Privacy Policy
What data AIP:Aero processes, and what it does not. No accounts, no advertising, no social plugins - and usage statistics that work without cookies.
Controller
The controller responsible for data processing on this website is Alexander Dross (Dross:Media). For contact details please see our contact page and our imprint.
Hosting and server logs
This website is hosted on Cloudflare Workers. When you access the site, Cloudflare processes technical connection data (such as your IP address) to deliver the pages and to ensure security and stability. The source code is deployed via GitHub. See the Cloudflare Privacy Policy.
Usage statistics (Cloudflare Web Analytics)
We measure how often our pages are opened, using Cloudflare Web Analytics. It works without cookies and does not use client-side storage to recognise you. The measurement script is delivered from our own domain, but the measurement itself is reported by your browser directly to Cloudflare, so Cloudflare receives the connection data involved (such as your IP address, the page address and the referring page). We only ever see aggregated figures, such as page views per page, country and device type. See the Cloudflare Privacy Policy.
First-party measurement (performance, errors, app installs)
To keep the site fast and working, our own server records three small technical measurements. All three go to our server only, are never passed to third parties for their own purposes, and contain no identifier - no cookie, no device ID, no IP address - so they cannot be linked to you or to each other.Loading speed: the page address (path only) together with technical timing values of your page view, deleted after 90 days. Errors: when a script fails, the error message, its technical stack trace and the page address are sent to our server, which forwards them to our error-analysis provider Sentry so we can fix the fault. Installation: if you install this site as an app, we count that event together with a coarse platform and browser category (for example "ios", "safari").
Counting clicks on external links
When you follow a link on an aerodrome page to another site (for example the AIP, an approach chart, an aerodrome's website, a PPR portal, Google Maps, Wikipedia or a flight-planning app), your browser sends a short notice to aip.aero on the click. The link itself goes straight to the destination. This lets us count which links are actually used. On a page saved for offline use, links to the AIP and to charts go through an address under aip.aero/go/, so that an outdated copy still takes you to the edition currently in force once you are back online; that request is counted the same way.We store only a daily total per combination of destination type and domain, aerodrome (ICAO code or the page's short name), page section, page language, country (derived by Cloudflare from the connection, country only), approximate age of the page, and a technical classification of the request (click, automated request or invalid link). The time of individual clicks is not stored. No IP address, no user agent, no cookie and no device ID; the figures cannot be linked to you. To prevent abuse, the IP address is counted briefly as a salted hourly hash in a cache and never stored permanently. The destination only learns that you came from https://aip.aero/, not from which page. The daily totals are deleted after 12 months. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in knowing which links are useful).
Spam protection (Cloudflare Turnstile)
Our contact form, the widget sign-up and the app launch waitlist are protected against automated abuse by Cloudflare Turnstile. It is loaded only once you start filling in the form, so simply opening the page does not contact it. Turnstile checks technical characteristics of the request to distinguish humans from bots.
Advertising
This website shows no advertising. No ad is loaded, no advertising script runs and no advertising cookies are set. Should we ever display advertising, we will amend this policy beforehand.
Search Console
We use Google Search Console to understand how the site performs in Google Search. It provides us with aggregated statistics and does not identify individual visitors. For background, see the Google Privacy Policy.
Local storage (favorites and offline)
Your saved airports, favorites and offline-saved pages are stored locally in your browser (localStorage and the browser cache). This data stays on your device and is not transmitted to us.
Maps
The interactive maps (the airport map and the VFR charts on the detail pages) now serve their base map from our own domain since the switch to vector maps: the tiles are cached and delivered by our server, so no third-party tile server receives your IP address. The weather overlays on the detail pages - the precipitation radar (RainViewer) and the satellite image (EUMETSAT) - do load directly from those providers in your browser, but only after you tap them; doing so transmits your IP address to their servers (as with the webcams below).
Webcams (Windy)
Our airport pages embed webcam preview images from Windy; loading these images transmits your IP address to the windy.com servers. Windy's timelapse player (iframe) only loads after you tap a preview image; at that point Windy may set cookies and show ads. See the Windy privacy policy.
