Privacy notice
Notice under Articles 13-14 of Regulation (EU) 2016/679 (GDPR). It explains how RSFly processes accounts, pilot profiles, IGC files, GPS tracks, metrics, thermals, predictions, comments, Debrief, payments, and logs. Processed flight summaries can feed the logbook, profiles, and leaderboard for authenticated users; replay, raw files, and full track access remain protected by ownership, staff access, or accepted friendship.
Courtesy translation. The legally binding version is the Italian one. Versione ufficiale (IT)
Data controller and seller for legal obligations. For requests about access, rectification, erasure, restriction, objection, or portability, or to report a flight-data access issue, write to the email below.
No Data Protection Officer (DPO) is currently appointed, as the mandatory conditions of Article 37 GDPR are not met. Data-protection requests are handled directly by the controller at the contacts above. If a DPO is appointed, the contact will be published here.
Username, email, first name, last name, encrypted password, country, date of birth if provided, bio, and profile image.
IGC files, GPS coordinates, altitude, timestamps, takeoff, landing, duration, distance, speed, rates, scores, and derived data. An IGC may also include technical metadata about device, glider, logger, or competition.
Detected thermals, hotspots, prediction grid cells, aggregated metrics, and indicators generated automatically from tracks.
Only with explicit AI-training opt-in, separate from flight visibility, RSFly may create derived features with hashed identifiers and rounded coordinates for staff-reviewed thermal-training batches. Raw IGC files are not exported by default.
Only with a separate raw-archive opt-in or documented partner authorization, RSFly may store a protected private copy of the raw IGC with file hash, storage key, consent or contract reference, and audit events. This does not make the raw IGC public.
Comments, Debrief messages, browser-sent history, technical cookies, application logs, request metadata, and anti-abuse signals.
For RSFly Intelligence Artwork, RSFly may process flight id, user id, artwork status, plan state, render version and fingerprints, privacy radius, thermal summary, brilliant-moment metadata, and private/HD image files. Feed artwork is generated only when enabled by the user and published to the gallery only when flight visibility is set to gallery feed.
Stripe customer identifiers, subscription status, plan, billing cycle, payment outcome, transaction reference, and data needed to manage access, accounting, support, cancellations, and refunds. RSFly does not store full card data.
| Purpose | Main data | Legal basis |
|---|---|---|
| Account, login, and profile | Credentials, email, profile data, and optional Google verified-identity metadata if you choose Google login | Performance of the contract (Art. 6(1)(b)) |
| Upload, replay, and logbook | IGC, GPS tracks, timestamps, metrics | Performance of the contract (Art. 6(1)(b)) |
| Thermal analysis, scores, and predictions | Data derived from flight and terrain | Performance of the contract; legitimate interest for safety and technical quality (Art. 6(1)(b)/(f)) |
| Optional RSFly AI training | Derived flight, thermal, terrain, solar, and weather features, with hashed identifiers and rounded coordinates | Explicit consent, revocable from profile settings (Art. 6(1)(a)) |
| Optional protected raw IGC archive | Raw IGC file, file hash, storage key, consent/partner provenance, and audit events | Explicit consent or documented partner authorization (Art. 6(1)(a)) |
| Comments and social features | Text, author, date, linked flight | Performance of the contract and legitimate interest for moderation (Art. 6(1)(b)/(f)) |
| Logs, security, debug, and abuse prevention | Technical logs, IP, user agent, application events | Legitimate interest and security obligations (Art. 6(1)(f)) |
| Payments, subscriptions, support, and tax obligations | Email, plan, cycle, customer/subscription ID, payment outcomes, transaction references | Contract performance, legal obligations, and legitimate interest in legal defense (Art. 6(1)(b)/(c)/(f)) |
| RSFly Intelligence Artwork and HD plan download | Flight id, user id, artwork status, render metadata, plan state, and protected media access logs | Contract performance for the plan and legitimate interest for support, security, and fraud prevention (Art. 6(1)(b)/(f)) |
By uploading IGC files, images, comments, or other content, the user represents that they have title, authorization, or another lawful basis to use them on RSFly and remains responsible for the lawfulness, accuracy, and relevance of uploaded data.
RSFly processes data provided by the user and external technical components. Replay, logbook, scoring, thermals, predictions, rankings, and Debrief are post-flight informational tools: they are not certified safety, navigation, operational meteorology, training, aviation consulting, or sports-validation services.
