Last updated: July 24, 2026
Flight Owl ("we", "our", "the app") is operated by TBM Solutions LLC. This policy describes how we collect, use, and protect your personal data when you use the Flight Owl mobile application.
Data controller: TBM Solutions LLC, a Wyoming limited liability company, United States. Contact: [email protected].
| Data | Purpose | Stored where |
|---|---|---|
| Email address | Account authentication | Our authentication provider |
| Display name | Profile personalization | Our servers (EU) |
| Profile photo, if you set one | Profile personalization | Our servers (EU), on your account record. Remove it any time from Profile |
| Tracked flights | Flight alerts and predictions | Our servers (EU) |
| Flight journal entries | Travel history (user-created) | Our servers (EU) |
| Feature requests & votes | Community product feedback (user-submitted) | Our servers (EU) |
| Device push token | Push notifications | Our servers (encrypted at rest) |
| Coarse location | Nearby airports (when permitted) | In-memory only (not persisted) |
| Purchase history | Subscription management | Our subscription processor, which is separate from the app store that handles payments |
| Crash reports | Bug fixing | Our crash-reporting processor |
| Anonymous usage events + masked session recordings | Feature analytics | Our analytics processor (EU, no user ID sent, IP discarded) |
Under Article 6 of the GDPR, every use of your data needs a legal basis. Ours are:
| What we do | Legal basis |
|---|---|
| Create and run your account, track your flights, produce predictions, store your journal, manage your subscription | Performance of a contract (Article 6(1)(b)). You asked us to provide this service. |
| Send push notifications, read your coarse location, store a profile photo | Consent (Article 6(1)(a)). All three are off until you switch them on, and you can withdraw at any time. |
| Fix crashes, prevent abuse, enforce rate limits, keep the service secure | Legitimate interests (Article 6(1)(f)). Our interest is a working, non-abused service; the data involved is minimal. |
| Measure anonymous feature usage | Legitimate interests (Article 6(1)(f)). No user identifier is sent and IP addresses are discarded. |
| Keep audit and deletion records | Legal obligation (Article 6(1)(c)) and legitimate interests, so we can show that a deletion request was honoured. |
Where we rely on legitimate interests, you have the right to object. See "Your Rights" below.
You can sign in with email/password, Apple, or Google. Authentication is handled by a third-party authentication provider on our behalf. When you sign in with Apple, you may choose to hide your email address; Apple provides a private relay address instead. We accept either.
All notification types are disabled by default. You choose which alerts to enable (delays, gate changes, departures, arrivals, weekly digest). We record the timestamp when you change notification preferences. Device tokens are encrypted at rest using AES-256-GCM.
Subscriptions are processed by the app store you installed Flight Owl from, which on iPhone is Apple's App Store. We verify subscription status through a third-party subscription processor. We do not process or store payment details. See Apple's privacy policy for payment data handling.
| Type of processor | Data shared | Purpose |
|---|---|---|
| Authentication provider | Email, account ID | Signing you in |
| Push delivery providers | Device token, notification content | Push notifications and Live Activity updates |
| Subscription processor | Account ID, subscription status | Subscription management |
| Crash-reporting processor | Account ID, crash traces | Error monitoring |
| Analytics processor (EU) | Anonymous event names, masked session recordings (IP discarded) | Privacy-first analytics |
| Team messaging tool | Your email address and an excerpt of feedback you submit | Routing in-app feedback to our team |
We name categories rather than individual vendors here, as Article 13(1)(e) of the GDPR permits. If you want the specific processors behind any category, ask us at [email protected] and we will tell you.
Our own servers are in the European Union, and our analytics runs on EU infrastructure. Your data stays in the EU for everything we host ourselves.
Some of the processors above are operated from the United States, so using them involves transferring personal data outside the EU and EEA.
Those transfers rely on the European Commission's Standard Contractual Clauses, which are built into the data processing agreement we have with each provider, and on the EU-US Data Privacy Framework where the provider is certified under it. You can ask us for more detail at [email protected].
TBM Solutions LLC is established in the United States and does not currently have an establishment in the European Union.
Under the EU General Data Protection Regulation, you have the right to:
Device tokens are encrypted at rest with AES-256-GCM. All communication uses HTTPS with TLS 1.2+. API requests from the app include HMAC-SHA256 attestation signatures. Database access uses least-privilege roles.
Flight Owl is not directed at children under 16 and you need to be at least 16 to create an account. We do not knowingly collect data from children. If you believe a child has given us personal data, write to [email protected] and we will delete it.
We may update this policy. Significant changes will be communicated through the app. Continued use after changes constitutes acceptance.
For privacy questions or data requests: [email protected]. We are the data controller for the personal data described here, and that address reaches us directly.
For anything else, see our support page.