01 / THE BASICS
Information we handle
When you request beta access, we receive your name, school, email address, and any message you send. We use those details to respond to your request.
For a member account, we store an email address, school membership and role, and any name or profile details provided. If you use a password, we store a salted password hash rather than the password itself. We use a session cookie to keep you signed in and short-lived records to protect sign-in, invitations, and password resets.
A school can provide or import its roster, aircraft, reservations, and lesson details. Members can add notes and feedback. Flightslog stores flight tracks, proposed matches, review decisions, and published replays so the appropriate school members can revisit a lesson. Flight positions can come from Flightradar24 or public ADS-B sources; schedules can come from a connected Google Calendar, Flight Schedule Pro, or an uploaded calendar file.
02 / GOOGLE CONNECTIONS
Google sign-in and Calendar are separate
If you connect Google for sign-in, we receive your verified email address and Google's stable account identifier. We use them only to link the Google account you chose to your existing Flightslog account and to sign you in later. Google sign-in does not give Flightslog access to your calendars, and it does not create a school membership by itself.
A school administrator can separately authorize a read-only Google Calendar connection. During setup, we list calendars available to that Google account so the administrator can choose one or more reservation calendars. The authorization can cover calendars accessible to that account; after selection, Flightslog reads events from each selected calendar to import reservations and match students, instructors, and aircraft. Event titles, descriptions, times, and attendee details may be used for those matches. We do not create, edit, or delete Google Calendar events.
We store each selected calendar's identity, imported reservation details, and an encrypted Google refresh token needed for future syncs. Disconnecting a calendar removes its token and stops future reads. Previously imported reservations and lessons remain in the school workspace until removed separately. We use information received from Google Workspace APIs only for these user-facing features and in accordance with the Google API Services User Data Policy, including its Limited Use requirements.
03 / PURPOSE & ACCESS
How we use and share it
We use this information to run accounts, send invitations and password resets, import schedules, identify possible flight matches, show lesson replays, respond to support requests, and protect the service from misuse. We do not sell member or Google user data or use Google Calendar data for advertising.
School access follows membership and role. School owners and administrators manage their school's roster and reservations. Students see their own published lessons; instructors see lessons assigned to them. Personal notes are visible to their author, while shared lesson feedback is visible to the people allowed to view that lesson. One school's private workspace is not available to another school.
Cloudflare hosts the service and stores account, school, and flight data. Resend delivers account and invitation emails and forwards beta access requests to us. Google provides sign-in and optional Calendar access. When a school enables a schedule or flight-data connection, the relevant provider supplies that data; flight lookup requests may include an aircraft registration and time window. We share information with these providers only as needed to operate the requested features.
04 / CONTROL
Retention and choices
We keep account, school, reservation, and note records while they are needed for the workspace. Flightradar24 flight captures are normally removed after 30 days; reservation details and notes can remain after a track expires. Personal ADS-B flight history does not follow that 30-day capture limit. Setup and password reset links expire after 15 minutes, invitations after seven days, sign-in sessions after 30 days, and hosted demo workspaces after seven days.
You can sign out, reset your password, or connect Google from account settings. A school administrator can disconnect Google Calendar at any time; this stops syncing but does not erase lessons already imported. To ask about access, correction, or removal of account or school data, contact us. If your school supplied your roster information, its staff can also correct your record or invitation.
05 / QUESTIONS
Contact
For privacy questions or requests, email hello@flightslog.com. We may update this page as Flightslog changes and will revise the effective date when we do.