Privacy Policy SkyWindow

§ 1. Who is responsible for your data

1. The company responsible for your data (its controller) is BinSoft Sp. z o.o., with its registered office in Szczytno, ul. Władysława IV 35, 12-100 Szczytno, NIP: 7451846889, REGON: 364251875, KRS: 0000618367. This is the company that publishes SkyWindow: in the App Store it publishes the app from the company account with the team name BinSoft.
2. We have not appointed a separate data protection officer. For matters concerning your data, write to [email protected] or by post to the company address, marked "Personal data".
3. For matters concerning the app itself, also write to [email protected]. The address [email protected] leads to the same mailbox. You can write in English or in Polish. This is our point of contact for users, required by the EU law on digital services (Article 12 of Regulation 2022/2065).

§ 3. What stays on the phone and what goes to the server

The app saves the block data when our server refuses to sign you in or to extend your sign-in because the account is blocked. With it, the app shows you the information about the block even after a restart and without internet (§ 7(4) of the Terms of Service). It keeps the data in the phone's protected storage, next to the sign-in keys. The reason is one of a few fixed reasons, without any description from our team. The app deletes this data when our server lets you sign in on this phone again: after the block is lifted or when you sign in to a different account. The app learns that the block has been lifted only at your next sign-in, so until then the data stays on the phone. Deleting the app may not delete it: this storage is run by the iOS system, not by the app. If it stays, the app will show the block again after you reinstall it.

If you write to us by e-mail, by post or through the form on the skywindow.ai website, we will have the address you write from and the content of your message (§ 4.11). We describe a "Write to us" message from the app in § 4.7.

§ 4. What data we process, why and on what basis

For each group of data we say why we have it and what allows us to have it. The law provides several grounds for using personal data (Article 6(1) GDPR). For us it is most often the contract with you, which simply means the app you use doing its job.

4.1. Account and sign-in

What: an account number that we assign ourselves; the technical number Apple uses to mark your account for our app only; a credential from Apple (encrypted; we use it only to finally disconnect SkyWindow from your Apple account); language and unit settings; session keys that keep your phone signed in (in the database we keep only their fingerprints, from which the key cannot be recovered). We do not store your e-mail address or first name. We do not ask for your name, so Apple does not pass it to us. At your first sign-in, Apple asks whether to show us your e-mail address or to hide it. If you choose "Hide My Email", Apple gives us a random substitute address that forwards messages to your inbox. The address, real or substitute, arrives in the sign-in confirmation from Apple. Our server skips it: it does not store it in the database or in the logs and does not use it for anything. The app does not keep it either.

Why: so that you can sign in and recover your data on another device.

Basis: the contract with you, that is, the service doing its job (Article 6(1)(b) GDPR).

4.2. Trips, boarding passes and places

What: flight number and date, airports, seat, class, boarding group, saved places and routes, and the "high fives" you give to places. From the boarding pass we take only the flight details: the route, flight number, day, class and seat. The barcode, the passenger name and the booking reference from the pass stay on your phone and do not go to the server. Next to the flight details lies a separate fingerprint of the pass, which serves only to recognise that the same pass was added a second time; the pass cannot be recovered from the fingerprint.

Why: to show your flight, route and map, and to prepare the trip for working without internet.

Basis: the contract with you (Article 6(1)(b) GDPR).

4.3. Notifications

What: the address for delivering notifications assigned by Apple (encrypted), the app installation number, the system and app version, whether you agreed to notifications and location, the history of delivery attempts.

Why: to send you information about a change to your flight and about what is happening with your report or message, including the decision on a chat report.

Basis: for notifications about your flight - the contract with you, because they concern your flight (Article 6(1)(b) GDPR). A notification about a reply to your report or message has the same basis as handling that report or message (§ 4.7). We send the notification about the decision on your chat report because EU law requires us to inform you of such a decision without undue delay (Article 6(1)(c) GDPR in connection with Article 16(5) of Regulation 2022/2065). We send the notification about the outcome of your appeal because handling your appeal is our obligation under the Terms of Service (Article 6(1)(b) GDPR; § 7(5) of the Terms of Service). You agree to the notifications themselves in iOS and you can withdraw that consent there (phone Settings).

4.4. SkyWindow Plus subscription

What: the transaction number assigned by Apple, the name of the purchased product, the purchase and expiry dates, whether the purchase is real or a test one, information about a family subscription, the fingerprint of Apple's purchase confirmation (it lets us check that the confirmation is genuine). The app also attaches the number of your SkyWindow account to the purchase. Apple returns it to us in the purchase confirmation, which lets us assign the subscription to the right account.

Why: to unlock the paid features and to settle accounts with Apple.

Basis: the contract with you (Article 6(1)(b) GDPR) and tax and accounting obligations to the extent they apply to us (Article 6(1)(c) GDPR). We do not see your card number or any other payment details. Payment is handled by Apple.

4.5. Cabin chat

Described separately in § 6.

4.6. Safety reports and moderation

What: the type of report, its urgency, your account, the app installation number and the trip you report from, the fingerprint of the reported participant (from the fingerprint alone nobody can work out who it is), the account number of the person named in the report, if the server manages to identify it (below), encrypted evidence material, the decision, the reason code and your appeal (also encrypted). When we block an account, we also record since when and for what reason it is blocked.

Why: to keep the cabin chat safe and to make it possible to appeal against a decision.

Basis: our legitimate interest and the interest of other passengers, that is, protection against harassment, spam and unlawful content (Article 6(1)(f) GDPR), and the obligations that the EU law on digital services places on us: accepting reports, making decisions and giving reasons for them (Article 6(1)(c) GDPR in connection with Articles 16-18 of Regulation 2022/2065). We do not ask for specially protected data, for example about health, religion, opinions or intimate life, and we do not want it. It may still reach us if it is in the reported message, in a reported nickname or group name, in your description or in the text of your appeal. In that case only the members of our team who handle reports can see it. The beginning of the reported message also passes through Apple's notification system (below in this point). We use it only to assess that report and any appeal against the decision. We record the decision as a choice from a list of reasons, without copying the content. We normally delete it together with the rest of the evidence 90 days after receiving it. If we retain the evidence because of a dispute or a request from an authority, we keep it longer. Each hold lasts no more than 365 days from when it is imposed. If the reason still exists, we may impose another hold after the previous one expires, so the total period may be longer (§ 7). We do this because EU law requires us to accept and carefully handle reports of illegal content, and protecting passengers from harassment and threats is in the substantial public interest (Article 9(2)(g) GDPR in connection with Articles 16-18 of Regulation 2022/2065). If a dispute arises, we also use it to establish, exercise or defend legal claims (Article 9(2)(f) GDPR).

