Privacy Policy & Terms of Service

The data controller responsible for processing your personal data is:

• Roman Magerko
• aircodes@aircodes.sk
• Location: Slovakia / European Union

When you create an account or use the Service, we may collect the following personal data:

• Name (optional)
• Nickname (publicly visible)
• Email address
• Password (securely stored)
• User-generated content (e.g. comments, uploaded photos)
• Google account information — name and email address (only if you choose to sign in with Google, see Section 2a)
• Apple account information — name, email address (or an Apple private relay address) and an Apple user identifier (only if you choose to sign in with Apple in the iOS app, see Section 2c)
• Newsletter subscription data — email address and subscription details (only if you subscribe, see Section 2b)
• Discount offer preference — whether you switched offers on, when, and when an offer was last sent or opened (only if you switch them on, see Section 2d)
• Gift plan details — if you buy a plan as a gift: your name and email, the recipient's email, name and your message (see Section 2e)
• Plan details — which plans you have and when they end, used to send you a reminder before a plan ends (see Section 2f)
• Messages you send with the contact form in the iOS app — your email address and message (see Section 2f)
• Crash reports from the iOS app — anonymous technical data only (see Section 2f)
• Push notification subscription — a technical device/browser identifier (only if you allow notifications, see Section 5)
• IP address — used briefly to show prices in your local currency; we do not store it for this purpose (see Section 5)

We do not collect any additional personal data beyond what is necessary for the operation of the Service.

In addition to creating an account directly, you may sign in to the Service using "Sign in with Google."

When you use this option, Google shares the following information with us, based on the basic profile scope you approve on Google's consent screen:

• Your name
• Your email address

We do not request or receive access to your Gmail, Google Contacts, Drive, Calendar, or any other Google service.

Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. This data is used solely to create and authenticate your Air Codes account — it is never used for advertising and never sold or shared with third parties beyond what is necessary to operate the Service.

You can review or revoke Air Codes' access to your Google account at any time at myaccount.google.com/permissions. Google's own handling of your data is described in the Google Privacy Policy.

You can subscribe to the free Air Codes daily briefing — a once-a-day email with a selection of the latest aviation crash, accident and news posts from the Service. Subscribing is optional and does not require an account.

Double opt-in. After you enter your email address, we send you a confirmation email. You are added to the list only after you click the confirmation link. Unconfirmed sign-ups are automatically deleted after 7 days.

From your account. If you have an Air Codes account, you can also switch the newsletter on or off in your account settings. Because your account email address is already verified, switching it on subscribes you directly, without a separate confirmation email. You can switch it off there at any time.

When creating an account. The sign-up form has an optional, unticked "Send me the daily aviation briefing" box. If you tick it, you are subscribed only once you activate your account through the activation email.

For the newsletter we store:

• Your email address
• The date and time of your sign-up and of your confirmation
• The IP address used at sign-up, kept as a record of your consent
• The date the last newsletter was sent to you

Unsubscribing. Every newsletter contains an unsubscribe link. When you unsubscribe, your email address and all related newsletter data are deleted immediately. Your newsletter subscription is separate from your account: deleting your account does not unsubscribe you, and unsubscribing does not affect your account.

We do not use tracking pixels, open tracking or click tracking in the newsletter, and your email address is never sold, rented or shared for marketing purposes. Images in the newsletter may be loaded from the original image sources (for example Wikimedia Commons or Flickr) when you open the email.

In the Air Codes iOS app, you may also sign in using "Sign in with Apple."

When you use this option, Apple shares the following information with us, based on what you approve on Apple's sign-in screen:

• Your name — as you choose to share it; Apple provides it only the first time you sign in
• Your email address — either your real email address or, if you choose "Hide My Email", a unique random address created by Apple (ending in @privaterelay.appleid.com) that forwards to your real inbox
• A unique user identifier assigned by Apple, used to recognise your account when you sign in again

If you use Hide My Email, we never see your real email address. Emails we send you — such as account emails or the newsletter, if you subscribe — are delivered through Apple's Private Email Relay service.

This data is used solely to create and authenticate your Air Codes account. It is never used for advertising and never sold or shared with third parties beyond what is necessary to operate the Service. When you delete your Air Codes account, we also revoke the Sign in with Apple authorization.

You can stop using Sign in with Apple with Air Codes at any time in your Apple Account settings on your device or at account.apple.com. Apple's own handling of your data is described in the Apple Privacy Policy.

If you have an Air Codes account, you can choose to receive occasional e-mails with discounts on Air Codes paid plans. This is optional and off by default — you turn it on yourself with the Discount offers switch in your account settings.

When creating an account. The sign-up form has an optional, unticked "Send me occasional discounts on Air Codes paid plans" box, separate from the newsletter box. If you tick it, offers can be sent only once you activate your account through the activation email. Creating an account without ticking it does not sign you up for offers.

Offer e-mails are sent only by Air Codes, to your account e-mail address. Your e-mail address is not sold, rented or shared with anyone for this purpose.

