Privacy Policy — MyLogbook

This policy describes how MyLogbook ("we", operated by SynthaSkill LLC) collects, uses, and protects information when you use the Service.

1. What we collect

Account info: name, email, hashed password, profile photo if provided.
Aircraft + maintenance records: registration, model, hours, deferrals, work orders, work items, sign-off signatures, logbook entries, attached documents (PDFs, photos).
FAA airmen reference data: when you sign an entry, we look up your certificate number against the public FAA Airmen registry for display purposes only.
Usage telemetry: page loads, errors (via Sentry), feature usage. No third-party advertising trackers.
Payment info: handled by Stripe; we receive a Stripe customer/subscription ID, never your card number.

2. Why we collect it

To provide the Service you signed up for.
To maintain tamper-evident maintenance records as required by FAR 43.9 and 91.417.
To bill you for paid plans.
To diagnose errors and improve the Service.
To respond to your support requests.

3. Blockchain anchoring

Signed logbook entries are hashed (SHA-256) and the hash is periodically anchored on the Ethereum Sepolia testnet for tamper-evidence. Only the hash is published — your actual record content is never written to the blockchain. The on-chain hash cannot be reversed to reveal record contents.

4. Where data lives

Production data is hosted in the European Union (Hetzner FSN1-DC11, Helsinki, Finland) on encrypted disks. Backups are encrypted with age (X25519) and replicated to a Hetzner Storage Box in the same region. We never sell or rent your data.

5. Sharing

We share data only with:

Stripe (payment processing — PCI-compliant)
Sentry (error tracking — error metadata only)
Better Auth (session management — open source, self-hosted)
Resend (transactional email — opt-in only)
Law enforcement when compelled by valid legal process.

We never sell data to advertisers or data brokers.

6. Your rights (GDPR / CCPA)

Access: Export your data from Settings → Export.
Correction: Edit any draft record directly in the app. Signed maintenance records cannot be edited (FAR 43.9 append-only) — instead, sign a corrective entry referencing the original.
Deletion: Settings → Delete account triggers a 30-day grace period, then hard purge. Some records may be retained where required by law (e.g. FAA airmen audit trail).
Portability: PDF + JSON exports.
Object / Restrict: Email [email protected].

7. Cookies

We use only essential cookies for authentication (Better Auth session) and an opt-in analytics cookie if you accept it on the banner. See our Cookie Policy for the full list.

8. Children

MyLogbook is not directed at users under 18. We do not knowingly collect data from minors.

9. Security

Passwords are hashed via Better Auth's default algorithm (scrypt at time of writing). Sessions use HttpOnly + Secure + SameSite=Lax cookies. We enable TLS 1.3 on all endpoints with HSTS.

10. Changes

Material changes will be announced via in-app notification and email at least 30 days before they take effect.

11. Contact

Data Protection Officer: [email protected].

1. What we collect

Account info: name, email, hashed password, profile photo if provided.

Aircraft + maintenance records: registration, model, hours, deferrals, work orders, work items, sign-off signatures, logbook entries, attached documents (PDFs, photos).

FAA airmen reference data: when you sign an entry, we look up your certificate number against the public FAA Airmen registry for display purposes only.

Usage telemetry: page loads, errors (via Sentry), feature usage. No third-party advertising trackers.

Payment info: handled by Stripe; we receive a Stripe customer/subscription ID, never your card number.

5. Sharing

We share data only with:

Stripe (payment processing — PCI-compliant)

Sentry (error tracking — error metadata only)

Better Auth (session management — open source, self-hosted)

Resend (transactional email — opt-in only)

Law enforcement when compelled by valid legal process.

We never sell data to advertisers or data brokers.

6. Your rights (GDPR / CCPA)

Access: Export your data from Settings → Export.

Correction: Edit any draft record directly in the app. Signed maintenance records cannot be edited (FAR 43.9 append-only) — instead, sign a corrective entry referencing the original.

Deletion: Settings → Delete account triggers a 30-day grace period, then hard purge. Some records may be retained where required by law (e.g. FAA airmen audit trail).

Portability: PDF + JSON exports.

Object / Restrict: Email [email protected].