FlightDex

FlightDex — Privacy Policy

Effective date: 2026-09-15 Last updated: 2026-10-17

FlightDex ("FlightDex", "we", "us") is a flight-tracking app operated by FlightDex. This policy explains what information the app collects, why, who we share it with, and the choices and rights you have. If you have questions, contact us at [email protected].

By using FlightDex you agree to this policy. If you don't agree, please don't use the app.

1. Information we collect

We collect only what we need to track your flights and run the app.

a) Account & identity. When you first open the app, our authentication provider (Google Firebase Authentication) creates an anonymous account identifier for you, with no sign-up, and it handles your sign-in credentials if you later choose to sign in. We store your account identifier so your flights and history stay tied to your account. We do not store your password. If you sign in with Google, Firebase processes your Google account's name and email address, and the app shows them on your account screen; we do not store them on our servers. See Google's privacy policy for how Firebase handles that.

b) Flight and travel information you provide. The flights you add and the details attached to them: flight numbers, airlines, dates, departure/arrival airports, scheduled and actual times, gates and terminals, seat, cabin/class, booking or confirmation codes, aircraft type, and tail numbers. From these we derive your travel history and Passport statistics (miles, hours, countries, airports, and achievement "stamps"). For each flight we also keep a record of the alerts we sent about it and of any delay prediction we made and how it turned out. If you organise flights into a trip, we also store what you write there: the trip name, your trip notes, and your packing checklist, and any label you give a flight you are watching. That text is yours — we store it only so it syncs to your other devices and survives a reinstall, and it is never used for anything else.

c) Flight import — calendar events and pasted confirmations (optional). The import screen takes text and finds flights in it. Whichever way that text reaches us, it is sent to our server only to scan it for flight information: it is parsed in memory within the request, the flights found are returned to you to review, and the text itself is not stored and not logged. Only the specific flights you choose to add are saved to your account. There are two sources, and you start both. Calendar: if you grant calendar permission, FlightDex reads your device calendar to detect upcoming flights and sends the text of events that look like flights. You can decline or revoke that permission at any time in your device settings, and the app lists the matching events and lets you untick any of them before anything is sent. A confirmation you paste: if you paste a booking confirmation, the text you paste is sent exactly as you pasted it. A confirmation usually contains more than flight details — your name, your booking reference, sometimes a ticket or frequent-flyer number — so the app shows you the exact text that will be sent, and sends nothing until you tap Send.

Your calendar, written (optional, from the next app update). If you turn on Add flights to my calendar, FlightDex writes your flights into the calendar you choose, on your phone; it never writes your booking code, name or seat, and nothing is sent to FlightDex to do it. The calendar permission is asked for only when you turn this on, and you can turn it off or revoke the permission at any time.

A flight-history file you choose to import from another app is sent to our server and read within the request. Only the flights in it are kept, as your Passport history; the file itself, and columns such as booking codes, seats and notes, are not stored.

d) Notifications. We store a push token from Google Firebase Cloud Messaging and your device platform so we can send you flight alerts (delays, gate changes, cancellations, and similar). Alerts go to a Pro account, and to a free account that follows a flight whose alerts reach its followers. In the current version of the app, the app offers its token to our server each time it starts, and the server keeps it for the account signed in on that phone, whatever its plan. From the next app update, we keep one for a phone only while it can be sent alerts: on a Pro account, or on a free account that follows such a flight; when the phone no longer needs it (you stop following, or Pro ends), the app removes it the next time it checks. Either way, the token is kept whether or not notifications are allowed on the phone, and it is removed when you sign out or delete your account. You can turn notifications off at any time in your device settings; that silences alerts but does not remove the token. The Firebase libraries also create an installation ID for this copy of the app, which Google uses to deliver notifications and sign you in.

e) Sharing and follows (optional). If you share a flight, we create a shareable link and store the flight status that the link exposes, and the display name you add, if any. If you follow a friend's shared flight, we store that follow relationship. Shared links exclude your booking/confirmation code and seat. They include a display name only if you choose to add one; if you do, it is shown to the people you share with and on the share link. A follower sees the flight's public status — such as its route, times, gates, baggage belt and progress, and, while it is in the air, the aircraft's last reported position — and not your personal booking details. Anyone holding the link can open it without an account. A link stops working three days after the flight arrives, or as soon as you revoke it.

f) Technical data needed to operate the service. Basic request data required to deliver the app (for example, your device's network address, which is needed to route responses). Our server keeps operational logs for a limited period: they record requests and events such as flight numbers you track and internal record identifiers, and some lines include your account's identifier or a shortened Google Play purchase reference. They do not contain names, email addresses or booking details. A flight number, or a route and date, you search for is sent to our server to find the flight; it is not saved to your account and not written to our application logs. We do not use advertising SDKs, build advertising profiles, or add an analytics SDK of our own (Google ML Kit's own diagnostics are described in 1(g)).

g) Boarding passes (on-device only). If you scan or import a boarding pass, it is stored encrypted on your device only. The barcode payload and its details are never uploaded to our servers, never logged, and are excluded from device-to-device transfer and cloud backup. Deleting the pass, or the app, removes it. We never receive this data. If you choose to add the pass's flight to your list, only its flight number and date are sent, as with any flight you add. The barcode is read on your device by Google's ML Kit; the image and the barcode are not sent anywhere, but Google says ML Kit may send Google basic diagnostics about the scanner (device and app information, performance, and a per-installation identifier).