For offers we store:

• Whether offers are switched on, and the date and time you switched them on or ticked the sign-up box (as a record of your consent)
• The date the last offer was sent to you
• The date and time you opened the offer link in an offer e-mail, if you do — used only to know whether the offer was used

Switching off. You can switch offers off at any time in your account settings, or with the link at the bottom of every offer e-mail. It takes effect immediately and does not affect your account or the newsletter.

Offers are sent only on the basis of Article 6(1)(a) GDPR — your consent, which you can withdraw at any time. We do not use tracking pixels or open tracking in offer e-mails.

You can buy an All-Access plan as a gift for someone else. For this we store your name and email address, the recipient's email address, the recipient's name (optional) and your personal message (optional), together with the gift code and whether and when it was redeemed.

Gifts can be bought on the website or in the Air Codes iOS app. On the website the payment is processed by Stripe; in the iOS app it is an in-app purchase paid with your Apple Account and processed by Apple. In both cases we never receive your card or payment details — only a confirmation that the gift was paid.

The recipient's details are used only to deliver the gift: we send one email with the gift code to the recipient and a copy to you. They are not used for marketing and are not shared with anyone.

Legal basis: Article 6(1)(b) GDPR for the buyer (performance of the purchase) and Article 6(1)(f) GDPR for the recipient (our legitimate interest in delivering a gift that was bought for them). The recipient can ask us at any time to delete their details.

Plan reminders. When a time-limited plan (10 days, 30 days or 1 year) is about to end, we send you one email to your account address a few days before the end date. It is a service message about your own purchase, so it is sent without separate consent. We record which reminder was sent, so you get each one only once. If you have switched on Discount offers (Section 2d), the reminder may also include a renewal discount code; without that consent it never contains offers. Lifetime plans get no reminders.

Contact form. The contact form in the iOS app sends your email address and message, together with the app version, iOS version and device model, by email to us. It is used only to answer you and is not stored in our database. To limit spam, we keep a scrambled (hashed) form of your IP address for one day.

Crash reports. If the iOS app crashes or freezes, your iPhone (Apple's MetricKit) gives the app a technical crash report, which the app sends to us so we can fix the problem. It contains only the app version, iOS version, device model and technical details of the crash — no account, name, email or location — and is not linked to you.

Legal basis: Article 6(1)(b) GDPR for plan reminders (part of the purchased service) and Article 6(1)(f) GDPR — our legitimate interest in answering your messages and keeping the app working — for the contact form and crash reports.

Your personal data is processed for the following purposes:

• Creating and managing user accounts
• Authenticating accounts via Sign in with Google or Sign in with Apple, where chosen
• Enabling user interaction (comments, content sharing)
• Maintaining security and functionality of the Service
• Sending the daily newsletter, where you have subscribed
• Sending discount offers on paid plans, where you have switched them on
• Delivering gift plans (the gift email to the recipient and a copy to the buyer)
• Processing payments for plans and gifts (on the website by Stripe, in the iOS app by Apple)
• Reminding you before a time-limited plan ends
• Answering messages you send with the contact form
• Finding and fixing app crashes
• Sending push notifications, where you have allowed them
• Showing prices in your local currency (EUR or USD)

Legal basis under GDPR: Article 6(1)(b) — processing is necessary for the performance of a contract (providing the Service). Where you choose to sign in with Google or Apple, this also relies on Article 6(1)(a) — your consent, given via the Google or Apple sign-in screen. The newsletter is sent only on the basis of Article 6(1)(a) — your consent, confirmed by double opt-in, which you can withdraw at any time by unsubscribing. Discount offers are sent only on the basis of Article 6(1)(a) — your consent, given with the sign-up box or the Discount offers switch in your account settings, which you can withdraw at any time. Push notifications are sent only on the basis of Article 6(1)(a) — your consent, given when you allow notifications in your browser or device, which you can withdraw at any time in your browser or device settings. Detecting your country to show prices in the right currency relies on Article 6(1)(f) — our legitimate interest in displaying correct prices.

Any content you upload (such as comments or photos) may be visible to other users. You are responsible for ensuring that:

• You have the right to publish such content
• The content does not violate any laws or third-party rights

We reserve the right to remove content that violates applicable laws or community standards.

We do not sell or share your personal data for marketing purposes. Your data may be processed by trusted third parties strictly for technical operation of the Service, such as:

• Hosting provider WebSupport — EU (including the mail server used to send account, newsletter and offer emails)
• Stripe Payments Europe, Ltd. — processes card payments for plans and gifts bought on the website. Stripe receives your email address and payment details; we receive only a payment confirmation, never your card number
• Google LLC — used solely to provide the optional Sign in with Google login feature
• Apple Inc. — provides the optional Sign in with Apple login feature in the iOS app, forwards our emails through Apple's Private Email Relay if you use Hide My Email, processes in-app purchases of plans and gifts paid with your Apple Account (we receive a signed purchase confirmation, never your payment details), and delivers push notifications in the iOS app through the Apple Push Notification service (APNs) if you allow them — for this we store only a device token issued by Apple
• OneSignal, Inc. (USA) — used solely to deliver web push notifications on the website if you allow them in your browser. OneSignal receives a technical identifier of your browser (a push subscription ID), basic technical data such as browser and device type, and the time of your subscription. OneSignal is not used in the iOS app. It does not receive your password and is not used for advertising.
• ip-api.com — when you view prices, your IP address is sent to this geolocation service to determine your country, so prices can be shown in EUR or USD. Only the resulting currency is used; we do not store your IP address for this purpose.

