Privacy policy

I collect as little personal data as I can, and I never sell it. This policy explains what Open Flight World collects when you visit the website, fly the simulator, create an account or buy something, why, who receives it and what you can do about it.

Who is responsible

The data controller is the company that operates Open Flight World ("I" or "me" in this policy). Its contact address is [email protected], where its identification details are provided on legitimate request; it is also the way to reach me about your data, as is the contact form.

What I collect and why

When you visit the site or fly

• Technical data. Like any website, my servers receive your IP address, your browser's description and the addresses you request. They are used to deliver the pages, keep the service secure and fix problems, and are kept for a limited period. Basis: my legitimate interest in running a secure service.
• First-party measurements. The site and the simulator send short events (a page was opened, a button was pressed, a flight started, an article was read to the end) with the page, the website you came from (its name only), the type of device, the language and your country (from your IP address, as a two-letter code; the IP address itself is not stored with them). A random session number kept in your browser tab puts the steps of one visit in order, and disappears when you close the tab. Anything that looks like an e-mail address or a phone number is discarded before it is stored. Basis: my legitimate interest in understanding how the service is used, without identifying you.
• A visitor id, only if you accept. If you press Accept in the banner, your browser keeps a random identifier so I can tell one visit from the next. It is never created if you reject, and you can change your choice at any time with the Cookies link at the bottom of every page. Basis: your consent.
• Price tests. I sometimes test different prices. The version you see is drawn at random (from your visitor id if you accepted it) and, once you buy All Access, kept with your account so it stays the same.

When you create an account

• Your e-mail address, the language you used, when you created the account and last used it, that you accepted the terms, whether you want news by e-mail (only if you ticked the box), and the country you signed up from. Basis: the contract between you and me; your consent for news.
• To sign you in: one-time codes and links (stored only as hashes, valid for 15 minutes and deleted within a day) and your sign-in sessions (stored as hashes, valid for 30 days and renewed as you use them).
• If you are signed in, the measurements above are linked to your account, so I can understand, for example, which pages helped someone decide to buy.

When you buy

Payments are made in the checkout of Freemius, my reseller and merchant of record, which collects your payment details directly under its own privacy policy. I never see or store your card details. From Freemius I receive what I need to give you what you bought: the licence number, the plan, the billing cycle, its status and end date, your Freemius customer number and the e-mail address used. I also keep what you unlocked and a record of each checkout you opened (when, what, which plan and currency). Basis: the contract between you and me, and the legal obligations that apply to sales.

When you write to me

The contact form sends me your e-mail address, your name if you give it, the subject and your message, its language and, if you are signed in, your account. Basis: my legitimate interest in answering you, or the steps before a contract.

Who receives your data

I use a few providers to run Open Flight World. Each receives only what it needs:

• Freemius: payments, invoices and taxes, as merchant of record.
• Resend: delivers the e-mails I send (sign-in codes, purchase confirmations, replies).
• Cloudflare: delivers the site and protects it from attacks; it handles your IP address and the requests you make.
• My hosting provider, which rents me the servers in the European Union where the site, the accounts and the measurements are stored.
• Google: the site's typeface is loaded from Google Fonts, and in the simulator's HD mode the 3D buildings come from Google Maps Platform. Your browser connects to Google for them, so Google receives your IP address and those requests.
• Map and imagery providers whose tiles the simulator may load directly in your browser, such as OpenFreeMap (OpenStreetMap data), Esri and NASA. Like any website your browser visits, they receive your IP address and the requests for those tiles.

I do not sell or rent your data, and I do not use advertising trackers.

Some of these providers are based outside the European Economic Area, mainly in the United States. Transfers to them rely on the safeguards the GDPR provides, such as the European Commission's standard contractual clauses or the EU-US Data Privacy Framework.

How long I keep it

• Your account: until you delete it.
• Sign-in sessions: 30 days from their last use. Sign-in codes and links: deleted within a day.
• Purchases: as long as needed to give you what you bought and to meet legal and tax obligations.
• Messages: as long as needed to answer you and follow up.
• Measurements: kept to understand how the service is used over time. They do not contain your name, your e-mail or your IP address.

When you delete your account, I delete it with your sessions and what you unlocked, and I unlink your purchases, checkouts and measurements from you, so they no longer identify you.

Your rights

You can ask me for access to your data, to correct it, to delete it, to restrict or object to its use, and to receive it in a portable format. You can delete your account yourself, at any time, from your account page, and withdraw any consent you gave (the visitor id, the news by e-mail) at any time. To exercise any right, write to [email protected] or use the contact form; I may need to confirm that the request comes from the owner of the account.

If you think I have not handled your data properly, you can complain to the data protection authority of your country.

Security

The site and the simulator only work over HTTPS. There are no passwords to leak: you sign in with one-time codes, and the codes, links and sessions are stored only as hashes. Access to the data is limited to what is needed to run the service.

Children

Open Flight World can be enjoyed by people of any age, but creating an account or buying requires being old enough to do so under the law of your country, or the permission of a parent or guardian.

Changes

I will update this policy when what I do with data changes. The date at the top shows the latest version; if the change is important, I will say so on the site and, if you have an account, by e-mail.

See also the cookie policy and the terms.