Privacy policy

Who is responsible

Bradley Fowler, a sole trader in the United Kingdom, is the controller of your personal data for Learn To Fly (“we”, “us”). For anything about your data, email bradley.fowler123@gmail.com.

What we collect

• Account details: your email address and, if you add them in your profile, a username, full name and profile picture link. If you sign in with Google, we receive your name, email address and profile picture from Google. Passwords are stored only as secure hashes by our sign-in provider; we never see them.
• Study data: the lessons you mark as finished, your practice and exam answers, scores and streaks, so we can show your progress and readiness.
• Search: what you type into search is used to find matching lessons and isn't saved to your account or our database (our provider's request logs may briefly include it).
• Feedback board: posts, comments and votes you make, with your display name, and a record of when you posted (to prevent spam).
• Subscription data: from Paddle, your subscription status, plan, renewal and cancellation dates, refund or chargeback status and Paddle customer and subscription references. We never receive your card or bank details.
• Messages: emails you send us and our replies.
• Technical data: IP address, browser and request logs kept by our hosting and database providers for security and troubleshooting.

Why we use it, and our lawful basis

• To provide Learn To Fly (your account, lessons, progress, Premium access and the feedback board): necessary for our contract with you.
• To send service emails such as sign-up confirmation, password resets and important notices about your account, subscription or these policies: necessary for our contract with you. We don't send marketing emails, and won't without your consent.
• To keep the service secure, prevent abuse and spam, moderate the feedback board, fix problems and improve the content: our legitimate interests in running a safe, accurate service. We use study data in aggregate to find questions or lessons that need improving.
• To keep business and tax records and respond to legal claims: legal obligation and our legitimate interests.

We don't sell your data, show ads or make automated decisions about you that have legal or similarly significant effects.

Who we share it with

These providers process data for us, under contracts that require them to protect it:

• Supabase: our database, sign-in, file storage and server functions. Your account, study, feedback and subscription data is stored in its London (UK) region.
• GitHub Pages (GitHub, Inc., USA): hosts the website and keeps request logs such as IP addresses.
• Resend (USA): emails us when a feedback post or comment is made. These emails contain the post, your display name and what it relates to, not your email address.

These organisations receive data as independent controllers, under their own privacy policies:

• Paddle: our reseller and merchant of record. When you subscribe, Paddle collects your payment details, email address, country and billing details directly, to process the payment, prevent fraud and meet its tax obligations. See Paddle's privacy notice.
• Google: only if you choose “Continue with Google”. See Google's privacy policy.

We may also share data if the law requires it, or to protect our rights or someone's safety.

International transfers

Some of these providers, or their support staff and sub-processors, are in the US or other countries outside the UK. Where data is transferred outside the UK, it is protected by UK adequacy regulations (including the UK–US “data bridge” where the recipient is certified) or by approved safeguards such as the UK International Data Transfer Addendum to the EU standard contractual clauses. Email us if you would like more detail.

Cookies and local storage

We only use storage that is needed for the site to work or to remember choices you make, so we don't ask for cookie consent:

• Sign-in cookies that keep you logged in (set by our sign-in provider, Supabase).
• Your browser's local storage for your exam track, theme, practice settings and any unfinished practice test, and short-lived session storage to return you to the right page after signing in.
• Paddle's checkout script, loaded on the pricing page to show local prices and take payment, which may set cookies needed for secure checkout and fraud prevention.

We don't use analytics, advertising or tracking cookies. If that ever changes, we will ask for your consent first.

How long we keep it

• Account, profile and study data: until you ask us to delete your account. We delete it within a month of your request.
• Feedback posts and comments stay on the board after you delete your account, shown under your display name but no longer linked to you. Ask us if you want them removed as well.
• Subscription records in our database: until you delete your account. Paddle keeps its own payment and tax records as merchant of record, and we keep our business accounting records for as long as tax law requires (usually six years).
• Emails: as long as needed to deal with your request, and no more than two years.
• Server logs: a short period set by each provider, typically days to weeks.

Your rights

Under UK data protection law you have the right to ask for a copy of your data, to have it corrected or deleted, to object to or restrict how we use it, and to receive it in a portable format. Email bradley.fowler123@gmail.com from the address on your account. We will reply within a month (we may need to confirm your identity first). If you live in the EU, you have similar rights under the EU GDPR.

Complaints

If you are unhappy with how we have handled your data, please email bradley.fowler123@gmail.com first. We will acknowledge your complaint within 30 days and tell you the outcome. You also have the right to complain to the Information Commissioner's Office (ico.org.uk, 0303 123 1113), or to the data protection authority where you live.

Children

Many student pilots are teenagers, so Learn To Fly is open to anyone aged 13 or over. It isn't meant for children under 13, and we don't knowingly collect their data; if you believe a child under 13 has an account, email us and we will delete it. If you are under 18, please don't use your real name as your username, and ask a parent or guardian before subscribing.

Changes

If we change this policy in a way that matters, we will tell you by email or in the app before the change takes effect. See also our terms of service.