Skytrails Privacy Policy
Last updated: September 29, 2026
Protecting your data matters to us. This policy explains what Skytrails collects, why, who it is shared with, and what rights you have.
Skytrails is built around data minimisation. We run no advertising networks and no third-party analytics or tracking SDKs.
1. Controller
StagWorks
Benjamin Seeger und Maximilian Rosnauer GbR
Beinsteinerstraße 40
71394 Kernen im Remstal
Germany
Email: info@stagworks.de
2. Account data
When you create an account we process your email address, display name and — if you set one — your profile photo. Sign-in runs through Firebase Authentication, either with email and password or with Google Sign-In. If you use Google Sign-In, Google supplies us with your email address, name and profile picture.
Your profile photo is stored as a compressed image inside your user document, not in a separate file store.
Legal basis: Art. 6(1)(b) GDPR — performance of the contract with you.
3. Flight logs and GPS tracks
The core of Skytrails is your logbook. We process:
- Flight entries: date, departure and destination airport, aircraft registration, duration, distance, and any notes you add.
- GPS tracks. When you record a flight, the app samples your position, altitude and time, and stores the result on the flight as a track of up to 400 points.
- Derived statistics: total hours, distance, airports and countries visited.
Your logbook stays private. Nobody else can read your flights, routes, times or tracks: not your friends, not other pilots, not your public profile. This is enforced by the database's security rules, not only hidden in the app. The one exception is yours to make: a pilot you link as crew on a flight can read that one flight, so they can add it to their own logbook. Your airplanes and homebases are private in the same way. Profile → Privacy in the app shows what is shared with whom.
Background recording. So that a recording survives you locking your phone, Skytrails keeps receiving location updates while it is in the background. On iOS this is visible as the blue status bar indicator; on Android it runs as a foreground service with a persistent notification. Recording only ever runs while you have explicitly started a flight, and you can stop it at any time. Skytrails does not request "allow all the time" background location access.
Legal basis: Art. 6(1)(b) GDPR.
4. Sharing your position with other pilots
Position sharing works in two separate ways:
- Live flights. While recording, the app can publish your current position, altitude, speed and flight phase. This is readable only by pilots you are mutually friends with and who you have switched on in your sharing preferences. Nobody is on that list unless you add them. Publishing is throttled and stops when the flight ends; an abandoned record is treated as stale after two minutes and removed.
- Spot Map. While you record a flight, your aircraft appears live on the map for other signed-in pilots, with your name and photo, registration or callsign, altitude, speed, destination and the path flown so far. It is removed when the flight ends.
Please note: when you fly as a crew on a shared flight, the crew list — pilot names and their role on that flight — is visible to any signed-in Skytrails user who can see that aircraft on the map. This is deliberate, so that a plane on the map can be identified, but it means your name and role are not limited to your friends in that case.
You can stop sharing at any time in the app, which deletes the published record.
Legal basis: Art. 6(1)(a) GDPR — your consent, given by enabling sharing and withdrawable at any time.
5. Photos
Photos you match to a flight never leave your device. Skytrails stores only the local photo library identifiers, so the images are resolved from your own library each time. Identifiers from another device simply do not resolve.
Photos you attach to a community post are different: those are uploaded. They are compressed and stored inside the post document itself, and are visible to the audience you chose for the post — your group, or the public pilot feed. Before upload, the app removes the photo's metadata (EXIF), including where it was taken. The same applies to your profile photo.
Legal basis: Art. 6(1)(b) GDPR, and Art. 6(1)(a) for anything you choose to publish.
6. Community
Groups (clubs) store their name, invite code and member list. Posts store their text, photos and author. Anything you post to the public feed is visible to every signed-in Skytrails user; anything posted to a group is visible to that group's members.
Your flight log is visible only to you and to pilots you are friends with.
Reports and blocks. When you report content or a pilot, we store the report (category, your optional note, an excerpt of the reported content, and your user id) so we can review it and, where the law requires, pass it to authorities. Reports are deleted after 12 months, unless we have to keep them longer by law (for example as evidence in a child-safety case). The pilots you block are stored with your account so the block holds on every device. Legal basis: Art. 6(1)(c) and (f) GDPR — our legal duties as a hosting service and our interest in a safe community.
7. Leaderboard
If "Show me on Top Pilots" is enabled, your display name, profile photo, your totals (flights, minutes flown, distance, airports, countries), your personal records and the badges and records you pin are published to the global leaderboard and your public profile, readable by all signed-in users. A record can name an airport, an aircraft type or a route (for example your biggest airport or your busiest route). Turning the setting off deletes your leaderboard entry and stops further publishing. Your detailed flight log is never published — only these totals and records.
Legal basis: Art. 6(1)(a) GDPR — your consent.
8. Push notifications and Live Activities
To deliver notifications — a friend taking off, an invitation to fly together, a Live Activity showing a friend's flight in progress — we operate a relay server. It stores your device push token and the state of currently running Live Activities. This data is technical, regenerable, and holds no flight history: the relay reads live flight state and forwards it, and never writes flight data back.
You can switch notifications off in your operating system settings at any time.
Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in operating the service, and Art. 6(1)(a) where your OS asked for your permission.
9. Processors and recipients
| Processor | Purpose | Location |
|---|---|---|
| Google Ireland / Google LLC (Firebase) | Authentication, Firestore database, file storage, crash reporting, push delivery | EU / USA |
| Oracle Corporation (Oracle Cloud) | Virtual server hosting our notification relay | EU |
| Mapbox | Map tiles and 3D map rendering | USA |
| Apple Inc. | Push notifications and Live Activities on iOS | USA |
Where data is transferred to the USA, the transfer is covered by Standard Contractual Clauses under Art. 46 GDPR or an equivalent safeguard, such as the EU–US Data Privacy Framework. We have concluded data processing agreements under Art. 28 GDPR with our processors.
We do not sell your data, and we do not share it for advertising.
10. Crash reporting
Firebase Crashlytics collects diagnostic data when the app crashes — device model, operating system version, and a stack trace. This is used solely to fix faults.
Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in a stable app.
11. Data stored only on your device
Some things never reach our servers at all: your saved crew contacts and their phone numbers, your matched photo identifiers, the intro-completion flag, your language choice, and your leaderboard opt-out. Uninstalling the app removes them.
12. Retention
We keep your account data and flight logs for as long as your account exists. Live position records are short-lived by design and are removed once a flight ends or goes stale. Deleting your account removes your profile, flights, leaderboard entry, community posts and your list of blocked pilots.
13. Your rights
Under the GDPR you have the right to:
- Access the data we hold about you (Art. 15)
- Rectification of inaccurate data (Art. 16)
- Erasure (Art. 17) — you can delete your account and all associated data yourself, from the profile screen
- Restriction of processing (Art. 18)
- Data portability (Art. 20)
- Object to processing based on legitimate interest (Art. 21)
- Withdraw consent at any time, without affecting processing already carried out (Art. 7(3))
To exercise any of these, email info@stagworks.de.
You also have the right to lodge a complaint with a supervisory authority. The authority responsible for us is the Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg.
14. Children
Skytrails is not directed at children under 16. We do not knowingly collect data from them.
15. Changes
We may update this policy as the app changes. When a change is material, the app asks you to review and accept the updated version.
Last updated: 29 September 2026