Reports are handled by the members of our team whom we have entrusted with this, in the support panel in the SkyWindow app. Only our server decrypts the evidence material. It shows it only to such a person, and only when they deliberately open the case. The exception is the beginning of the reported message in the notification for the team (below in this point). We record every opening and every decision in the log (§ 13(7)). The person handling the report sees the type of report, the attached messages with their authors' nicknames and the time they were sent (including yours, if they are in the material) and your description. For a report of just a nickname or a group name (§ 6(12) and (13)), they see that nickname or that name. They do not see your account or your trip. If you appeal against a decision, the person handling the appeal sees the same, plus that decision and the text of your appeal (from 20 to 1000 characters). They do not see your account or your trip either. The app does not save this material on their phone: it is only on the screen and disappears when the case is closed or the person leaves that screen.

When a report reaches us, our server checks once whether the person named in the report is on the passenger list of that flight. If they are, we record that person's account number with the report. We do this so that we can block the account of a person who breaks the rules (§ 6(6) and (10) of the Terms of Service). Conversations do not pass through our server, and the person named in the report is given by the phone of the person who reports. So the server does not confirm that the named person wrote the reported message, and that is why a person decides about a block after reading the evidence material. For a report of just a nickname or a group name, the server also checks whether the named person appears under exactly that nickname on the passenger list of your flight (§ 6(14)). The person handling the report sees only the result: a nickname confirmed by the list, or one given only by the person reporting. The server does not confirm the group name or who created the group, because it does not know groups (§ 6(8)). Neither the person who reports nor the person who handles the report sees the account number. The latter sees only whether the account could be identified. After a block, however, the account number is visible in the support panel (§ 13(7)). The account number disappears together with the report (§ 7), and earlier if that person deletes their account. The legal basis is the same as for the whole report (above in this point).

When someone reports a message from a chat, the members of our team who handle reports receive a notification on their phone if they have "Flight updates" turned on in the app. It contains the heading "New chat report" or "Urgent chat report" and the beginning of the reported message, up to 100 characters. It is the beginning of the last message in the report signed with the nickname of the reported person. For a report of just a nickname or a group name, the notification has only the heading and the sentence "Tap to open chat reports.", without any content of the report. We do not add the nickname, the flight or the account details of the person who reports. The excerpt may, however, contain anything someone wrote in that message, including things about other people and specially protected data. We send it so that the team can see at once how urgent the case is and can respond within 24 hours (§ 6(6) of the Terms of Service). The notification is delivered by Apple's notification system, so this excerpt passes through Apple's servers in the United States (§ 8 and § 9). On the team member's phone such a notification stays among the other notifications until that person removes it or opens a chat report for review in the app on that phone. The app then removes all such notifications from that phone by itself, including those about other reports. It does not remove them from that person's other phones or from the phones of other team members. On our server the excerpt waits, encrypted, only until the sending service picks it up for sending. Then we remove it from the server. The legal basis is the same as for the whole report (above in this point). The person who reported the message receives a notification about the decision and about the outcome of the appeal, without any content of the case, if they have "Flight updates" turned on in the app.

4.7. Bug reports and messages from the app

What: your description (from 10 to 2000 characters); one picture (up to 2 MB): a screenshot that the form attaches by itself when you report a problem from a screen of the app, or any photo you choose from your phone's photo library; the messages in the report's thread, that is, our replies and what you write back to us. Every report includes the app version, build number, system version and device model. The switch lets you turn off additional technical details: the phone's language and region, your plan, demo mode, the screen, connection type, flight number and status, number of downloaded packages, enabled features and a record of app activity.

Note: a screenshot or a photo may contain your data - a boarding pass, your name, your route, a map with the aircraft's position and the flight track. A screenshot shows everything that was on the screen. Before sending, you can change it or remove it, and you turn off the additional technical details with a switch in the form.

A "Write to us" message (Settings → Help): the topic you choose (question, idea, my data, partnership or something else) and the content (from 10 to 2000 characters), plus the app version, build number, system version and device model. We do not attach any additional technical details or pictures to it. We reply in the message's thread in the app, so you do not give us an e-mail address. A person from our team reads the message in the support panel in the SkyWindow app. They see your account number next to it, so that the reply reaches you. About a new message we receive a short e-mail to our mailbox, without its content and without the details of your account.

Why: to fix the bug, to reply to your report or message and to deal with your matter.

Basis: handling your report, that is, the contract with you (Article 6(1)(b) GDPR), and our legitimate interest in improving the app (Article 6(1)(f) GDPR). For a message: for requests concerning your data - an obligation that the law places on us (Article 6(1)(c) GDPR); in other matters - our legitimate interest, that is, replying to your message (Article 6(1)(f) GDPR).

4.8. Community and user contributions

What: proposals of places and facts: title, description, source and the location of the described place.

Why: to expand the catalogue of facts in the app.

Basis: your consent (Article 6(1)(a) GDPR). You give it by knowingly sending a proposal. You can withdraw your consent at any time. We then do not use your contribution in new editions of the catalogue. A contribution that has already entered published editions of the catalogue stays in them on the basis of the licence in § 10 of the Terms of Service.

4.9. Service security

What: request counters (so that nobody floods the server), markers that protect against the same command being carried out twice (for example a double save), the log of operations on personal data, the register of administrator actions. In addition, the log of the server that accepts connections: the IP address, the time of the connection, the page or app function opened together with its parameters (for example the flight number and day searched for) and the name and version of the browser or of the app and the system. We delete this log automatically after 7 days.

Why: to block abuse, to protect the server against attacks, to fix failures and to be able to show that your requests concerning your data were carried out.

Basis: our legitimate interest in the security of the service (Article 6(1)(f) GDPR) and the obligation to show that we comply with the data rules (Article 6(1)(c) in connection with Article 5(2) GDPR).

