Privacy Policy

Who we are

41aero is operated by [TODO: legal entity name and registered address] ("we", "us"). We are the controller of the personal data described here.

For anything about this policy or your data, contact privacy@41aero.com. You can also open a support ticket from your dashboard.

The short version

• We collect what we need to run your account, sell you our products, check your licence and keep the service secure.
• Our add-ons check your licence and tie it to one PC. They don't upload your files, screenshots, flights or browsing history.
• We don't run analytics, advertising or tracking scripts on the website, and we don't sell your data.
• The only cookies we set are ones the site needs to work. See the Cookie Policy.

What we collect

Your account

When you register and use the dashboard we store:

• your username and email address
• your password, stored only as an Argon2 hash and never in plain text
• two-factor details: your authenticator secret if you turn on an authenticator app, and short-lived hashes of email codes
• your access request, if you send one: what you tell us about how you'll use 41aero and how you found us, and the reviewer's decision and notes
• account state: when you registered, the products you own, and whether the account is staff or suspended

Our add-ons

When you sign in from one of our add-ons, such as the 41aero Ground control panel, it sends us identifiers read from your PC's hardware and Windows installation. We combine them into a device fingerprint so your licence works on one PC. We also record the IP address and country you connect from and when you last used the add-on.

We use this to check your licence, to spot accounts being shared or resold, and to move your licence when you change PC. We don't use it for anything else.

The airports, routes and spots you set up in 41aero Ground stay on your PC. [TODO: confirm that setups aren't uploaded]

Payments

When you buy something, [TODO: payment provider] handles the payment. We receive and keep the product, amount, currency, date, status and the provider's reference for the payment. We don't receive or store your full card details.

Discord (optional)

If you link Discord, we store your Discord user ID, username and the tokens Discord issues, so we can connect the two accounts and add you to our community server. We don't store your Discord email address or your list of servers. Unlinking Discord from your dashboard deletes them.

Support tickets

We store the tickets you open, the messages in them and any images you attach. Images are re-encoded when you upload them, which strips their metadata, such as location. Staff can add internal notes to a ticket, which you won't see.

Security logs

To protect the service we keep server logs and rate-limit counters. These can include your IP address, the pages and endpoints you called and when. Rate-limit counters expire after a short window.

Why we use it (legal bases)

We don't make decisions about you based solely on automated processing that have legal or similarly significant effects. If a licence check blocks you, a person reviews it when you contact us.

Who we share it with

We use these service providers to run 41aero. They process data only on our instructions:

We only disclose data otherwise if the law requires it, or if we need it to protect our rights or someone's safety. We don't sell personal data or share it for advertising.

International transfers

Some of these providers are based in, or store data in, the United States or other countries whose data protection laws may differ from yours. Where the law requires it, we rely on Standard Contractual Clauses or similar safeguards for these transfers.

How long we keep it

• Account data: while your account exists, then deleted within 30 days of you asking us to close it.
• Device fingerprint and sign-in history: while your account exists. If an account was suspended for sharing or reselling, we keep the related records for 12 months afterwards.
• Payment records: as long as tax and accounting law requires, usually up to 10 years, even if you close your account.
• Support tickets and images: 2 years after the ticket is closed. Images may be removed sooner.
• Server logs: 30 days.
• Email and reset codes: until they're used or expire, usually within minutes.

Your rights

Depending on where you live, you can ask us to:

• give you a copy of your data (access and portability)
• correct data that's wrong
• delete your data
• restrict or object to how we use it, including uses based on legitimate interests
• withdraw consent, for example by unlinking Discord

To make a request, email privacy@41aero.com from the address on your account, or open a support ticket. We reply within one month. If we can't deal with a request in full, for example because we have to keep payment records, we'll tell you why.

You can also complain to the data protection authority where you live.

Security

Passwords are hashed with Argon2. Sessions are signed tokens in an HTTP-only cookie. Codes and reset tokens are stored only as hashes, and our add-ons talk to us over encrypted connections. No system is perfectly secure, but if a breach affects your data we'll tell you and the relevant authority where the law requires it.

Children

Our products aren't aimed at children under 13 [TODO: or 16, depending on where you operate], and we don't knowingly collect their data. If you believe a child has signed up without a parent's permission, contact us and we'll delete the account.

Changes

If we change this policy we'll update the date at the top. If a change is significant, we'll also tell you by email or with a notice in the dashboard before it takes effect.