, and stores the result on the flight as a track of up to 400 points.
• Derived statistics: total hours, distance, airports and countries visited.
• Other people on a flight. You can add people to a flight (their name and their role, and a link to their Skytrails account when they have one). Names and roles are stored with the flight. When you import a logbook file, no name of a person without a Skytrails account is saved unless you tick it, one name at a time; unticked names are left out. Email addresses read from an imported file are used on your phone to recognise a person and are not uploaded. You are responsible for adding only people you may store (see the terms).

Your logbook stays private. Nobody else can read your flights, routes, times or tracks: not your friends, not other pilots, not your public profile. This is enforced by the database's security rules, not only hidden in the app. The one exception is yours to make: a pilot you link as crew on a flight can read that one flight, so they can add it to their own logbook. Your airplanes and homebases are private in the same way. Profile → Privacy in the app shows what is shared with whom.

Background recording. So that a recording survives you locking your phone, Skytrails keeps receiving location updates while it is in the background. On iOS this is visible as the blue status bar indicator; on Android it runs as a foreground service with a persistent notification. Recording only ever runs while you have explicitly started a flight, and you can stop it at any time. Skytrails does not request "allow all the time" background location access.

Legal basis: Art. 6(1)(b) GDPR.

4. Sharing your position with other pilots

Position sharing works in two separate ways:

• Live flights. While recording, the app can publish your current position (including the name of the nearest town), altitude, speed, flight phase, takeoff and landing time and your aircraft type. This is readable only by pilots you are mutually friends with and who you have switched on in your sharing preferences. Nobody is on that list unless you add them. Publishing is throttled and stops when the flight ends; an abandoned record is treated as stale after two minutes and removed.
• Takeoff and landing message. Before a flight you can pick friends who get a push when you take off and when you have landed, with your name, the nearest town, your aircraft and the flight time. Our server sends it from your live flight, in each friend's app language. Your pick is stored with your sharing preferences until you change it.
• ADS-B stand-in. If your phone stops sending during a flight (no signal, flight mode), our server looks up your aircraft on the public ADS-B feed (adsb.lol) by the callsign or registration you entered, and publishes where the feed has it. This is readable by the same friends as your live flight, and is deleted when the flight ends.
• Airline flights. If you record an airline flight, the app asks for your agreement once. Your callsign or registration and your position at the gate go to our server, which follows the aircraft on the public ADS-B feed and keeps the recording for 72 hours, after which it is deleted. The finished track is sent to your app and saved in your logbook like any other. ADS-B data is public and can identify the pilot or the aircraft; we use it only for your flight.
• Spot Map. While you record a flight, your aircraft appears live on the map for other signed-in pilots, with your name and photo, registration or callsign, altitude, speed, destination and the path flown so far. It is removed when the flight ends.

Please note: when you fly as a crew on a shared flight, the crew list — pilot names and their role on that flight — is visible to any signed-in Skytrails user who can see that aircraft on the map. This is deliberate, so that a plane on the map can be identified, but it means your name and role are not limited to your friends in that case.

You can stop sharing at any time in the app, which deletes the published record. Friends or other pilots watching a flight see only what you share. Skytrails is not a flight-following, tracking or emergency service.

Legal basis: Art. 6(1)(a) GDPR — your consent, given by enabling sharing or, for an airline flight, by agreeing to the ADS-B lookup, and withdrawable at any time.

5. Photos

Photos you match to a flight never leave your device. Skytrails stores only the local photo library identifiers, so the images are resolved from your own library each time. Identifiers from another device simply do not resolve.

If you choose Build track from photos, the places and times those photos were taken (and their GPS altitude, when the file has one) become that flight's GPS track. The track is stored with the flight like a recorded one, under the same rules as any other track (section 3). The photos themselves still never leave your device.

With Enable iCloud Photos (iOS, off by default) the original of a photo that is only in iCloud is downloaded to read its location and time, which can use mobile data and means Apple delivers the file to your phone.

Photos you attach to a community post are different: those are uploaded. They are compressed and stored inside the post document itself, and are visible to the audience you chose for the post — your group, or the public pilot feed. Before upload, the app removes the photo's metadata (EXIF), including where it was taken. The same applies to your profile photo.

Legal basis: Art. 6(1)(b) GDPR, and Art. 6(1)(a) for anything you choose to publish.

6. Community

Groups (clubs) store their name, invite code and member list. Posts store their text, photos and author. Anything you post to the public feed is visible to every signed-in Skytrails user; anything posted to a group is visible to that group's members. A group, its description, its member list and its posts are readable only by its members. Likes and comments are visible to everyone who can see the post.

Your flight log is visible only to you, as described in section 3.

Place reviews. When you rate or review an airport or landmark, your rating, text, photos (location data removed), comments, your pilot tag and photo are visible to every signed-in Skytrails user. A "Flown here" badge shows when your logbook contains that place. You can edit or delete your review at any time.

Wikipedia. When you open a place page, the app requests the article intro and lead photo from Wikipedia, Wikidata and Wikimedia Commons (Wikimedia Foundation). They receive your IP address and the article requested. Texts are shown under CC BY-SA 4.0; photos with their author and license.

Reports and blocks. When you report content or a pilot, we store the report (category, your optional note, an excerpt of the reported content, and your user id) so we can review it and, where the law requires, pass it to authorities. Reports are deleted after 12 months, unless we have to keep them longer by law (for example as evidence in a child-safety case). The pilots you block are stored with your account so the block holds on every device. Legal basis: Art. 6(1)(c) and (f) GDPR — our legal duties as a hosting service and our interest in a safe community.