IGC note: the raw file may contain very precise technical and timing details. RSFly keeps it as needed for parsing, replay, diagnostics, security, support, operational continuity, and legal defense, within the limits described in this notice.
IGC tracks and full routes can reveal movements, habits, places, and presence times. RSFly therefore separates summary visibility from replay access: authenticated users can browse processed summaries, pilot counts, and rankings, while flight details and track APIs are limited to the owner, authorized staff, and accepted friends. Anonymous visitors remain blocked from the internal logbook, leaderboard, replay, and derived flight data.
RSFly computes automatic metrics and indicators to review the flight. Debrief chat uses the user's message, browser-sent history, and a compact technical evidence pack to produce an answer. When OpenAI API is configured, this pack is sent server-side to OpenAI as an external processor; when Ollama remains configured on a local host, inference is treated as an internal component. Debrief answers may be incomplete or wrong and are not operational instructions, certified weather, safety assessments, training, or professional advice.
To run the service, RSFly relies on the following processors/sub-processors. Some are activated only when the related feature is enabled. Any transfer outside the European Economic Area occurs only when necessary and based on adequacy decisions or appropriate safeguards, including Standard Contractual Clauses.
| Provider | Purpose | Country | Transfer mechanism |
|---|---|---|---|
| Railway | Application hosting, database, service execution | USA | Standard Contractual Clauses (SCC) + DPA |
| Cloudflare | CDN, DNS, security and anti-abuse, asset delivery | USA (global network) | Standard Contractual Clauses (SCC) + DPA |
| Stripe | Payments, subscriptions, customer portal, billing | Ireland (EU) / USA | EU entity (Stripe Payments Europe) + SCC for the US group |
| MapTiler | Maps and terrain tiles for the 3D replay | Switzerland | Adequacy decision (Switzerland) |
| Anthropic | AI processing for intelligent features (if enabled) | USA | Standard Contractual Clauses (SCC) + DPA |
| OpenAI | AI processing for Debrief Plus (if enabled via OpenAI API) | USA | Standard Contractual Clauses (SCC) + DPA |
| Google (Fonts, Analytics) | Web fonts; analytics only after consent | USA | SCC + consent for analytics |
| PostHog | Product analytics only after consent | EU / USA | SCC + consent |
| Open-Meteo | Weather enrichment for training/predictions (if enabled) | EU (Germany) | No transfer outside the EEA |
RSFly uses technical cookies required for operation, including session and CSRF cookies, which do not require consent.
Optional analytics tools (Google Analytics and client-side PostHog) use analytics storage only after consent, collected via a banner: without consent, or if denied, analytics and advertising storage stay denied by default. The preference can be changed at any time from the banner.
For maps, replay, and frontend resources, Google Fonts, MapTiler, MapLibre/demotiles, CARTO, ArcGIS, and OpenTopoMap may be involved. The thermal-map "locate" feature uses browser geolocation only after user action and consent, client-side, without intentional storage.
You may exercise the rights of access, rectification, erasure, restriction, objection, and data portability (Arts. 15-22 GDPR). Requests are normally handled within one month.
Portability (Art. 20): you can download the IGC files you uploaded, in a machine-readable format, directly from each of your flight detail pages, regardless of plan. Additional exports (GPX/KML/WPT) are available for plans that include them.
Erasure (Art. 17): self-service deletion of the account and of individual flights is available from profile settings and from the detail pages of flights you own.
Complaint (Art. 77): you may lodge a complaint with the competent supervisory authority, Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Roma, Italia — www.garanteprivacy.it.
To exercise your rights write to [email protected] (or via PEC to [email protected]). The legally binding version of this notice is the Italian one.
RSFly processes detailed location data. Use by minors must occur only under suitable legal grounds and, where needed, with involvement from the holder of parental responsibility.
RSFly applies reasonable technical and organizational security measures: HTTPS in production, secure cookies, CSRF controls, flight-detail access restrictions, authorization checks, and technical logs, without claiming zero risk.
User-uploaded content remains owned by the user or the respective rights holders. The user grants RSFly a non-exclusive license functional to hosting, backup, parsing, analysis, map rendering, metric generation, and security. RSFly code, interface, original text, assets, platform structure, and databases are protected. Mass scraping, unauthorized commercial reuse, reverse engineering for competing services, and systematic reuse of datasets, thermals, hotspots, or predictions are prohibited.
Privacy requests
To exercise privacy rights or report a flight-data access issue, use the dedicated contact.
[email protected]