h) Fares you enter (on-device only). If you record what a flight cost, that amount and its currency are stored only on your device, in their own local database file, and are never sent to our servers — we cannot see what you paid. Unlike boarding passes, that one file is included in Android's own backup, so a fare survives a reinstall or a move to a new phone; that backup goes to your personal Google account, never to us. Deleting the fare, or the app, removes it. A fare also appears in a flight log you export yourself, which you then choose who to share with.

i) Subscription and purchase data. If you subscribe to FlightDex Pro, your payment is processed by Google Play — we never receive or store your card number or other payment details. To unlock Pro features we receive and store, from Google Play, a purchase token, the plan you chose, and your subscription status (for example: active, in trial, or expired) and its renewal/expiry date. We verify this with Google's Play Developer API so that only a genuine, active subscription unlocks Pro. Apart from the server log lines that record each purchase check (see 1(f)), this is the only purchase-related data we hold.

We do not collect your device's GPS/location, your contacts, your photos, or your microphone. Camera access, if you grant it, is used only to scan a boarding-pass barcode on your device (see 1(g)); no photo or camera image is uploaded or stored.

On our website (flightdex.app), not in the app

Everything above is about the FlightDex app. Our website is separate, and what it records stays with the website: it is never linked to your FlightDex account or to app data.

j) Website feedback (optional). If you use the feedback form on our website, the message you send — and your email address, only if you choose to include one — is delivered to us through our form provider, Formspree, so we can read and reply. We use it solely to respond and to improve FlightDex; it is never sold or used for advertising.

k) Website analytics (Cloudflare Web Analytics). Our website host, Cloudflare, counts visits to the pages of flightdex.app for us with Cloudflare Web Analytics. It sets no cookies and stores nothing in your browser, and Cloudflare says it does not use your network address to identify you. What it records is aggregate: which page was visited (the address without any query string), the referring site, your country, your browser, operating system and type of device, and how fast the page loaded. Cloudflare keeps the full detail for 7 days and a sample of about one in ten after that, and lets us view it for up to six months. The page a shared-flight link opens is left out of these analytics, so a share link is never recorded there. This information is never linked to your FlightDex account or app data.

2. How we use your information

We use your information to: add and track your flights; show live status and estimated times; send the alerts you opt into; build your travel history and Passport; enable flight sharing and follows that you initiate; provide and manage your FlightDex Pro subscription and unlock Pro features for active subscribers; keep the service secure and working; and comply with legal obligations.

Delay predictions and status are estimates. Flight information can be delayed or inaccurate. Always confirm critical details (like departure time and gate) with your airline.

3. How your information is shared

We do not sell your personal information, and we do not share it for advertising.

We share information only with service providers that help us run the app, and only as needed:

We may also disclose information if required by law, or to protect the rights, safety, and security of our users or the service.

When you choose to share a flight or follow a friend, the limited flight information described in Section 1(e) is shared with the people you share it with. That sharing is under your control and can be stopped.

4. Data retention and deletion

We keep your information while your account is active. You can permanently delete your account and all associated data at any time from within the app: You → Account → Delete account. This removes your flights, history, Passport, device tokens, and share/follow relationships from our database straight away. Copies can remain for a short time in our database provider's recovery backups (up to 3 days) and in server log lines written before you deleted your account, until they age out. You can also request deletion by emailing [email protected]. Boarding passes and fares are kept on your device and we never receive them, so there has never been a copy of either on our servers to delete. Deleting your account erases them from the phone, as does deleting them individually or uninstalling the app. One exception, and it is not ours to reach: fares are included in your own Android backup, so a figure you typed can survive a reinstall or a move to a new phone. That backup belongs to your Google account rather than to us, and you control it in your device's backup settings. Boarding passes are excluded from it entirely. See our account deletion page for full details.

5. Your rights

Depending on where you live, you may have rights to access, correct, delete, or export your personal information, and to object to or restrict certain processing (for example under the EU/UK GDPR or the California CCPA/CPRA). You can exercise deletion directly in the app, or contact us at [email protected] for any request. We will not discriminate against you for exercising these rights.

6. Security

We protect your information with industry-standard measures, including encryption in transit (HTTPS) between the app and our servers, and encryption at rest for boarding passes stored on your device. Secret credentials are held server-side and are never shipped in the app. No method of transmission or storage is perfectly secure, but we work to protect your data and to be honest with you if something goes wrong.

7. International transfers

Your information may be processed in the United States and other countries where our service providers operate. Where required, we rely on appropriate safeguards for such transfers.

8. Children

FlightDex is not directed to children under 13 (or the minimum age required in your country), and we do not knowingly collect their personal information. If you believe a child has provided us information, contact us and we will delete it.

9. Changes to this policy

We may update this policy as the app evolves. We will post the new version at https://flightdex.app/privacy and update the "Last updated" date. Significant changes will be communicated in the app where appropriate.

10. Contact

Questions or requests: [email protected]. FlightDex