Privacy policy

As of 5 October 2026 ·English translation for convenience — the German version is the binding one.

Waypoint (waypoint-live.app, the iOS and Android apps, and the virtual-airline websites we host) is a private, non-commercial project around the flight simulator Infinite Flight. This policy explains which data is processed, why, for how long and who receives it.

1. Controller

Julian Höke
Lingertstraße 6b, 79541 Lörrach, Germany
E-mail: [email protected]

No data protection officer is appointed, as none is required by law.

Enquiries by e-mail: When you write to the address above, we process your e-mail address, your name if the mail contains it, and the content of your message to answer the enquiry. Legal basis: Art. 6(1)(f) GDPR (answering enquiries); where the enquiry concerns your account or a function you use, (b); where you exercise your rights under the GDPR, (c). The mailbox is hosted by Google (Gmail, Google Ireland Limited, Ireland); Google also processes the messages in the USA through Google LLC. Google LLC participates in the EU-US Data Privacy Framework and, according to Google, additionally relies on standard contractual clauses for transfers. We keep enquiries as long as needed to handle them and delete them at the latest 12 months after the last message on the matter, unless we need them longer to establish, exercise or defend legal claims or statutory retention duties require it. For reports and objections to moderation decisions, the periods in section 11 apply in addition.

At a glance

The table sums up what the sections below describe in detail; the links lead to the details. Legal bases refer to Art. 6(1) GDPR: (a) consent, (b) contract or a function you asked for, (c) legal obligation, (f) legitimate interest. "DPF" means the EU-US Data Privacy Framework, covered by the European Commission's adequacy decision of 10 July 2023; "SCC" means the EU standard contractual clauses. Where a provider shows both, it relies, according to its own statements, on standard contractual clauses in addition to the DPF, so the transfer stays covered if its certification lapses or the adequacy decision falls away. In general: where a provider offers standard contractual clauses, transfers to it are also covered by them. The United Kingdom is covered by an EU adequacy decision (last renewed on 19 December 2025 until 27 December 2031). On a phone, swipe the table sideways.

2. Hosting, delivery and server logs

The application runs on a server rented from Hetzner Online GmbH (Gunzenhausen, Germany) in a data centre in Germany. In front of it sits the network of Cloudflare, Inc. (San Francisco, USA) as content delivery network, DNS and protection against attacks. Every request passes through Cloudflare, which technically processes IP address, time, requested address and browser identification. Cloudflare participates in the EU-US Data Privacy Framework; in addition, the EU standard contractual clauses apply, which Cloudflare has built into its Data Processing Addendum and which, under that contract, take effect as soon as the certification lapses. Legal basis: Art. 6(1)(f) GDPR (fast delivery protected against attacks).

The website's program and style files (scripts, stylesheets and fonts, the same for every visitor) are loaded by your browser from static.waypoint-live.app, a storage of Cloudflare R2 (Cloudflare, Inc.) on the same Cloudflare network; this keeps the site reachable while it is being updated. What is said above about Cloudflare applies to these requests. As for every address under waypoint-live.app, the browser also sends the site's cookies along; they are not evaluated there, and the storage keeps nothing about visitors. Legal basis: Art. 6(1)(f) GDPR (stable delivery).

Our own application does not write IP addresses to databases or logs. The server's own system log (the operating system journal) does contain IP addresses; it is deleted after 14 days at most. To fend off abuse (submissions, contact forms, reports, counting photo views) a shortened hash of the IP address, made with a secret additional value, is kept briefly — six hours at most — as a counter; the address itself is not stored. Some counters (for example for profile-picture uploads, reported Skydle maps or linking accounts) use your account id instead and expire after 24 hours at most. Legal basis: Art. 6(1)(f) GDPR (secure, stable operation).

Logs on the server: The reverse proxy (Traefik) that passes requests to the application on the server writes no access log. The application containers' logs are rotated: at most three files of 10 MB each are kept, older entries are overwritten. Our application writes no IP addresses into them; a sample taken on 15 September 2026 contained none. The server's system log is deleted after 14 days at most, as said above. To protect against attacks, the program fail2ban temporarily blocks IP addresses from which repeated failed sign-in attempts at the server's SSH access come, and keeps them in its database for one day. Legal basis: Art. 6(1)(f) GDPR (security of the service).