4.10. Fixing failures with the help of an AI assistant

What: fragments of server logs and of data from the database that we read when we look for the cause of an error, for example an account number, an IP address, flight details or the description of a bug report.

Why: to find and remove the cause of a failure. The AI assistant Claude from the company Anthropic helps us with this, so what we read in the process also reaches that company (§ 8 and § 9). Records of the conversations with the assistant also stay on our team's computer. We delete them automatically, after 90 days at the latest.

Basis: our legitimate interest, that is, a working and secure service (Article 6(1)(f) GDPR). You can object to this (§ 10(6)).

4.11. Correspondence with us

What: the address you write from (e-mail or postal), your first name and surname if you give them, the content of your message and our replies, and in a matter of a blocked account also the account number. From the form on the skywindow.ai website we receive your first name, if you give it, your e-mail address, the topic and the content of the message. The mail server also records in its log the address of the sender and of the recipient, the time and the IP address of the server the message came from.

The form on the website: our server immediately forwards the message as an e-mail to our mailbox. The service handling the form does not save its data in the database or in its own logs. We keep the message in our mailbox like any other e-mail to us (§ 7). Before the form sends the message, the company Cloudflare checks that a human is writing (§ 14).

"Write to us" messages from the app do not go to our mailbox - we receive only a short e-mail that they are waiting. We describe them in § 4.7.

Why: to reply to you and to deal with your matter, for example a request concerning your data or an appeal against an account block.

Basis: for requests concerning your data - an obligation that the law places on us (Article 6(1)(c) GDPR); in other matters - our legitimate interest, that is, replying to your message (Article 6(1)(f) GDPR). How long we keep the correspondence is described in § 7.

4.12. Planes on your route - approaches with the flights of other people using SkyWindow

This feature shows a fact: your route may come close to a plane on a flight that someone using SkyWindow has planned. We calculate this from the routes and times of flights (scheduled, estimated or actual), not from the position of phones. We do not use your position at all (§ 5).

Why: to show you such a fact during the flight, and to show other people a fact about your flight, if you agree to it.

When you show your flight. For a specific flight you can turn on "Show others I have this flight". We then save that consent: which flight it is (carrier, number, day and airports), when you turned it on and which version of this description you saw. We also save the confirmation of turning it on (the same data) as a marker that protects against the same command being carried out twice - for 30 days, after which the cleanup automation deletes it within a day (§ 7). This marker does not disappear when you turn the consent off, but we do not show it to anyone else and do not use it to calculate approaches. Your flight will be seen by people using SkyWindow who check approaches for their flight (from 3 days before its departure until it lands), if according to the routes and times of the flights their plane may come within 150 km of yours, within 45 minutes of each other. They will see the number of that flight, its airports, its departure and arrival times (scheduled, estimated or actual), its route and the information that someone using SkyWindow has this flight planned. They will not see your nickname, your account number, your seat or how many such people have this flight. This information also does not confirm that you are on board.

Basis: your consent (Article 6(1)(a) GDPR). It applies to one flight and is off by default. It ends by itself 6 hours after that flight lands according to the latest times we know, and earlier - when you change its carrier, number, day or airports, or delete the trip or the account.

Turning it off. You turn the consent off with the same switch. Once our server receives the withdrawal, new checks no longer use your consent. If the phone is without internet, the app shows "I'll turn it off when there's internet" and sends the change when it runs with internet on this account. People who checked approaches earlier may still see your flight on their phones until the deadlines described below - while their phones are without internet, we have no way to change that. The same flight may also remain visible because another person who has it has consented.

An honest note. We do not show who has this flight. However, someone who knows that you use SkyWindow and guesses which plane you are on can save a flight near your route and see that someone using SkyWindow has your flight planned. That is why you turn the consent on for each flight separately - turn it on only for flights where this does not bother you. The Terms of Service forbid using this feature to work out which flight a particular person is taking (§ 5(2)(f) of the Terms of Service).

When you check approaches yourself. You do not have to show your flight to others to check approaches. The app checks them by itself after it downloads the flight data for working without internet and again before the flight (in the last day or when the departure time moves); you can also check them with a button. It sends our server only which of your flights it is checking. The server calculates the answer from the flight data it already has and saves nothing from it. To enforce the limit (20 checks and 6 different flights within 24 hours for one account), it saves only when your account checked and a short code representing the flight - without the route and without the answer. It deletes records older than 24 hours at the next check by that account or during the automatic cleanup, at the latest within the following day. We provide these checks under our contract with you (Article 6(1)(b) GDPR). The phone shows the information about each flight found until the earlier of two deadlines: 6 hours after that other flight lands or 6 hours after your flight lands. It deletes the whole answer at the first start of the app after 6 hours have passed since your flight landed. It calculates the deadlines from the arrival times in the downloaded data. The phone also saves the state of the checks (when and with what result it checked) and withdrawals of consent not yet sent. It deletes state it no longer needs while the app runs on that account, 7 days after the last attempt; it keeps a withdrawal not yet sent until it is sent.

