Legal & Policies

Whose Data This Is

AutoPilot is business software: a flight school, club, or operator signs up, invites its staff and students, and runs its operation on the Platform. The operational records described below — schedules, dispatch entries, training folders, billing ledgers — are the School's records. The School decides who is enrolled, what is recorded, and how long records are kept; AutoPilot stores and processes those records on the School's behalf to provide the service. For your sign-in account itself, and for the public website, AutoPilot is directly responsible.

If you are a student or instructor with a question about a record your School keeps — a grade, a balance, an enrollment — your School's administrator is the right first contact. We support every such request the School passes to us.

Information We Collect

Everything below is provided directly by you or by your School. AutoPilot has no other sources: it buys no data, scrapes nothing, and receives nothing from data brokers or advertising networks.

Account information: Your name, email address, and the role your School assigns you (for example student, instructor, or staff). Sign-in uses your email address with a password or a one-time code; passwords are stored only in securely hashed form by our authentication provider.

Operational records: What you and your School enter to run the operation — reservations and scheduling requests, including preferred aircraft, instructor, time windows, and notes; dispatch records such as routes and aircraft hobbs and tach readings; aircraft, maintenance status, and squawk reports; flight-training records, including enrollments, graded lesson folders, and instructor endorsements; billing records such as charges, credits, payments, and balances; and qualification dates your School records to manage scheduling eligibility, such as a medical certificate expiration date.

Device and technical data: If you turn on notifications in the iOS app, your device's push token is registered with Apple's push service and with us so schedule updates can reach you. Our infrastructure providers keep standard server request logs — IP address, browser or device type, timestamps — for security and reliability. Your signed-in session is kept in your browser's local storage on the web, and in the system Keychain on iOS.

What we do not collect: No usage analytics or behavioral profiling. No advertising identifiers. No location. No access to your contacts, photos, camera, or microphone. If you use the iOS app's optional App Lock, Face ID is evaluated by iOS on your device; biometric data never reaches the app or us. The iOS app's App Store privacy label says the same thing: data linked to you is limited to contact info (your email address), identifiers (your account ID), and user content (the operational records you enter), all used solely for app functionality, and nothing is used to track you.

How We Use Your Information

We use collected information to:

• Run the service — showing the right schedules, records, and balances to the right people, according to the role your School assigned you.
• Send service messages — sign-in codes, invitations, and notices about your account — and, if you enable them, push notifications about your schedule.
• Keep the Platform secure, prevent abuse, and debug problems.
• Respond to support requests.
• Comply with legal obligations.

We do not use personal information for advertising, do not sell or rent it, and make no automated decisions about you that carry legal or similarly significant effects. We send no marketing email without consent.

Information Sharing

We never sell personal information and never share it for cross-context behavioral advertising. We share information only in the following circumstances:

• Within your School — with the staff, instructors, and administrators whose role requires it, as described above.
• Service providers — companies that host and run the Platform for us, bound to process data only to provide their service: Supabase (database, authentication, and email delivery), Netlify (web hosting), Apple (push notification delivery), and, where a School enables online payments, Stripe (payment processing; card details are entered into and handled by Stripe's own systems, and AutoPilot never receives or stores full card numbers).
• Regulators and legal process — flight-training records are federally regulated, and your School may be required to make them available to the FAA; we support that at the School's direction. We disclose information when required by law, subpoena, or court order, or to protect the safety and rights of users and of the Platform.
• Business transfers — if AutoPilot is acquired or its assets are transferred, records transfer with the service, with notice to affected Schools and users.

Data Retention & Security

Account data is kept while your account is active and deleted or de-identified within a reasonable period after closure. Operational and training records belong to the School, and aviation regulations require flight schools to retain certain training records — so records your School must keep are retained according to its instructions and legal obligations, and may persist after your own account closes. Server logs are short-lived and rotate automatically.

All traffic is encrypted in transit, and data is encrypted at rest by our database provider. Access is limited by row-level security and role-based permissions, so each account can reach only the records its role allows. No internet service can promise perfect security, but the Platform is built so that the shortest path to your data is through your own sign-in — keep it protected. Report suspected vulnerabilities or incidents to privacy@flywithautopilot.com.

Your Rights & Choices

You can request access to, correction of, export of, or deletion of your personal information by emailing privacy@flywithautopilot.com, or through your School. Where a record is controlled by your School — a training folder, a ledger — we refer the request to the School and support its response. Deletion has limits: records a School is legally required to retain, such as federally regulated training records, cannot be deleted while the retention obligation lasts.

Push notifications can be turned off at any time in iOS Settings. Service emails — sign-in codes, invitations, account notices — are part of operating your account.

United States state privacy laws: Residents of California and other states with comprehensive privacy laws have rights to know, access, correct, delete, and port personal information, and to be free of discrimination for exercising those rights. The categories we collect, the purposes, and the recipients are exactly those described above. We do not sell personal information, do not share it for cross-context behavioral advertising, and do not use it for targeted advertising — there is no sale or sharing to opt out of, and browser opt-out signals such as Global Privacy Control are honored by default.

