Privacy Policy

Last updated: 15 October 2026

Who is responsible What we process and why Who we share it with Transfers outside the EU Your rights Children Security The website Users outside the EU Changes

Who is responsible

The controller of your data is Pablo Asensio Martínez, Spanish tax ID (NIF) 06010425L, Travesía de Téllez 1, 28007 Madrid, Spain. Write to [email protected] with any privacy question or to exercise your rights.

Logbookly is a digital flight logbook for pilots (an iPhone app and the logbookly.app website). We process only the data needed to run it.

What we process and why

Data	Why	Legal basis	How long
Account: email and/or your Sign in with Apple or Google identifier	To identify you and link your flights to your account	Performance of the contract	While your account exists
Your flights and profile: dates, aircraft, times, landings, functions, notes, signature, and your name, licence, address and profile photo if you add them	The purpose of the app: keeping your logbook and syncing it across devices	Performance of the contract	While your account exists
Your medical certificate expiry date (if you enter it)	To remind you before it expires	Your explicit consent, which the app asks for before saving it	Until you delete it or your account
Other people you record: name and licence number of the PIC, instructor or examiner	They are part of the logbook entries (AMC1 FCL.050)	Legitimate interest in keeping a complete logbook	While your account exists
Flights you send from NavFly: the flight's GPS track (one point every 30 seconds) and the takeoff and landing times NavFly detected	To draw the route you actually flew on the map and keep the detected times even if you adjust them to block times	Performance of the contract (you send the flight and confirm it)	While you keep the flight or your account
Photos of logbook pages you scan	To extract the data with AI for you to review	Performance of the contract (you request the scan)	We do not keep them. Google may (see below)
Subscription status	To unlock Premium	Performance of the contract	While your account exists
Technical errors (no logbook content)	To detect and fix bugs	Legitimate interest	Up to 90 days
Anonymous usage statistics (e.g. "flight saved"), with app version, platform, language and a random session code that changes on every launch	To learn which features are used	Legitimate interest; they identify no one	13 months, then deleted automatically. You can turn them off in Settings → Privacy
Support messages	To answer you	Legitimate interest	As long as needed to answer, and at most 2 years

We do not sell your data, we do not use it for advertising, and we do not profile you or make automated decisions about you.

Logbookly does not access your phone's location. A flight's track only arrives if you send it from NavFly; it goes from one app to the other on your phone, and nothing is saved until you confirm the flight. From then on it syncs with your account like the rest of the flight, and you delete it by deleting the flight.

Do not write health information in your notes. The app only needs your medical certificate's expiry date; we neither ask for nor use anything else.

Who we share it with

Only with providers that deliver the service for us, under a data processing agreement:

Supabase (database, accounts, sync and profile photos). Servers in Frankfurt (EU).
Sentry (technical errors). Servers in Frankfurt (EU).
Google (Gemini) (reading the photos you scan). We use the free tier of the Gemini API: under its terms, Google may use the photos and the extracted text to improve its products, and Google staff may review them. Do not scan pages with data you do not want to share with Google; you can always enter flights by hand without scanning.
RevenueCat (checks with Apple whether your subscription is active). It receives your account identifier and purchase history, never your card.
Apple (subscription billing and Sign in with Apple) and Google (Google sign-in), if you use them.
Google Firebase Hosting (hosts the logbookly.app website; logs visitors' IP addresses for security).

We may disclose data to authorities where the law requires it.

Transfers outside the EU

Google, RevenueCat and Apple are US companies, and so are Supabase and Sentry, even though they store your data in the EU. Where there is access from the US, the transfer relies on the EU-US Data Privacy Framework, to which they are certified, and on the European Commission's standard contractual clauses.

Your rights

At any time you can ask for:

access to your data;
rectification of anything wrong;
erasure ("right to be forgotten");
portability: the app gives you a full copy (CSV and a backup file);
objection to processing based on legitimate interest;
restriction of processing;
withdrawal of your consent (for example, for the medical certificate), without affecting what came before.

Email [email protected]. We reply within one month at the latest. You can also delete flights, wipe your cloud data and delete your account in the app (Settings → Account), which removes all your data from our servers. The provider's encrypted backups roll over within 30 days at most.

If you think we have not handled your data properly, you can complain to the Spanish Data Protection Agency (aepd.es) or to the authority in your country.

Children

Logbookly is not directed at children under 14 (or the higher minimum age set by the law of your country), and we do not knowingly collect their data.

Security

Everything travels encrypted (HTTPS). Each account can only access its own data (row-level security in the database). On the phone, data uses the system's file protection. If a security breach affected you, we would notify the authority within 72 hours, and you whenever the law requires it.

The website

logbookly.app uses no cookies and no analytics, and stores nothing in your browser. Fonts are served from the website itself. The hosting provider logs visitors' IP addresses for security.

Users outside the EU

United States and California: we do not sell or share personal information for advertising. Since we do not track you across sites, nothing changes in response to a "Do Not Track" signal. The app is not directed at children under 13.
Brazil (LGPD): you have the same rights described above; you can complain to the ANPD.
Canada and other countries: we process your data with the consent you give by using the app, with the same safeguards as this policy.

Changes

If we change this policy in a meaningful way, we will tell you in the app before it applies. The current version and its date are always on this page.