§ 5. Location - details

1. The app asks only for the "While Using the App" permission. It does not ask for the "Always" permission. It does not start measuring when you enter a marked area. Measuring with the screen off works under that same permission and only after you turn it on yourself: on the iPhone with the "I’m on board" button, on the Apple Watch with the "Help get a signal" feature.
2. We ask for consent only after your deliberate action: on the flight dashboard or after you start help on the Apple Watch. We do not ask at app start-up.
3. Without the "I’m on board" mode, the iPhone measures your position only while the flight dashboard is visible. After you tap "I’m on board", it keeps measuring with the screen off and outside the map, and the system then shows the blue location indicator. Measuring in the background ends when you switch it off yourself, 12 minutes after a detected landing, or at the latest 6 hours after the scheduled arrival. When you open the app again, the mode comes back by itself until that deadline passes. Help on the Apple Watch, if you turn it on, can keep working after the screen goes dark or after you return to the watch face, until you stop it. It switches itself off after 18 hours at the latest. While help is running, the watch shows the system location icon.
4. Your precise position stays on your paired devices. The phone saves the flight track (position, altitude, speed, heading, time) in its database, with that flight. After landing it thins the track down to 600 points. The track disappears together with the flight when you delete it from your list or uninstall the app. The database is encrypted while the phone is locked. The track does not go into your iPhone backup and will not move to a new phone. When you sign in on a new device, your flights come back, because those are also stored in your account with us. The GPS tracks will not come back - we do not have the measurement data needed to recreate them. The watch passes the position only to your iPhone, over the system connection between the watch and the phone. We do not write the position to logs, and we do not send it to our server or to any other company. An exception is a picture or screenshot that you choose to send with a bug report - it may show your position or flight track (§ 4.7). When the flight dashboard shows the Apple map, however, Apple sees the map area around the aircraft (point 9).
5. If you refuse consent or GPS does not work, the app still shows the map. If the signal is lost during the flight, the app may calculate the position from the last reliable measurements. If there are no such measurements or no permission to use your location, it calculates the position from the flight schedule. In both cases it clearly marks the position as estimated.
6. In the version from the store we do not send your position beyond your iPhone, including to any air traffic information provider. That possibility is switched off in the code and could not work anyway, because the app does not send the position to our server. If we ever switched it on, the provider would receive the position rounded to three decimal places, which means an accuracy of about 110 metres, with nothing marking that it is about you. First we would write here who that provider is.
7. Basis for location: your consent, which you give in the iOS or watchOS system dialog (Article 6(1)(a) GDPR). You can withdraw it at any time in the system Settings. Withdrawal does not work backwards: what we did earlier with your consent remains lawful. The law also governs access to information stored on your device (Article 399 of the Polish Electronic Communications Law, Journal of Laws 2024, item 1221).
8. The phone (on the flight dashboard and in the "I’m on board" mode) and the watch (during help) also read the air pressure from the barometer, to recognise whether the aircraft is climbing, cruising or descending. iOS asks for this separately, as access to motion sensors. The reading stays on your devices. The watch passes it only to the iPhone. The phone saves the pressure record in its database, with that flight, so it can show you the flight again after landing. It is treated the same way as the flight track (point 4): it disappears together with the flight, it does not go into your iPhone backup, and it never reaches our server or any other company. Neither the phone nor the watch uses the Health app, starts a workout, asks for access to health data or reads health or fitness data.
9. The Apple map. When there is no map on the phone for your route, the flight dashboard shows the Apple map from the internet. You also see the Apple map in a place's details and when you point to a place in a proposal for the catalogue. Apple then receives your IP address and the map area you are looking at, which on the flight dashboard is the area around the aircraft (§ 8 and § 9). We do not pass any data of your SkyWindow account to Apple in the process.

An honest note about the current state: the server database contains a place for position samples that was prepared in advance but is unused. The app from the store never uses it, and the table is empty. Points 1-9 therefore describe the truth about the version on your phone: the flight track stays on your iPhone, and your precise position does not leave your paired devices. If we ever wanted to change that, we would first correct this section and ask you in the app for separate consent.