Push notifications. Notifications are optional and are only enabled after you allow them in your browser or device. You can turn them off at any time in your browser or device settings; your push subscription is then no longer used.

All such processing is limited to what is necessary and complies with GDPR requirements. Where a provider processes data outside the European Union (such as OneSignal in the USA), the transfer is covered by that provider's data processing terms with appropriate safeguards under GDPR.

• Your account data is stored within the European Union
• Push notification identifiers are processed by OneSignal (website) and Apple Push Notification service (iOS app), as described in Section 5
• Passwords are securely hashed using modern cryptographic algorithms
• Appropriate technical and organizational measures are in place to protect your data

Your data is stored as long as your account is active. You may delete your account at any time. Upon deletion, all associated data is permanently erased.

Accounts inactive for 2 years are automatically deleted without backup or archival.

Newsletter data is kept until you unsubscribe. Unconfirmed newsletter sign-ups are deleted after 7 days.

Your discount offer preference is kept until you switch offers off or delete your account.

Gift plan details (names, email addresses and the message) are kept for 2 years after the purchase, for support and accounting, and then deleted.

The record of sent plan reminders is kept for about one year. Contact form messages are not stored in our database (only in our mailbox); the hashed IP address used against spam is deleted after one day. Crash reports are kept for up to 90 days.

Under the General Data Protection Regulation, you have the right to:

• Access your personal data
• Request correction of inaccurate data
• Request deletion of your data ("right to be forgotten")
• Restrict processing
• Request data portability
• Object to processing

You can get a copy of all data we store about you at any time with the E-mail me my data button in your account settings. It is sent to your account e-mail address, with a machine-readable file attached. For any other request, contact us at the address below.

You also have the right to lodge a complaint with your local data protection authority (Slovakia: Office for Personal Data Protection).

The Service uses only essential cookies required for proper functionality, such as:

• Maintaining login sessions
• Basic site operation
• Remembering your day/night (dark mode) choice — the colorPreference / colorPreferenceMobile cookie. It stores only the value "dark" or "light", is set when you change the theme, stays on your device, and contains no personal data.

No tracking, analytics, or marketing cookies are used.

The Service is not intended for individuals under the age of 16. We do not knowingly collect personal data from children.

We may update this Privacy Policy from time to time. Any changes will be published on this page.

If you have any questions, requests, or concerns regarding your personal data, you can contact: aircodes@aircodes.sk

The Service allows users to:

• Create an account
• Share content (e.g. comments, photos)
• Interact with other users

You agree to use the Service only in compliance with applicable laws and these Terms.

• You are responsible for maintaining the confidentiality of your account credentials
• You are responsible for all activity under your account
• You must provide accurate information when registering
• You may not impersonate other individuals or entities

We reserve the right to suspend or terminate accounts that violate these Terms.

You retain ownership of any content you upload (e.g. photos, comments). By uploading content, you grant the Service a non-exclusive, worldwide, royalty-free license to:

• Store
• Display
• Distribute that content within the platform

You are solely responsible for your content.

You agree not to upload or share content that:

• Violates any laws or regulations
• Infringes intellectual property rights
• Contains hate speech, harassment, or threats
• Contains explicit or inappropriate material
• Belongs to another person or company without permission

We reserve the right to remove any content that violates these rules.

We may:

• Remove content without prior notice
• Suspend or terminate accounts
• Restrict access to parts of the Service

This is done to maintain safety, legality, and proper functioning of the platform.

You may delete your account at any time. Upon deletion, your data will be permanently removed (as described in the Privacy Policy).

We may suspend or terminate your account if you violate these Terms.

The Service is provided "as is" without guarantees of:

• Continuous availability
• Error-free operation

We may modify or discontinue parts of the Service at any time.

Lifetime plans. A “lifetime” plan is a one-time payment that gives access to the section it was bought for (for example Airports) for the lifetime of the Air Codes service — that is, for as long as Air Codes operates that section — and not for the lifetime of the buyer. Features, data sources and the way the section works may change over time. If the section or the Service is discontinued, lifetime access ends with it; we will announce this on the Service at least 30 days in advance. A lifetime plan is personal, linked to one account, and cannot be transferred.

To the maximum extent permitted by law:

• We are not responsible for user-generated content
• We are not liable for any damages resulting from use of the Service
• Use of the Service is at your own risk

Your personal data is handled in accordance with our Privacy Policy.

We may update these Terms at any time. Continued use of the Service after changes means you accept the updated Terms.

These Terms are governed by the laws of Slovakia / European Union.

For any questions regarding these Terms, contact: aircodes@aircodes.sk