Aeronautical data and weather
Aerodrome data, weather (METAR/TAF), the meteogram's forecast data and address lookups are fetched by our server from third-party sources such as the Aviation Weather Center (NOAA), Open-Meteo, OpenAIP and OpenStreetMap/Nominatim. These requests are made by our server, not by your browser, so your personal data is not shared with them.
Location (locate me)
The map's optional 'locate me' button uses your browser's geolocation only after you tap it. It shows your position as a live moving map (the map follows your position and displays ground speed, track and altitude while the feature is active). Your location is processed in your browser only and is neither stored nor transmitted to us or any third party; tracking ends as soon as you turn it off or leave the page.
App launch waitlist
On our app page you can leave your email address to be notified once the native app is released. We store that address first-party, use it only for that single launch announcement, and never share it or use it for anything else. A repeated sign-up of the same address changes nothing. You can ask us to delete it at any time using the contact details in our imprint; the form is protected by Cloudflare Turnstile (see above).
Briefing by mail
On the aerodrome pages you can have a flight-planning and weather briefing PDF sent to an e-mail address. To do that we process the e-mail address you enter, the up to three ICAO codes of your route (departure, destination, alternate) and the page language. The legal basis is Art. 6(1)(b)/(f) GDPR - you asked for the mail yourself.We keep these details for 180 days and then delete them automatically. They exist only to build the briefing, to trace what happened to a send, and to bound the service against abuse (at most ten briefings per address per day). There is no newsletter - we write to you only with the briefing you asked for. We do not store an IP address for this, not even hashed; the abuse limit uses a salted, hourly-rotating counter that never reaches our database.If you also use the direct PDF download, we briefly keep the generated briefing in Cloudflare R2 storage so you can download it straight away. That file is deleted automatically after at most two days, and the download link itself is only valid for 24 hours. The PDF holds the same details as the mail and is not stored linked to your e-mail address.Every mail carries an unsubscribe link. Following it adds the address to a suppression list and we send it no further briefings. That list holds the address in the clear and is not deleted after 180 days: an objection has to outlive the request it objects to - otherwise we would start writing to you again once the period expired.We send through Cloudflare Email Sending, which receives the recipient address and the content of the message so it can be delivered. The form is protected by Cloudflare Turnstile (see above). The briefing is an informational snapshot and does not replace the official pre-flight briefing.
The AIP:Aero app (iOS and Android)
This policy covers the app as well. It runs no user accounts, shows no advertising and uses no advertising identifier (no IDFA, no Advertising ID) - which is why iOS shows no tracking prompt.Install identifier: on first launch the app generates a random identifier and stores it on the device. It is derived from nothing that describes your device, and exists only so that active use can be counted at all. With it we store a short list of events (first launch, pack downloaded, chart shared, notifications enabled) and one “was active” row per day. Those rows are deleted after twelve months; only the first launch is kept, as a running total carrying nothing else.Deletion: the app shows you its install identifier in its settings so you can quote it in a request to info@aip.aero, and you can reset it there - the app then mints a new one and the old one is retired on our side. Without an account there is no other way for you to name your own rows, which is why both exist.Notifications: only if you turn them on do we store your device’s push token together with the list of aerodromes and countries you want to hear about. That list is technically necessary - without it there is no way to tell who a new NOTAM at a given aerodrome concerns. It replaces any previous selection outright, so an unstarred aerodrome really does go away, and turning notifications off removes the entry. On Android delivery goes through Firebase Cloud Messaging (Google as a processor, with no other Firebase product), because Android offers no other delivery route; on iOS through Apple’s own service.Location: the app asks for location only for “aerodromes near me”, and only when you use that feature. The position is used on the device and never transmitted to us - the list is computed locally from data you already downloaded, which is also why it works with no signal.Charts: aerodrome pages are shown inside the app in an embedded browser window served from aip.aero, where everything above applies. In the app the performance measurement additionally carries a coarse platform label (“ios” or “android”) so app figures can be told apart from browser ones. The approach charts themselves are downloaded by your device directly from the relevant aviation authority - those files do not pass through our server.
Your rights
You have the right to access, rectification, erasure, restriction and objection regarding your personal data, and the right to lodge a complaint with a supervisory authority. As we run no user accounts and store no personal profiles, the data we process is minimal. To exercise your rights, please use the contact details in our imprint.
More information
For network-wide details beyond this website, see the full Dross:Network privacy policy.