§ 6. Cabin chat - details

1. The cabin chat connects passengers on the same flight. It works over the network on board (Wi-Fi or Bluetooth). The internet relay is turned off in this version (point 3). A group conversation works only over the network on board (point 8).
2. A private conversation goes straight between two phones. In this version of the app, the phone sends a message over the network on board, through an encrypted connection between your phone and the other person's phone. The keys of this connection are created on both phones, and our server receives neither the message nor the keys. The phone does not, however, check that the other end of the connection is really the person with that nickname. So we do not rule out that someone within range of your phone impersonates the other person and receives a message meant for them. That is why we do not say that a private conversation can be read only by its participants. Impersonation is prohibited (§ 5(2)(d) of the Terms of Service). The exact name of the method used is given in the glossary at the end.
3. In this version of the app the internet relay is turned off. The app does not let you turn it on, so you send nothing through it. Before we launch it, we will first update this point and points 1, 4 and 6. Once it runs, the relay will see: the encrypted package, its size, the time it was sent, the markers of the flight, room and thread, the fingerprints of the participants and the IP address of the connection. It will not see the content, the nickname or the attachment. A fingerprint replaces the participant's marker in the conversation, but it does not make you anonymous: the relay stores it together with the number of your account, device and trip, because it has to know to whom to deliver the package. Such data are still your personal data (Recital 26 GDPR). Encryption does not hide this data about the package, and we say so plainly.
4. You reach the relay only after turning it on separately on both devices. The consent has a time limit set in advance, at most 24 hours, and you can withdraw it.
5. Legal bases:
   • transmitting and delivering messages - the contract with you (Article 6(1)(b) GDPR);
   • the group conversation and the conversation partner's profile - the contract with you (Article 6(1)(b) GDPR); you enter a group only yourself, with the "Join" button;
   • using the relay on the internet - your separate consent, which you turn on in the app (Article 6(1)(a) GDPR);
   • the flight's passenger list, that is, your nickname and your phone's identifiers in conversations (point 14) - the contract with you (Article 6(1)(b) GDPR);
   • the visibility of your nickname nearby over Bluetooth (point 15) - your consent; you turn it on and off yourself (Article 6(1)(a) GDPR);
   • the safety of the conversation, blocking and reports - our legitimate interest (Article 6(1)(f) GDPR, see § 4.6).
6. We do not store readable message content. Once the relay runs (point 3), it will keep the encrypted package and the delivery data for at most 24 hours. The part of the database the relay uses does not even have a place for the content or the nickname. It does record which account, device and trip you turned the relay on from - without that it cannot deliver the package. That is how we designed the database; it is not an accident.
7. We do not collect conversation quality statistics today. That module is switched off. If we ever start it, we will first correct this point. The module is designed to collect only a list of events fixed in advance, with no content (for example "connection successful"), to record the delivery time as a range, and to show a result only once at least 20 observations have been collected in a given hour. Smaller groups it deletes. No user marker goes there.
8. Group conversation. A group is created for 3 to 8 people on the same flight, counting the person who creates it. A group works only over the network on board, without our relay and without our server. The phone sends each message separately to each person in the group, over an encrypted connection between two phones. You enter a group only yourself, with the "Join" button in the invitation. The invitation shows the group name and the nicknames of the people who are in the group or have also been invited. The people in the group see its name and its members: the nicknames and who joins, who does not accept the invitation, who leaves and who is removed. Our server does not receive the group name, its members or its messages. The exception is what you attach to a report yourself: a message, a nickname or a group name (point 12, § 4.6).
9. What stays on the phone from a group, and for how long. The phone saves the group name and its members in an encrypted file that does not go into your iPhone backup. The phone keeps them until the cabin chat of that flight ends, that is, at the latest until 24 hours after the scheduled arrival. The phone saves the content of group messages in that file only if you have "Chat history on this phone" turned on (it is off by default), and for at most 24 hours from receiving the message. Without that history, the messages are only in the app's memory and disappear when the cabin chat closes. Entries past their deadline are deleted from the file by the phone at the latest the next time the cabin chat starts. The only exception is what you report to us yourself: a report can wait on the phone longer (point 12). The "Clear chats from this phone" button (§ 11(5)) also deletes groups.
10. What stays on the phone from private conversations and the flight room. The phone saves messages only if you have "Chat history on this phone" turned on (it is off by default), and for at most 24 hours from saving them. The phone remembers that you blocked someone for 7 days, also without that history, because a participant marker works only on one flight anyway. A message that you hide ("Hide message"), delete for yourself ("Delete for me") or report disappears from your screen, and the phone deletes it from its history, also in a group. A copy attached to a report waits to be sent like the whole report (point 12). So that the message does not come back, the phone saves its number, your account number, the date it was hidden and the date this entry expires. The entry has no content and no author's nickname and expires after 7 days; "Clear chats from this phone" deletes it earlier. You do not delete the message from the phones of people who have already received it. The phone keeps history, blocks and the entries about hidden messages in an encrypted file and does not send them to our server. Entries past their deadline are deleted from that file by the phone at the latest the next time the cabin chat starts. The phone shows the flight's passenger list downloaded from the server (nicknames) for at most 48 hours from download, so it works without internet. After that it no longer shows the list, but the file with it may stay on the phone after the flight too. It is deleted by the "Clear chats from this phone" button (§ 11(5)), by signing out and by switching accounts. The phone does not show an entry whose deadline has passed (point 14) at all, also without internet.
11. Leaving, removal and blocking in a group. You can leave a group at any time. Your phone then immediately stops accepting its messages. When the person who created the group removes you from it, new messages stop reaching you as soon as the phones in the group learn about that change. The messages you already have stay on your phone for at most 24 hours, also after you leave the group or are removed from it. The messages that others have already received stay on their phones on the same terms, because a sent message cannot be taken back. On the other people's phones your nickname stays in the group's members with a note that you are leaving or that you are being removed. Blocking a person works only on your phone: it stops sending group messages to that person and accepting them from that person, and the rest of the group still sees that person. One exception: when you block the person who created the group, your phone leaves that group at once, just as if you chose "Leave group". The other people will see that you are leaving. The person you block will not get this information from your phone.
12. Reporting from a group. When you report a message from a group to us, from the conversation you send only that one message, with its author's nickname and the time it was sent, and your description, if you add one. When you report an invitation, you send the group name and the nickname of the person who is inviting. You can also report a group name from a group you belong to that someone else created. You then send the group name and the nickname of the person who, according to your phone, created it. Our server does not know groups, so it confirms neither the name nor who created the group (§ 4.6). We do not attach other messages or the group's members. The phone first saves the report in an encrypted file that does not go into your iPhone backup, and deletes it as soon as it reaches us. Without internet, for example on a plane, the report waits on the phone and the app sends it later. If it cannot be sent within 30 days, the phone deletes it and stops trying. So a reported message or group name can stay on your phone for longer than 24 hours. Once the report reaches us, we treat it like any other (§ 4.6).
13. The conversation partner's profile shows only what the app already knows. From the cabin chat: that person's nickname, whether they are in range now, whether you are talking privately and the names of the groups you have both joined. From the list of passengers on that flight, when there is internet: what that person has shown on it themselves. The profile does not collect any new data about anyone. Blocking and muting turned on in the profile work only on your phone, and muting lasts until the cabin chat closes. If that person created a group you are in, blocking also takes you out of that group (point 11). You can also report that person from the profile in two ways. When you report their message, you attach one message from that person, which the app shows you before you send it, with their nickname and the time it was sent. When you report just the profile ("Report profile"), you attach their nickname, without a message - for example when the nickname itself is offensive. In both cases you also attach your description, if you add one. The phone saves such a report and sends it to us in the same way as a report from a group (point 12).
14. The flight's passenger list. When you open the Chats tab for your flight and the phone has internet, the app saves your phone's identifier in conversations with your account. If you have a nickname set, it also adds you to the passenger list of that flight. Passengers on that flight who have also opened Chats will see your nickname, and their apps will receive your phone's identifiers in conversations. These are strings of characters that are not a phone number or a device name. One of them stays the same on later flights, so the same phone can be recognised by it. The entry is visible for at most 48 hours from your last visit to Chats and for no longer than a day after the scheduled arrival. Within the following day we delete it from the server. We delete it earlier if you delete that flight or your account, or if we block your account after a chat report. The phone identifier saved with your account stays until the account is deleted (§ 7).
15. Nearby visibility (Bluetooth). This feature is off by default. When you turn it on (Settings → You in conversations), your phone shows your nickname over Bluetooth to passengers on the same flight who are close by and have SkyWindow. They can then invite you to a conversation, also while the app is running in the background. Visibility works from 2 hours before departure until 30 minutes after arrival. None of this passes through our server. The same switch turns visibility off and withdraws your consent (point 5).

No conversation in this version of the app - private, group or the public room of the flight - has "participants only" encryption. All of them are protected in transit by the encrypted connection between phones, and our server neither receives nor stores them. The phone does not, however, check that the other end of such a connection is really the person with that nickname. So we do not rule out that someone within range of your phone impersonates someone else's nickname. The cabin chat is a side feature of a travel app, not a separate platform for publishing content. We fulfil the reporting and moderation obligations of the EU law on digital services regardless of that (Articles 16-18 of Regulation 2022/2065; § 4.6 of this policy and § 7 of the Terms of Service).

§ 7. How long we keep data

We took the periods below directly from the code and the server settings, not from estimates. The exception is correspondence with us: we set its period ourselves and enforce it by hand. Where the period depends on your decision, we give the condition instead of a number. The third column says who enforces the deadline: the database itself (it does not accept older data), the cleanup automation on the server, the server code or we ourselves. The periods in the table apply to our database, our server's logs and our mailbox. Once a day we make a backup of the database, so deleted data may still sit in a backup for a while. It disappears from there on the schedule in § 11(4). We use backups only to restore the service after a failure (Article 5(1)(e) GDPR).

