Privacy notice
Notice under Articles 13-14 of Regulation (EU) 2016/679 (GDPR). It explains how RSFly.app processes accounts, pilot profiles, IGC files, GPS tracks, metrics, thermals, predictions, comments, Debrief, payments, logs, and aggregated service statistics. Summaries may feed the logbook, profiles, and leaderboard; an indexable public summary is created only when the owner separately enables public sharing for that individual flight and all visibility requirements remain satisfied. Replays, raw files, and the full track are not part of that summary.
Courtesy translation. The legally binding version is the Italian one. Versione ufficiale (IT)
Data controller and seller for legal obligations. For requests about access, rectification, erasure, restriction, objection, or portability, or to report a flight-data access issue, write to the email below.
No Data Protection Officer (DPO) is currently appointed, as the mandatory conditions of Article 37 GDPR are not met. Data-protection requests are handled directly by the controller at the contacts above. If a DPO is appointed, the contact will be published here.
Username, email, encrypted password and, if provided later, first name, last name, country, date of birth, bio, and profile image.
IGC files, GPS coordinates, altitude, timestamps, takeoff, landing, duration, distance, speed, rates, scores, and derived data. An IGC may also include technical metadata about device, glider, logger, or competition.
Detected thermals, hotspots, prediction grid cells, aggregated metrics, and indicators generated automatically from tracks.
Only with explicit opt-in to internal RSFly training, separate from flight visibility, RSFly may create derived features with hashed identifiers and rounded coordinates for staff-reviewed thermal batches. This consent does not authorize sharing flight inputs, outputs, or data with OpenAI for model training.
Only with a separate raw-archive opt-in or documented partner authorization, RSFly may store a protected private copy of the raw IGC with file hash, storage key, consent or contract reference, and audit events. This does not make the raw IGC public.
Comments, closed Coach action codes selected by the user, quota state, technical cookies, application logs, request metadata, and anti-abuse signals. The backend does not receive free text or history for a flight debrief.
Counts of active external accounts with a verified email and successfully processed flights, including private flights only in the overall total. Before publication, counts are aggregated and rounded down; they contain no identity, track, location, date, or country breakdown.
For each submitted flight, RSFly records the opaque selection reference, consent version, authorized scopes, and grant or revocation dates. The preview and artwork use normalized local geometry without absolute coordinates, the IGC file, or exact takeoff and landing locations.
Only with the owner's explicit, revocable choice for that flight, together with feed visibility and leaderboard inclusion, may RSFly.app publish a summary limited to flight date, a public or masked place label, counted XC distance, total track distance, XC score, duration, and a public artwork URL when available. It contains no pilot name, username, country, coordinates, track, comments, wing, upload time, or internal versions.
For RSFly Intelligence Artwork, RSFly may process flight id, user id, artwork status, plan state, render version and fingerprints, privacy radius, thermal summary, brilliant-moment metadata, and private/HD image files. Feed artwork is generated only when enabled by the user and published to the gallery only when flight visibility is set to gallery feed.
Stripe customer identifiers, subscription status, plan, billing cycle, payment outcome, transaction reference, and data needed to manage access, accounting, support, cancellations, and refunds. RSFly does not store full card data.
| Purpose | Main data | Legal basis |
|---|---|---|
| Account, login, and profile | Credentials, email, profile data, and optional Google verified-identity metadata if you choose Google login | Performance of the contract (Art. 6(1)(b)) |
| Upload, replay, and logbook | IGC, GPS tracks, timestamps, metrics | Performance of the contract (Art. 6(1)(b)) |
| Public aggregated service statistics | Rounded counts of verified external accounts and successfully processed flights, without identities, tracks, or locations | Legitimate interest in describing service usage proportionately and evaluating distribution (Art. 6(1)(f)) |
| Indexing an individual flight summary (optional) | Date, public or masked place, XC metrics, and duration; no pilot identity or track | The flight owner’s explicit, revocable consent (Art. 6(1)(a)) |
| Thermal analysis, scores, and predictions | Data derived from flight and terrain | Performance of the contract; legitimate interest for safety and technical quality (Art. 6(1)(b)/(f)) |
| Optional internal RSFly training | Derived flight, thermal, terrain, solar, and weather features with hashed identifiers and rounded coordinates; no OpenAI opt-in | Explicit consent, revocable from profile settings (Art. 6(1)(a)) |
| Museum 2026 submission (optional) | Normalized local geometry for one flight; identity and editorial story only when separately authorized | Explicit, revocable consent for each flight (Art. 6(1)(a)) |
| Optional protected raw IGC archive | Raw IGC file, file hash, storage key, consent/partner provenance, and audit events | Explicit consent or documented partner authorization (Art. 6(1)(a)) |
| Comments and social features | Text, author, date, linked flight | Performance of the contract and legitimate interest for moderation (Art. 6(1)(b)/(f)) |
| Logs, security, debug, and abuse prevention | Technical logs, IP, user agent, application events | Legitimate interest and security obligations (Art. 6(1)(f)) |
| Payments, subscriptions, support, and tax obligations | Email, plan, cycle, customer/subscription ID, payment outcomes, transaction references | Contract performance, legal obligations, and legitimate interest in legal defense (Art. 6(1)(b)/(c)/(f)) |
| RSFly Intelligence Artwork and HD plan download | Flight id, user id, artwork status, render metadata, plan state, and protected media access logs | Contract performance for the plan and legitimate interest for support, security, and fraud prevention (Art. 6(1)(b)/(f)) |
By uploading IGC files, images, comments, or other content, the user represents that they have title, authorization, or another lawful basis to use them on RSFly and remains responsible for the lawfulness, accuracy, and relevance of uploaded data.
