In short
- Flyaway works without an account. Your flights are then stored only on your device.
- There are no ads, no advertising trackers and no third-party SDKs that collect data. We never sell or share your data for advertising.
- If you create an account, your flights are backed up to our server so you can restore and sync them. Your profile is private unless you make it public.
- You can delete your account and its synced data at any time in the app or on the website.
Who is responsible
Flyaway (the iOS app and flyaway.day) is run by Andreas Gassmann, Switzerland. For anything about your data, write to support@flyaway.day.
Flyaway can also be pointed at a server someone else runs (Settings → Server and data). If you use another server, its operator decides how your data is handled there, and this policy covers only what happens on your device.
Using the app without an account
Your flights, the people you travel with, seats, booking references, boarding pass data, notes and settings are stored on your device. API keys you enter are kept in the iOS Keychain. None of this is sent to us.
To show flight information, the app makes these requests while you use it:
- Flight search. The flight number, airline or route and the date you search for go to the Flyaway server, which asks our flight data provider (AeroDataBox). If you entered your own AeroDataBox key, it is passed along for that request and not stored on the server.
- Live positions and flight paths. For flights in the air, the app asks the OpenSky Network directly for the aircraft’s position, using the aircraft’s transponder address. You can turn this off in Settings.
- Live traffic and aircraft details. With Other planes turned on, the Globe tab loads aircraft positions from the Flyaway server. Aircraft photos come from Planespotters.net.
- Weather. Only if you add an OpenWeather key: the coordinates of your departure and arrival airports go to OpenWeather with your key.
- Maps. Maps are drawn with Apple Maps.
These requests carry no name, account or list of your flights. Like any internet request, they reveal your IP address to the server that answers. The Flyaway server keeps IP addresses in memory for a short time to limit abuse and does not write them to its database or logs.
Travel reminders are scheduled on your device as local notifications. Widgets and Live Activities are drawn on your device from the flights stored there.
Server search records
To operate the service and monitor provider quotas, the server records flight search times, normalized flight numbers or routes, requested dates, whether a server or personal key was used, outcomes, result counts, provider call counts and durations. Signed-in searches include your account ID. Operators can view these records for up to 30 days, after which they are deleted. Deleting your account detaches its ID from these records. API keys, IP addresses and raw provider responses are never included in search records.
Your account
An account is optional. When you sign in, we store:
- Sign-in details: your email address and a provider identifier. With Sign in with Apple you choose whether to share your name and real email address; Apple may give us a private relay address instead. With Google, your name and email come from your Google account.
- Profile: your username, display name, and, if you add them, a short bio, home airport and profile picture. Your username is suggested from your name or email address, and you can change it.
- Backup: your flights with everything in them, including seats, booking references, boarding pass data, notes and the names of people you travel with, plus the names and home airports of those people.
- Sessions: a hashed sign-in token per device with the device model (for example “iPhone”) or browser name, so you can see and sign out your devices.
- Following and blocks: the profiles you follow, who follows you, and the accounts you have blocked.
- Usage counts: how many flight searches and flight paths you requested per day, to enforce daily limits.
Email sign-in codes go to the address you enter through our email provider. Codes expire after 15 minutes and are deleted within the hour. Sessions end after 90 days without use.
Public profiles, following and share links
Profiles are private until you make them public. A public profile at flyaway.day/u/your-username shows your display name, username, bio, profile picture, home airport, follower counts, the airports and routes you have flown and totals such as distance, flight time and countries. It never shows dates, upcoming flights, seats, booking references, boarding passes, notes or other travelers. Profile pages and share links ask search engines not to index them.
When you share a trip or your profile as a link, a snapshot is stored on the server: flights, airlines, airports, times, gates and optionally a traveler name for a trip; routes and totals for a profile. The link works for anyone who has it until you stop sharing, which deletes the snapshot. Links created without an account can only be stopped from the device that created them.
Reports
When you report a profile, we store who reported it, which profile, the reason, any note you add, and a copy of the profile’s username, display name and bio as they were at that moment. The report is emailed to the people who review reports. The reported person is not told who reported them. Reports are deleted a year after they have been handled, or straight away when the reported account is deleted; if you delete your own account, your reports stay without your name.
Who else receives data
- Our hosting provider, which runs the Flyaway server and its database for us.
- Our email provider, to deliver sign-in codes and reports.
- AeroDataBox (flight search), the OpenSky Network (positions and flight paths), adsbdb and Planespotters.net (aircraft details and photos), and OpenWeather (weather, only with your key), as described above.
- Apple and Google, to verify Sign in with Apple and Google sign-in. When you delete your account, we ask Apple to revoke Flyaway’s access.
Some of these providers process data outside Switzerland and the EU, including in the United States. Where that happens, we rely on the safeguards the law provides, such as adequacy decisions or standard contractual clauses.
The website
flyaway.day uses no advertising trackers. It sets a session cookie when you sign in and a language cookie if you pick a language, and remembers your light or dark choice in your browser. The live map and the Joyride game load map tiles from third-party servers, and the sign-in page loads Apple’s and Google’s sign-in scripts.
How long we keep data
Account data stays until you delete your account. Deleting your account removes your profile, sign-in methods, sessions, backup, follows, blocks, usage counts, profile picture and the share links tied to your account straight away. Copies may remain in encrypted backups for up to 30 days. Data on your device stays until you delete it or remove the app.
Your rights
You can see and change your profile in the app and at flyaway.day/account, and delete your account in the app (Settings → your account → Delete account) or on the website. You may also ask us for a copy of your data, a correction or deletion, or object to how we use it, by writing tosupport@flyaway.day. We use your data to provide the features you ask for: to run your account under our agreement with you, and to keep the service secure under our legitimate interest. If you think we handle your data wrongly, you can complain to the Swiss Federal Data Protection and Information Commissioner or a data protection authority in your country.
Children
Flyaway is not aimed at children under 13, and we do not knowingly create accounts for them. If you believe a child has created an account, contact us and we will delete it.
Security
Connections to flyaway.day are encrypted. Sign-in tokens and codes are stored only as hashes, and on your device your session and API keys are kept in the Keychain.
Changes
If this policy changes, we update the date at the top. For significant changes, we tell you in the app or by email before they take effect.