We delete the boarding pass record sooner than the rest of the trip, and on purpose: after landing it is no longer needed for anything. The trip itself stays on your flight list, just without the pass record. The next time the app on your phone connects to the server, it also deletes its own copy of the pass, together with the code, the name and the booking reference. This is required by the rule that data is not kept longer than necessary (Article 5(1)(e) GDPR).

The fragments of data that we read while fixing failures (§ 4.10) stay in the records of the conversations with the AI assistant on our team's computer. We delete those records automatically, after 90 days at the latest. How long the company Anthropic keeps these fragments is described in § 8.

After the account is deleted, all that remains is a receipt of execution (the request number and two dates), for no more than 30 days the encrypted credential from Apple needed to disconnect the account (§ 11(3)), entries in the administrator action log about what we did with your account, for example about blocking it (§ 13(7)), until the end of that log's period, fragments of data read earlier while fixing failures, until the end of their periods (§ 4.10 and § 8), entries in the log of the server that accepts connections, for at most 7 days (§ 4.9), correspondence with us, until the end of its period (§ 4.11), and safety cases that are still running, have an open appeal or are held back because of a dispute or an authority's request. We cut those cases off from any link to you, and they disappear on their original deadline. The data on your device and backups are described separately in § 11(3)-(4).

§ 8. Who we pass data to

What is not in this table, and why:

1. There is no outside cloud for files. Recordings, packages for working without internet, and screenshots and photos from reports sit in our own file storage, on the same rented server as the database. The storage is not reachable from the internet; files leave only through our service. Apart from the server provider, whom we describe below, nobody else stores them.
2. There are no analytics, advertising or crash reporting companies. The app contains not a single such tool. The app connects only to our server and to Apple. Maps work from files on the phone. The exception is the Apple map, which the app downloads from the internet in some views (§ 5(9)).
3. Microsoft Azure Speech is written into our configuration as a backup provider for turning text into speech, but it is not switched on and not one recording was made there. Before we switch it on, we will state its service region here.
4. There is nobody we would ask about you. What goes to the flight data providers is a question about a flight and an aircraft, not about a passenger. If a source does not know your flight or does not give a time, a gate or a position, the app shows that the data is missing. We do not fill the gap with an invented value, nor with one copied from another flight.

We keep the server and the database on a single rented server. We rent it from cyber_Folks S.A., with its registered office in Poznań. The server stands in Poland. The server provider processes data on our behalf and on our instructions.

We do not sell data and we do not share it with data brokers or advertising networks. With every company that processes data on our behalf, including the server provider, we have the data processing agreement that the law requires (Article 28 GDPR).

Anthropic does not use the data it receives from us to train its artificial intelligence and usually deletes it from its servers after 30 days. It keeps the data longer when Anthropic's automatic safeguards judge our conversation with the assistant to be a breach of the rules for using the service (at most 2 years), when the law requires it, or when we ourselves send this company an error report together with a record of the conversation with the assistant (then up to 5 years). Cloudflare also uses some data about the traffic on the website on its own account to protect its network, for example an assessment of whether a given IP address is dangerous; Cloudflare's privacy policy describes this. Apple processes data at sign-in, purchases, notifications and maps on its own terms, described in Apple's privacy policy.

§ 9. Transfers of data outside the European Economic Area

1. Apple Inc. has its seat in the United States. Apple does not take part in the EU-U.S. Data Privacy Framework programme. According to Apple's privacy policy, this company transfers data collected in the European Economic Area outside it on the basis of standard contractual clauses. This is a model contract approved by the European Commission, in which a company outside the European Economic Area undertakes to protect data as EU law requires (Commission Implementing Decision (EU) 2021/914).
2. AeroDataBox / api.market, ElevenLabs, OpenSky Network, adsb.lol - we pass none of them any data about you. We send there only the flight, aircraft and area data described in § 8 and the text of a fact from our catalogue. These questions contain no passenger personal data, so we do not transfer personal data outside the European Economic Area, regardless of where these providers have their seats.
3. Microsoft Azure Speech - a backup provider, not switched on today; nothing goes to it. Before we start it, we will state its service region in this point. We will choose a region in the European Union.
4. The server, the database and the file storage stand in one place, with the provider named in § 8, that is, in Poland, inside the European Economic Area. Stored data does not leave that server. The exception is what points 1, 2 and 6 describe: the data sent to Apple (the address for delivering notifications, the notification content - for a report of a chat message also its beginning for our team - and, after the account is deleted, the credential from Apple), the questions about a flight and an aircraft, which contain no personal data, and the fragments of data read while fixing failures, which reach Anthropic. At your request, our server also passes the information described in § 4.12 to other people using SkyWindow, including outside the European Economic Area.
5. Cloudflare, Inc. has its seat in the United States and takes part in the EU-U.S. Data Privacy Framework programme. On 10 July 2023 the European Commission decided that companies in this programme ensure adequate protection of data (Commission Implementing Decision (EU) 2023/1795). If that decision ever ceased to be in force, we would base the transfer of data to Cloudflare on standard contractual clauses (point 1).
6. Anthropic: the data that reaches this company sits on its servers in the United States. Standard contractual clauses protect it there (point 1). The clauses are part of our data processing agreement with Anthropic, which this company publishes at anthropic.com/legal/data-processing-addendum. We will also send you a copy on request (§ 16).

§ 10. Your rights

You have the right:

1. to find out what data we hold about you and to receive a copy of it (Article 15 GDPR);
2. to correct data that is wrong (Article 16 GDPR);
3. to delete data, that is, to be forgotten (Article 17 GDPR);
4. to restrict what we do with the data, for example while a dispute is being cleared up (Article 18 GDPR);
5. to transfer the data, that is, to receive it in a file that another program can read (Article 20 GDPR); in the app the data download button does this;
6. to object to processing that we base on our legitimate interest (Article 21 GDPR);
7. to withdraw consent at any time; withdrawal does not work backwards, so what we did earlier with your consent remains lawful (Article 7(3) GDPR);
8. to lodge a complaint with the authority that watches over data protection: the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, UODO website.