RSFly processes data provided by the user and external technical components. Replay, logbook, scoring, thermals, predictions, rankings, and Debrief are post-flight informational tools: they are not certified safety, navigation, operational meteorology, training, aviation consulting, or sports-validation services.
IGC note: the raw file may contain very precise technical and timing details. RSFly keeps it as needed for parsing, replay, diagnostics, security, support, operational continuity, and legal defense, within the limits described in this notice.
IGC tracks and full routes can reveal movements, habits, places, and presence times. RSFly.app therefore separates summary visibility, replay access, and search indexing. Without the explicit per-flight choice, the page remains excluded from search engines. When every requirement is satisfied, anonymous visitors receive only the minimized summary described above; coordinates, the full track, the IGC file, and the pilot's identity remain excluded. Revoking the choice makes the public projection unavailable and restores noindex on the next response. Search engines may take time to update results or previews already collected: RSFly.app can return the correct technical signals but does not control an external engine's removal timing.
RSFly computes automatic metrics and indicators to review the selected flight. The Plus guided Coach is deterministic. In this configuration, generative processing through OpenAI is disabled: no message, answer, or flight data is sent to OpenAI. Any future activation will require a prior update to this notice, the processor list, and the related release controls.
Submission is optional, applies to one flight, and requires an explicit, unselected consent. The required base scope authorizes only the normalized local geometry needed for the preview and a possible artwork. Pilot identity and an editorial story are separate optional permissions, both disabled by default; voice is excluded.
The Museum payload contains no absolute coordinates, IGC file, or exact takeoff and landing locations. Submission remains separate from flight visibility, leaderboard inclusion, artwork, training, and publication: curatorial selection is neither automatic nor guaranteed.
Consent can be revoked from the Museum as easily as it is granted. Revocation retires linked works and prevents future uses; the minimal consent, version, scope, and revocation record remains while the linked flight or account exists and is deleted with them.
To run the service, RSFly relies on the following processors/sub-processors. Some are activated only when the related feature is enabled. Any transfer outside the European Economic Area occurs only when necessary and based on adequacy decisions or appropriate safeguards, including Standard Contractual Clauses.
| Provider | Purpose | Country | Transfer mechanism |
|---|---|---|---|
| Railway | Application hosting, database, service execution | USA | Standard Contractual Clauses (SCC) + DPA |
| Cloudflare | CDN, DNS, security and anti-abuse, asset delivery | USA (global network) | Standard Contractual Clauses (SCC) + DPA |
| Stripe | Payments, subscriptions, customer portal, billing | Ireland (EU) / USA | EU entity (Stripe Payments Europe) + SCC for the US group |
| MapTiler | Maps and terrain tiles for the 3D replay | Switzerland | Adequacy decision (Switzerland) |
| Anthropic | AI processing for intelligent features (if enabled) | USA | Standard Contractual Clauses (SCC) + DPA |
| Google (Fonts, Analytics) | Web fonts; analytics only after consent | USA | SCC + consent for analytics |
| PostHog | Product analytics only after consent | EU / USA | SCC + consent |
| Open-Meteo | Weather enrichment for training/predictions (if enabled) | EU (Germany) | No transfer outside the EEA |
RSFly uses technical cookies required for operation, including session and CSRF cookies, which do not require consent.
Optional analytics tools (Google Analytics and client-side PostHog) use analytics storage only after consent, collected via a banner: without consent, or if denied, analytics and advertising storage stay denied by default. The preference can be changed at any time from the banner.
For maps, replay, and frontend resources, Google Fonts, MapTiler, MapLibre/demotiles, CARTO, ArcGIS, and OpenTopoMap may be involved. The thermal-map "locate" feature uses browser geolocation only after user action and consent, client-side, without intentional storage.
You may exercise the rights of access, rectification, erasure, restriction, objection, and data portability (Arts. 15-22 GDPR). Requests are normally handled within one month.
Portability (Art. 20): you can download the IGC files you uploaded, in a machine-readable format, directly from each of your flight detail pages, regardless of plan. Additional exports (GPX/KML/WPT) are available for plans that include them.
Erasure (Art. 17): self-service deletion of the account and of individual flights is available from profile settings and from the detail pages of flights you own.
Complaint (Art. 77): you may lodge a complaint with the competent supervisory authority, Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Roma, Italia — www.garanteprivacy.it.
To exercise your rights write to [email protected] (or via PEC to [email protected]). The legally binding version of this notice is the Italian one.
RSFly processes detailed location data. Use by minors must occur only under suitable legal grounds and, where needed, with involvement from the holder of parental responsibility.
RSFly applies reasonable technical and organizational security measures: HTTPS in production, secure cookies, CSRF controls, flight-detail access restrictions, authorization checks, and technical logs, without claiming zero risk.
User-uploaded content remains owned by the user or the respective rights holders. The user grants RSFly a non-exclusive license functional to hosting, backup, parsing, analysis, map rendering, metric generation, and security. RSFly code, interface, original text, assets, platform structure, and databases are protected. Mass scraping, unauthorized commercial reuse, reverse engineering for competing services, and systematic reuse of datasets, thermals, hotspots, or predictions are prohibited.
Privacy requests
To exercise privacy rights or report a flight-data access issue, use the dedicated contact.
[email protected]Loading data...
