Privacy Policy

1. Information We Collect

We collect the following categories of information:

• Account information: name, email address, phone number (optional), profile photo (optional), authentication provider (email / Google / Apple), email-verification status, and the timestamp of account creation and last update.
• Aircraft and operational data: tail numbers, make, model, year, total airframe and engine hours, home base, ownership shares, bookings, flight hours, maintenance items, and recorded costs.
• User-uploaded content: photographs and document files (PDFs, images) you choose to attach — for example, fuel and maintenance receipts, photos of completed maintenance, pilot licenses, insurance and registration documents.
• Device and notification data: push-notification tokens issued by Apple (APNs) and Google (FCM) via Expo, the operating-system platform, and limited diagnostic information needed to deliver notifications and to sign in.
• Authentication tokens: short-lived access tokens stored on the device in the platform's secure storage (Keychain on iOS, Keystore on Android, localStorage on the web).

We do not collect precise GPS location, contacts, microphone audio, calendar entries, or health data.

2. Permissions We Request and Why

Each permission is requested only at the point you use the related feature. You can deny or revoke permissions at any time in your device settings — the app will continue to work, with the corresponding feature disabled.

• Camera (android.permission.CAMERA, NSCameraUsageDescription): used only when you tap "Take photo" to capture a receipt, a maintenance photo, a pilot-license image, or any aircraft-related document. We do not record video or use the camera in the background.
• Photo library (NSPhotoLibraryUsageDescription, READ_MEDIA_IMAGES): used only when you tap "Choose from library" to attach an existing photograph to a cost, a maintenance item, or a document.
• Notifications: used to alert you about booking requests, approvals, maintenance due dates, completed maintenance, and activity from co-owners. You can disable categories individually in your profile settings.
• Internet / network state: required to communicate with our backend.

3. How We Use Information

• To create and authenticate your account, including via Google and Apple sign-in.
• To run the core product features: bookings, ownership shares, maintenance tracking, cost splitting, document storage.
• To notify you of events relevant to your aircraft and co-owners.
• To investigate misuse, prevent fraud, and enforce our Terms of Use.
• To comply with legal obligations and respond to lawful requests.

We do not use your data for advertising, profiling, or to train AI models.

4. Third-Party Services

SkyPartners relies on the following sub-processors:

• Google Sign-In: if you sign in with Google, Google shares your Google account ID, email, name, and (optionally) profile picture with us. See Google's Privacy Policy.
• Sign in with Apple: if you sign in with Apple, Apple shares an opaque user identifier and (on first sign-in) the email address and name you choose to share. Apple may provide a private-relay email which forwards to your real address. See Apple's Privacy Policy.
• Expo Push Notifications: push notifications are delivered via Expo, which forwards them to Apple Push Notification service (APNs) and Firebase Cloud Messaging (FCM). The push token is a non-identifying device handle. See Expo's Privacy Policy.
• Hostinger SMTP: we use Hostinger to deliver transactional email (account verification, password reset, notification emails).
• VPS hosting: the SkyPartners backend, database, and uploaded documents are stored on dedicated server infrastructure located in the European Union.

5. Data Sharing

We do not sell personal data. We share information only with the sub-processors listed above to operate the service, and with co-owners within your aircraft (for example, costs you record become visible to the other owners of that aircraft, by design).

We may disclose information when required by law, to enforce our terms, or to protect the rights, property, or safety of users or third parties.

6. Security

We apply reasonable administrative, technical, and organizational measures: passwords are hashed with bcrypt, sessions use signed JWTs with limited lifetime, traffic is encrypted in transit (HTTPS), uploaded files are stored outside the public web root, and access is gated by ownership checks. No method of transmission or storage is fully guaranteed.

7. Data Retention and Account Deletion

We retain your data for as long as your account is active. You can delete your account at any time:

• In the mobile app: Profile → Account → "Delete Account".
• On the web: Profile → "Delete account" at the bottom of the page.

Account deletion takes effect immediately: you are signed out, your sessions are invalidated, push notifications stop, and you lose access to all aircraft and shared data. Co-owner records, costs, maintenance items, and documents that you authored may remain visible to the co-owners of an aircraft for operational continuity, and may be retained in aggregated or anonymised form to satisfy legal and accounting obligations.

You can also request deletion or export of your personal data by writing to hello@readbackai.cloud.

8. Your Rights

Depending on where you reside, you may have the right to access, correct, port, or delete your personal data, to object to or restrict processing, and to withdraw consent. Residents of the EU/EEA, UK, Switzerland, and California have additional rights under the GDPR and CCPA respectively. To exercise any of these rights, contact us at hello@readbackai.cloud. We will respond within the timeframes required by applicable law.

9. Children's Privacy

SkyPartners is intended for adult licensed pilots and aircraft owners. We do not knowingly collect personal information from children under 13 (or under 16 in jurisdictions where that is the threshold). If you believe a child has provided us with information, contact us and we will delete it.

10. International Transfers

Our infrastructure is located in the European Union. If you access the service from outside the EU, your data will be transferred to and processed in the EU under applicable safeguards.

11. Changes to This Policy

We may update this Privacy Policy to reflect changes in our practices or for legal, operational, or regulatory reasons. The "Effective date" at the top reflects the most recent change. Significant changes will be announced in-app or by email.

12. Contact

For privacy-related questions or requests, email us at hello@readbackai.cloud.