We do not take decisions about you that would have legal effects and would be made purely automatically, without a human. We do not profile you (Article 22 GDPR). Moderation decisions that require judgement are made by a human.

Providing data is voluntary. The basic features of the app work without an account. An account and flight data are needed for the features that require the server: sync between devices, boarding passes, the passenger list in Chats, approaches with the planes of other people, notifications and the subscription.

§ 11. How to exercise your rights in the app

1. Settings → Your data → Download your data - we will prepare a file with your data in a format that another program can read (the name of the format is in the glossary). The file contains your profile, devices, trips, legs, boarding pass records (the flight details read from the pass), flight updates, saved places, "high fives" for places, contributions to the catalogue, visibility on flights, "Show others I have this flight" consents, bug reports and subscriptions. Limit: 3 downloads per hour.
2. The file from the app deliberately does not contain: the address for delivering notifications and the credential from Apple, screenshots and photos from reports, messages in the threads of bug reports, or messages from conversations, including group ones. The address and the credential are secrets that protect your account. We keep them encrypted and send them only to Apple: the address when Apple is to deliver a notification to you, and the credential when, after your account is deleted, we disconnect SkyWindow from your Apple account (§ 8). We do not have the conversations themselves. We only have messages, nicknames and group names that someone attached to a report (§ 4.6), and we keep them for the period given in § 7. The boarding pass code, the passenger name and the booking reference from the pass are not in it either, because the phone does not send them to us. They reach us only if they are visible on a screenshot or a photo that you attach to a report (§ 4.7). That button is a convenient shortcut, not the limit of your rights. We fulfil your full right of access on request: write to [email protected], we will check that it is you, and we will also give you the data that is not in the file (for example the screenshots and photos from reports and the messages in their threads), except for the secrets that protect the account (Article 15 GDPR).
3. Deleting the account, step by step: Settings → Your data → Delete account → confirm "Request deletion". From that moment you have 7 days to change your mind: the same section shows a countdown and an "Undo account deletion" button. After the seventh day the request goes into execution. From that moment cancelling may no longer be possible, and once executed the data cannot be recovered. We then delete from the server your trips, boarding pass records, saved places, reports, subscriptions, sessions and devices. We keep the credential from Apple a little longer, still encrypted, because we need it to ask Apple to disconnect SkyWindow from your Apple account. The number of your deleted account stays with it, because without that number the credential cannot be decrypted. As soon as Apple confirms the disconnection, we delete the credential. If it fails, we try again, and we delete the credential no later than 30 days after the account is deleted. We do this in our legitimate interest, to finish deleting the account the way Apple requires (Article 6(1)(f) GDPR). You can also remove the link yourself in your Apple account settings (Sign in with Apple). The deletion itself takes seconds. If it fails, the request goes back into the queue and we repeat it until it succeeds. The data saved on your device (trips, boarding passes, the flight track, packages for working without internet, settings) stays on it after the account is deleted on the server. You remove it in the app or by uninstalling the app.
4. What remains after the account is deleted. A receipt of execution: the request number and two dates. For no more than 30 days, the credential from Apple described in point 3 also remains, and after it is deleted - until the same deadline - only a record of whether Apple confirmed the disconnection. Safety cases that are running, have an open appeal or are held back because of a dispute or an authority's request are cut off from you and disappear on their original deadline. Entries in the administrator action log about what we did with your account stay until the end of that log's period (§ 7). Fragments of data read earlier while fixing failures stay with Anthropic until the deadlines in § 8, and in the records of the conversations with the AI assistant on our team's computer for 90 days at the latest (§ 4.10). Entries in the log of the server that accepts connections disappear after 7 days at the latest (§ 4.9). Correspondence with us stays until the end of its period: one year after the case is closed (§ 7). We hold no payment card details and no billing address: the sale is carried out by Apple, you receive the purchase confirmation from Apple, and we settle accounts with Apple, not with you. Our books contain neither your name nor your address. The transaction data from Apple (transaction number, product, dates) we delete together with the account. Database backups still remain. Data disappears from them on a schedule: from daily backups after 14 days, from weekly ones after 70 days, from monthly ones after 400 days. Our backup storage deletes the backups by itself, sometimes with a delay of a few days. We use backups only to restore the service after a failure. If we ever had to restore the database from a backup made before the deletion, we would carry out your deletion again on the basis of the receipt.
5. Settings → Offline & privacy → Privacy and data - a separate download of the data connected with conversations and safety reports. In the same place, the "Clear chats from this phone" button removes from this phone the conversation history, group conversations, blocks and unsent reports of your account, as well as the passenger lists downloaded from the server (§ 6(10)). Nothing goes to our server then. This version of the app does not let you delete the data connected with conversations and reports from the server separately. You delete it together with the account: Settings → Your data → Delete account (point 3). Point 4 describes what still remains.
6. If you prefer to write, write to [email protected] or in the app: Settings → Help → Write to us, topic "My data". We reply without undue delay, within a month at the latest (Article 12(3) GDPR).
7. A blocked account. You cannot sign in to a blocked account in the app, so you cannot download your data or delete the account there. In that case write to [email protected] and give the account number from the block screen. We will give you a copy of your data or delete the account.

§ 12. Children

1. SkyWindow is not intended for children under 13 years of age. By creating an account you declare that you are at least 13 years old.
2. If you are 16 or older, you can give the consents described in this policy yourself: for location, for the conversation relay on the internet, for the visibility of your nickname nearby over Bluetooth, for showing others that you have a given flight and for sending a contribution to the catalogue.
3. If you are between 13 and 15, your account works normally, but a parent or guardian must agree to the consents in point 2 (Article 8 GDPR). Until we build a path for such consent in the app, the consent-based features are not intended for you. The remaining features - flight, route, map, facts, working without internet - work without those consents, because they follow from the contract, not from consent.
4. We do not knowingly collect data of children under 13. If we learn that an account belongs to a younger person, we will delete it together with the data.
5. If you are a parent or guardian and you believe that your child has given us data, write to [email protected]. We will delete it.

