Privacy Policy

1. What we collect

• Account info: name, email, hashed password, profile photo if provided.
• Aircraft + maintenance records: registration, model, hours, deferrals, work orders, work items, sign-off signatures, logbook entries, attached documents (PDFs, photos).
• FAA certificate number: the airman certificate number you register in Settings is stored with your account and shown on entries you sign. During logbook import we may match certificate numbers in your paper logs against the public FAA Airmen registry.
• Usage telemetry: page loads, errors (via Sentry, not currently enabled), feature usage. No third-party advertising trackers.
• Payment info: handled by Stripe; we receive a Stripe customer/subscription ID, never your card number.

2. Why we collect it

• To provide the Service you signed up for.
• To maintain tamper-evident maintenance records as required by FAR 43.9 and 91.417.
• To bill you for paid plans.
• To diagnose errors and improve the Service.
• To respond to your support requests.

3. Blockchain anchoring

Signed entries are hashed (SHA-256). When anchoring is active,only the hash is published to the Ethereum L2 (Base) mainnet— never your record content. The on-chain hash cannot be reversed to reveal record contents.

4. Where data lives

Our application servers and primary database are hosted in the European Union on a server operated by netcup GmbH, and our websites are served through Cloudflare. Transactional email is sent through our own mail relay on that server. Uploaded files are stored with Cloudflare R2, and we use Cloudflare for content delivery, so some data may be processed outside the EU. Backups are encrypted with age (X25519) and kept on the production server. An offsite backup copy is not yet in place. We never sell or rent your data.

5. Sharing

We share data only with:

• Stripe (payment processing)
• Sentry (error tracking, not currently enabled; if enabled, only after you accept cookies)
• Better Auth (session management — open source, self-hosted)
• Cloudflare (content delivery and R2 file storage)
• Law enforcement when compelled by valid legal process.

We never sell data to advertisers or data brokers.

6. Your data rights

• Access: Export your data from Settings → Data.
• Correction: Edit any draft record directly in the app. Signed maintenance records cannot be edited (FAR 43.9 append-only) — instead, sign a corrective entry referencing the original.
• Deletion: Settings → Delete account anonymizes your name and email, ends your sessions, and removes your aircraft and records from view. We do not run a scheduled purge of stored records. Some records may be retained where required by law (for example signature and audit records under FAR 43.9 and 91.417). Email privacy [at] myaviationtools.com to request erasure of other data.
• Portability: ZIP export of your data (JSON + CSV).
• Object / Restrict: Email privacy [at] myaviationtools.com.

7. Cookies

We use only essential cookies for authentication (Better Auth session). Optional error tracking (Sentry) is not currently enabled; if we turn it on, it will load only after you accept it on the banner. See our Cookie Policy for the full list.

8. Children

MyLogbook is not directed at users under 18. We do not knowingly collect data from minors.

9. Security

Passwords are hashed via Better Auth's default algorithm (scrypt at time of writing). Sessions use HttpOnly + Secure + SameSite=Lax cookies. All endpoints are served over HTTPS with HSTS.

10. Changes

Material changes will be announced via in-app notification and email at least 30 days before they take effect.

11. Governing law

This Privacy Policy is governed by the laws of the State of Texas, without regard to its conflict-of-laws provisions. Any dispute will be resolved exclusively in the state or federal courts located in Texas.

12. Contact

Privacy contact: privacy [at] myaviationtools.com. We reply by email, usually within a few days.