Outside the United States: AutoPilot is operated from the United States, and data is processed there and in other countries where our providers operate. Where the GDPR or UK GDPR applies, we process personal data to perform our contract with you and your School, to meet legal obligations, for our legitimate interests in running and securing the service, or with your consent — and you additionally have the rights to object, to restrict processing, and to lodge a complaint with your supervisory authority.

Children

AutoPilot is a tool for flight-training providers, and flight students can be minors. Accounts for users under 18 are created through their School's enrollment and require parental or guardian consent, as our Terms of Service state. The Platform is not directed to children under 13, and we do not knowingly collect personal information from a child under 13; if we learn we hold such information, we will delete it.

Cookies & Tracking

The website, the console, and the app run no analytics or advertising code at all. AutoPilot sets no advertising or analytics cookies; your signed-in session is kept in your browser's local storage, and that is the extent of it. There is nothing to opt out of.

Updates to this policy are posted at this address with a new "Last Updated" date. Material changes are announced through the service or by email before they take effect. Earlier versions are available on request.

Purpose

Aviation is safety-critical, and AutoPilot holds the records a flight school runs its flight line on — schedules, dispatch times, maintenance status, and training folders. The integrity of those records is non-negotiable. This Acceptable Use Policy ("AUP") sets clear rules for how AutoPilot may and may not be used.

Violations of this AUP may result in immediate account suspension, permanent ban, and where appropriate, referral to the FAA or law enforcement.

Strictly Prohibited Uses

• Falsifying training records — entering grades, lesson completions, stage checks, or endorsements for training that was not given, or altering a record to misrepresent a student's progress.
• Falsifying dispatch or aircraft time records — misreporting hobbs or tach readings, routes, or check-in data.
• Falsifying maintenance information — concealing a known discrepancy, deleting or suppressing a squawk, or misrepresenting an aircraft's status to keep it on the schedule.
• Misrepresenting certificates or qualifications — including entering false qualification or medical-certificate dates used for scheduling eligibility.
• Impersonating any person, instructor, or aviation authority.
• Accessing data you are not authorized to access — another School's records, or records your role does not permit — or attempting to circumvent the Platform's security or role-based access controls.

Professional Standards

All users are expected to maintain professional standards consistent with the aviation industry. This includes:

• Treating students, instructors, staff, and other Members with respect.
• Keeping your account information current and accurate.
• Recording operational entries — times, squawks, grades — honestly and promptly, so the people relying on them are working from the truth.
• Using your access only for your School's operation, not to spam, harass, or solicit other users.

School & Operator Obligations

Schools, clubs, and operators using AutoPilot agree to:

• Use Members' personal data only to run their operation — never for unrelated marketing, and never to sell or disclose it outside the operation.
• Administer roles so each person can reach only the records their job requires, and keep administrator access limited to those who need it.
• Maintain the accuracy of the records they are responsible for, and correct errors when found.
• Comply with all applicable laws, including employment and anti-discrimination statutes, and the FAA regulations applicable to their certificate and operation.
• Ensure their staff and instructors understand and follow these policies.

Reporting Violations

If you believe another user is violating this AUP — particularly by falsifying training, dispatch, or maintenance records — please report it immediately. Aviation safety depends on the integrity of these records.

Nature of AutoPilot Training Records

Training records on the Platform are created and maintained by the School and its authorized instructors and staff in support of the School's training program, including programs conducted under 14 CFR Part 141. AutoPilot provides the software; it does not conduct training and does not certify the accuracy of any entry.

Grading, Endorsements & Responsibility

Grades, lesson completions, stage checks, and endorsements are entered by the School's instructors and staff under their own accounts, according to the roles the School administers. The person who records an entry is responsible for its accuracy, and the School is responsible for deciding who holds instructor and staff roles.

Students can see their own training folders through their account. If you believe a record about you is wrong, raise it with your instructor or your School's administrator — the School owns the record and is the one who can correct it.

Falsification — Consequences & Reporting

Falsifying any training record — a grade, a completion, an endorsement, or the aircraft times a lesson is built on — is a zero-tolerance violation of our Acceptable Use Policy. Report suspected falsification to safety@flywithautopilot.com.

Regulatory Records, Retention & Eligibility

Schools certificated under Part 141 are required by the FARs to maintain and retain student training records and to make them available to the FAA. AutoPilot supports that at the School's direction, and records a School is legally required to retain are kept according to its instructions and obligations — which may mean a training folder persists after a student's own account closes, as our Privacy Policy describes.

Dispatch and maintenance data — hobbs and tach readings, squawks, inspection countdowns — inform the School's scheduling and airworthiness decisions, but they are informational support, not a legal determination. The same applies to qualification dates recorded for scheduling eligibility, such as a medical certificate expiration: any eligibility or currency indicator on the Platform is a convenience, and pilots and Schools remain responsible for verifying eligibility, currency, and airworthiness directly against the applicable FARs before flight.

Export & Continuity

Schools can export training folders from the Platform and may request a full export of their records at any time, including within 30 days of closing their account. We recommend Schools maintain their own retention practices consistent with their training course outline and the FARs, and not rely on any single system — AutoPilot included — as the sole copy of records they are required to keep.