The app does not ask for your date of birth. At the first launch it shows a screen for accepting the Terms of Service: by tapping the button you confirm that you are at least 13 years old. You also have the Terms in Settings the whole time, also without internet. The rule in point 3 applies just the same: if you are between 13 and 15, for now do not turn on the consent-based features, even together with a parent or guardian. The app does not yet have a way for a parent or guardian to give that consent (Article 8 GDPR).

§ 13. Data security

1. All connections to the server are encrypted. The app refuses to switch to an unencrypted connection, even if someone tried to redirect it there.
2. The most sensitive data in the database is encrypted, each item separately, with a key that we can replace with a new one: the credential from Apple, the address for delivering notifications, evidence and appeals in safety cases, and the package with your data for download. The names of the encryption methods are in the glossary.
3. We do not keep session keys in the database as they are, only their fingerprints, from which the key cannot be recovered. A copy of the database on its own does not allow anyone to sign in to your account.
4. Your account number is assigned by us. It is not your e-mail address or your name. The technical number from Apple that we keep with the account was assigned by Apple for our app only; outside it, it identifies nobody.
5. The database restricts access according to the account's permissions. We share with other people using SkyWindow only the data provided for shared features, such as the passenger list for the same flight (§ 6(14)) and the flights for which you turn on "Show others I have this flight" (§ 4.12).
6. On the phone, the database is protected by the system's file protection: while the phone is locked, its content is encrypted. When you switch to another app, SkyWindow covers its screen in the app switcher. The entire app database is excluded from the device backup - along with maps that can simply be downloaded again, but also with things that cannot, such as GPS tracks (§ 5(4)). Data meant to come back on a new phone comes back when you sign in to your account, not from a backup.
7. Our support panel has no access to the link with Apple or to the data we encrypt in the database (point 2). There are two exceptions. The person we have entrusted with handling reports sees in it the material of the report or appeal they are handling at that moment (§ 4.6), and we record every such opening in the log. All members of our team who handle reports see the beginning of the reported message, up to 100 characters, in the notification, before anyone opens the case (§ 4.6). We do not record this notification in the log, because it is sent automatically, not by a person. Only a record without content remains: to whom and about which case we sent the notification, for 30 days, and when and with what result we tried to deliver it, for 90 days (§ 7). Next to a report, the panel does not show the account number of the person named in it. Once we block that account, however, its number and the reason for the block are visible in the panel in the list of accounts and in the log, including to members of our team who can only view the panel. Without that, the block could not be lifted. We record the decisions and changes an administrator makes, and every opening of a chat report, in a log. An entry cannot be changed or deleted together with the administrator account. We delete the entries automatically after 6 months, while the entries of a chat case in which an appeal is running or which we have held back because of a dispute or an authority's request stay until that case is closed (§ 7).
8. The services of our app on the server do not write IP addresses to their logs. Entries about conversations and chat reports also pass through our tool, which leaves only a few fixed fields in them and cuts out anything that looks like an e-mail address, an IP address, a long identification number, an access key or another secret. The IP address of a person who connects to our server is recorded by the log of the server that accepts connections. We delete that log after 7 days (§ 4.9).

§ 14. The skywindow.ai website, cookies and tracking

The app does not use cookies and does not track you across apps or websites. We do not show the system question asking for consent to tracking, because we do not track. We run an information website, skywindow.ai, where we also publish these documents. The website is simple and static: it sets no cookies itself and has no analytics tools and no tracking of any kind.

The shared flight page loads the times and route of that flight from our server. The server then receives the airline, flight number, day and airports from the link, the page language and the browser's IP address, does not link them to any account and keeps them in its log for 7 days (§ 4.9).

We serve the website through the network of the company Cloudflare (§ 8 and § 9). Cloudflare sees the IP address and technical browser data of the person visiting the website, and the address of the page opened. We do this in our legitimate interest: to make the website available and to protect it against attacks (Article 6(1)(f) GDPR). When Cloudflare judges a visit to be suspicious, for example during an attack on the website, it may check whether the visitor is a human. It then stores its own cookies in the browser for a short time, usually 30 minutes. They serve only to protect the website, not advertising or tracking.

We show the website in Polish when you open it from Poland, and in English when you open it from another country. Cloudflare determines the country from the IP address and passes it to our server only for that one visit, and we do not store it. We do this in our legitimate interest: so that the website is understandable straight away (Article 6(1)(f) GDPR). You can change the language with the switch at the bottom of every page.

At the end of the home page and on the support page there is a contact form (§ 4.11). Before it sends a message, Cloudflare checks that a human is writing, not a machine sending spam. It assesses this on the basis of the IP address and the technical browser data and passes only the result to us. We do this in our legitimate interest: to protect our mailbox from spam (Article 6(1)(f) GDPR). Cloudflare also uses the same data on its own account to get better at recognising machines, and it is responsible for that itself (see Cloudflare's privacy policy for this service). According to Cloudflare, this check does not use cookies to collect or store information.

§ 15. Changes to this policy

1. If we change this policy, the new version will appear in the app and on the skywindow.ai website. For a significant change we will ask you to read it again.
2. We will send you previous versions on request. Write to [email protected].
3. Language versions. We make this policy available in the languages the app supports; today in Polish and in English. This policy is information about what we do with data, not a contract. The Polish version is the source, and every translation is meant to mean exactly the same. If you notice a difference between the versions, write to us. We will correct the translation.

§ 16. Contact

• Personal data matters: [email protected]
• App matters: [email protected] (the address [email protected] leads to the same mailbox)
• Postal address: BinSoft Sp. z o.o., ul. Władysława IV 35, 12-100 Szczytno, Poland

Technical glossary

This part is for people who want to know the exact names. You do not need it to understand the policy.

Legal bases referred to in this document

• Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR)
• Regulation (EU) 2022/2065 (Digital Services Act, DSA)
• Commission Implementing Decision (EU) 2021/914 (standard contractual clauses)
• Commission Implementing Decision (EU) 2023/1795 (EU-U.S. Data Privacy Framework)
• Polish Electronic Communications Law of 12 July 2024, Article 399 (Journal of Laws 2024, item 1221)
• Polish Act on Providing Services by Electronic Means of 18 July 2002, Article 8
• Guidance of the Polish Personal Data Protection Office (UODO) on the information obligation
• Opinion 02/2013 of the Article 29 Working Party on apps on smart devices
• Apple App Store Review Guidelines, points 5.1.1 and 5.1.5