7. Leaderboard

If "Show me on Top Pilots" is enabled, your display name, profile photo, your totals (flights, minutes flown, distance, airports, countries), your personal records and the badges and records you pin are published to the global leaderboard and your public profile, readable by all signed-in users. A record can name an airport, an aircraft type or a route (for example your biggest airport or your busiest route). Turning the setting off deletes your leaderboard entry and stops further publishing. Your detailed flight log is never published — only these totals and records. Which badges you have unlocked and which you pinned are part of this entry too; your badge progress itself stays private in your account.

If you also enable "Favorites on your public profile" (off by default), your most flown aircraft (its registration, type and hours) and your most flown airfield (with its number of takeoffs and landings) are published to your public profile as well. Turning it off removes them with the next update.

If you enable "Stay anonymous" (off by default), your display name and profile photo are left out of the leaderboard entry and your public profile, which then show "Anonymous pilot"; your totals, records and badges are still published. Friends, the Spot Map, posts and reviews still show your name.

Legal basis: Art. 6(1)(a) GDPR — your consent.

Game Center and Google Play Games. If you switch this on (off by default), the badges you unlock are mirrored to your Apple Game Center or Google Play Games account. Apple and Google then process them under their own terms. Legal basis: Art. 6(1)(a) GDPR.

8. Push notifications and Live Activities

To deliver notifications — a friend taking off, an invitation to fly together, a Live Activity showing a friend's flight in progress — we operate a relay server. It stores your device push token and the state of currently running Live Activities. This data is technical, regenerable, and holds no flight history: the relay reads live flight state and forwards it, and never writes flight data back.

You can switch notifications off in your operating system settings at any time.

Invite links. A link or QR code to add you as a friend opens a page on our server, which shows the friend code and sends you to the app or to the app store. Like any web server, it writes ordinary access logs (IP address, time, page) for security and stability.

Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in operating the service, and Art. 6(1)(a) where your OS asked for your permission.

9. Processors and recipients

Where data is transferred to the USA, the transfer is covered by Standard Contractual Clauses under Art. 46 GDPR or an equivalent safeguard, such as the EU–US Data Privacy Framework. We have concluded data processing agreements under Art. 28 GDPR with our processors.

We do not sell your data, and we do not share it for advertising.

10. Crash reporting

If you allow it, Firebase Crashlytics (Google) collects diagnostic data when the app crashes: device model, operating system and app version, a stack trace and an installation ID. No flights, tracks, photos, names or messages. This is used solely to fix faults. The app asks in the intro; it is off until you say yes, and you can change it any time in Profile → Privacy.

Legal basis: Art. 6(1)(a) GDPR and § 25(1) TDDDG — your consent, withdrawable at any time.

11. Data stored only on your device

Some things never reach our servers at all: your saved crew contacts and their phone numbers, the people you linked in your logbook, your licences and ratings, your matched photo identifiers, the login for any video source you add (in the system keychain), the intro-completion flag, your language choice, your crash-report and ADS-B choices, and your leaderboard opt-out. Uninstalling the app removes them.

12. Retention

We keep your account data and flight logs for as long as your account exists. Live position records are short-lived by design and are removed once a flight ends or goes stale. Flight sessions you start with friends are deleted when the last crew member has left, and at the latest 48 hours after the last activity. ADS-B recordings for airline flights are deleted after 72 hours. Reports are deleted after 12 months (section 6).

Deleting your account removes your profile, flights, airplanes, friendships and requests, leaderboard entry, badge and record data, community posts, groups you own, place reviews, your likes and comments on other posts, your pilot tag and your list of blocked pilots. Comments written with very old app versions cannot be found automatically; write to us and we remove them.

13. Your rights

Under the GDPR you have the right to:

• Access the data we hold about you (Art. 15)
• Rectification of inaccurate data (Art. 16)
• Erasure (Art. 17) — you can delete your account and all associated data yourself, from the profile screen
• Restriction of processing (Art. 18)
• Data portability (Art. 20)
• Object to processing based on legitimate interest (Art. 21)
• Withdraw consent at any time, without affecting processing already carried out (Art. 7(3))

To exercise any of these, email info@stagworks.de. For data portability we send you your data in a machine-readable format on request; an export inside the app is not available yet.

You also have the right to lodge a complaint with a supervisory authority. The authority responsible for us is the Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg.

14. Children

Skytrails is not directed at children under 16. We do not knowingly collect data from them.

15. Changes

We may update this policy as the app changes. When a change is material, the app asks you to review and accept the updated version.

This website

This policy also covers the website skytrails.stagworks.de. The website has no sign-in yet and stores nothing about you.

• Server logs. When you open a page, our server processes technically necessary data: IP address, date and time, the address requested, referrer and browser identifier. We use it only to deliver the website, find faults and fend off attacks, and delete it after a short time. Hosting is provided by Oracle Cloud Infrastructure in a data centre in the EU. Legal basis: Art. 6(1)(f) GDPR.
• No cookies, no analytics. The website sets no cookies, uses no analytics or advertising services and loads no third-party content; even the fonts are served from our own server.
• Store links. The buttons lead to the App Store (Apple) and Google Play. You only leave this website when you click one; Apple's or Google's privacy policy applies there.

Last updated: 12 October 2026