Legal
Privacy Policy
Effective 2 October 2026 · Pilotly (pilotly.co.uk)
Your logbook is personal. This policy explains what Pilotly collects, why, who sees it, how long we keep it and the rights you have over it, in plain English. It applies to the Pilotly website and app, and to the emails we send.
1.Who we are
Pilotly (pilotly.co.uk) is run by [Operator's legal name, e.g. Example Ltd], [a company registered in England and Wales, company number 00000000], whose registered office is at [Registered office address]. In this policy “we”, “us” and “our” mean that business.
We are the controller of the personal data described here, under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. We are registered with the Information Commissioner’s Office (ICO) under number [ICO registration number].
For anything about your data, email privacy@pilotly.co.uk. We don’t have a Data Protection Officer; the same address reaches the person responsible.
2.The short version
- We collect what you put into your logbook so we can keep it, work out your currency and remind you before things run out.
- We don’t sell your data, show adverts, or use analytics or advertising cookies.
- Your data is stored on servers in Germany (in the EU).
- You can download everything or delete your account yourself, at any time, from Profile → Your data.
3.What we collect
Information you give us
- Account details — your email address, display name and password. Passwords are stored only as a salted hash; we can’t read them.
- Pilot profile — anything you choose to add: home airfield, bio, pilot status, flying club, photo.
- Your logbook — flights (dates, airfields, aircraft, times, landings, notes), imported GPS tracks (positions, altitudes, speeds and times), aircraft and maintenance records, flight plans, your diary and its reminders, goals, personal minimums, weather watchlist, airfields visited and photos you upload.
- Licences, ratings and medical — titles, issuing authority, reference numbers, issue and expiry dates, and your medical certificate class. See medical information below.
- Instructor features — if you’re linked with an instructor, lesson feedback and messages between you.
- Feedback — what you send us through Help & feedback, with the page you sent it from.
- Payments — if you take a paid plan, our payment provider (Stripe) handles your card. We never see your full card number; we receive only the plan, payment status and limited card details (such as the last four digits).
Information created as you use Pilotly
- Calculations — currency, readiness and insights worked out from your logbook.
- Email records — which emails we sent you and when, so a reminder isn’t sent twice.
- Security records — for example, that you accepted these documents, or that an account was deleted.
- Server logs — your IP address, browser type, the pages and data requested, and the time. Every website records these to run and protect itself.
What we don’t collect
We don’t use your device’s location, read your contacts, or use analytics, advertising or social media trackers. Positions in Pilotly come only from tracks you choose to import.
Medical information
Details of a medical certificate (its class and validity dates) can count as health data, which the law treats as special category data. We only hold it if you choose to add it, we use it only to show whether your certificate is valid and to remind you before it expires, and we rely on your explicit consent, which you give by adding it. You can withdraw that consent at any time by deleting the details; the rest of Pilotly carries on working. Please don’t add medical notes, diagnoses or limitations beyond what the certificate shows.
4.How we use it, and our lawful basis
The law requires a reason (“lawful basis”) for each use. Ours are:
| What we do | Lawful basis |
|---|---|
| Run your account and logbook: store your records, work out currency and readiness, show weather, airspace and traffic, sync between devices | Contract — it's the service you signed up for |
| Account emails: confirming your address, password resets, security notices, telling you about changes to these terms | Contract, and our legitimate interest in keeping accounts secure |
| Reminder emails: documents expiring, recency lapsing, diary reminders (you can turn each off) | Contract — they're features of Pilotly, and you can switch them off |
| Medical certificate details | Your explicit consent (see above), alongside contract |
| Keeping Pilotly secure, preventing abuse and fixing faults, including server logs | Legitimate interests — running a safe, reliable service |
| Reading your feedback to improve Pilotly | Legitimate interests |
| Taking payment and keeping financial records | Contract, and legal obligation (tax law) |
| Responding to legal requests and enforcing our terms | Legal obligation, and legitimate interests |
Where we rely on legitimate interests, we’ve weighed them against your rights; you can object (see your rights). We don’t make decisions about you by automated means that have legal or similarly significant effects. Currency and readiness indicators are aids to your own judgement, not decisions.
We don’t send marketing emails. If we ever want to, we’ll ask first.
6.International transfers
Your data is stored in Germany, which the UK recognises as giving adequate protection. Where a provider is based outside the UK and EU (Resend and Stripe are US companies), the transfer is protected by safeguards the UK recognises, such as the UK Extension to the EU–US Data Privacy Framework or the UK International Data Transfer Addendum to standard contractual clauses. Email us for details.
7.How long we keep it
| Information | How long |
|---|---|
| Your account, logbook, documents, photos and everything else in it | Until you delete your account. It's then removed from our live systems straight away |
| Backups | Daily backups are kept for 30 days and one monthly backup for 12 months, so deleted data leaves them within 12 months. Backups are only used to recover from a fault |
| Email records | 13 months |
| Server logs | Up to 30 days |
| Payment and invoice records | 6 years after the end of the tax year they relate to, as tax law requires |
| A record that an account was deleted or terms were accepted (no logbook content) | As long as needed to show we've met our obligations |
We don’t currently delete inactive accounts. If we introduce that, we’ll email you well before anything is removed.
8.Keeping it safe
Pilotly is served only over encrypted connections (HTTPS). Passwords are hashed, sessions are signed and can be ended everywhere by resetting your password, uploaded photos are private to your account, and access to our servers and backups is restricted. No system is perfectly secure. If a breach puts your rights at risk, we’ll tell you and the ICO as the law requires.
9.Your rights
Under UK data protection law you can:
- See your data — download a complete copy (a JSON file) from Profile → Your data, or ask us.
- Correct it — edit it in the app, or ask us.
- Delete it — delete your account from Profile → Your data, or ask us.
- Take it elsewhere — the download is machine-readable (portability).
- Object to uses based on legitimate interests, or ask us to restrict how we use your data.
- Withdraw consent (for medical details) at any time by deleting them.
- Turn off reminder emails from Notifications → Email, or with the link in any reminder.
To use a right we can’t do in the app, email privacy@pilotly.co.uk. We may need to confirm it’s you. We’ll answer within one month, and it’s free.
If you’re unhappy with how we’ve handled your data, please tell us first. You can also complain to the Information Commissioner’s Office: ico.org.uk/make-a-complaint, or 0303 123 1113.
10.Children
Pilotly is for people aged 13 and over. We don’t knowingly hold data about anyone younger. If you think a child under 13 has an account, email us and we’ll delete it.
12.Changes to this policy
If we change this policy in a way that matters, we’ll tell you by email or in the app before it takes effect, and update the date at the top. The current version is always at pilotly.co.uk/privacy.
Questions about this document? Email privacy@pilotly.co.uk.