Crash reports: When an app in the EFB crashes, your browser sends an error report to our server: the app's name, the error message, the stack trace and the browser identification shortened to 160 characters, without IP address or account. We keep the latest 100 reports for 7 days at most to fix errors (Art. 6(1)(f) GDPR).

Browser security reports: our pages carry a security policy (Content Security Policy). If a page tries to load something the policy does not allow, your browser may report it to us (/api/csp-report). Such a report only contains the rule involved, the blocked host and the path of the page — no full address, no IP address and no browser identification. We count the reports in memory for at most 24 hours to correct the policy. Legal basis: Art. 6(1)(f) GDPR (secure operation).

3. Databases and storage

• Valkey (Redis-compatible) on the same server in Germany: accounts, settings, notifications, memberships in virtual airlines, chat messages, push registrations, planned flights, content of the airlines' websites.
• Cloudflare D1 (Cloudflare, Inc., USA): crew-centre activity (flight reports, points, career, applications, bookings), Contrail, photo submissions, Skydeck, Airport Passport, the staff action log, e-mail delivery logs.
• Cloudflare R2, public storage (Cloudflare, Inc., USA): images and videos that are visible to everyone on the site, served from media.waypoint-live.app (profile pictures, photos, Contrail posts, media of the airlines' websites, airline badges and rank badges, crew-ID photos, images of tours, events, fleets and operators, and the images airlines use for their Discord webhooks).
• Cloudflare R2, private storage with data kept in the EU (Cloudflare, Inc., USA): crew-centre documents, images from crew chats, images of crew-centre shops and missions (visible only to that airline's active members), Infinite Flight replays pilots upload for checkrides (visible only to their own airline's staff, deleted automatically after 7 days) and technical data of the service. This storage cannot be reached publicly; only our server can access it.

Section 2 applies to Cloudflare. Hetzner backs up the server daily in Germany; there are seven daily backups, and the oldest is replaced automatically by the new one. A backup contains only what was stored at that moment, so data we delete is gone from the server backups after 7 days at the latest. Cloudflare D1 has a built-in recovery feature that cannot be switched off (Time Travel), which can reset the database up to 7 or 30 days into the past depending on the plan; deleted rows can therefore be restored through it for up to 30 days. We use it only to bring back an earlier state after a failure, and in doing so delete again any data whose deletion had already taken place. In addition, we back up the configuration database of our server management (Coolify) daily on the same server and keep these backups for 14 days; it holds the application's configuration, not user content. Legal basis for the backups: Art. 6(1)(f) GDPR (recovery after failures).

Security: We protect the data with technical and organisational measures (Art. 32 GDPR), including: encrypted connections only (TLS 1.2 or higher, HSTS); server and main database at Hetzner in Germany; two-factor sign-in for the server management; SSH access to the server with keys only, no passwords; a firewall; service credentials stored encrypted; request limits (rate limits) against abuse; daily backups whose restore we have tested; a private storage that cannot be reached publicly for confidential files such as documents, chat images and replays; sign-ins you can end everywhere at any time with "Sign out on all devices". No method offers complete security; we keep adapting the measures.

4. Use without an account

4.1 Live map and Infinite Flight data

The map shows flights and controllers from the public live API of Infinite Flight (Infinite Flight Corporation, USA). Our server fetches this data; your IP address is not passed on to Infinite Flight. The live data contains the Infinite Flight usernames of pilots and controllers. We do not store it permanently: positions and flights are held in a cache for seconds, a pilot's stats (such as grade and experience) and logbook for up to 15 minutes, their community roles (such as moderator) for up to 24 hours. For races at events we hold the participants' username, callsign, aircraft and start and finish times until one hour after the event. When our server asks Infinite Flight for a pilot's logbook, it sends that pilot's Infinite Flight user id, which Infinite Flight already knows. For crew-centre members whose profile carries their Infinite Flight username, a finished flight can be suggested as a flight report for them to submit with one click (section 7.4). Legal basis: Art. 6(1)(f) GDPR (showing Infinite Flight's public live traffic).

Landings of the last hour: per server, the live statistics and the airport window show the landings of the last 60 minutes — how many, where, the average touchdown rate and how the touchdowns were graded, plus the best landing and records such as the softest touchdown. When the map sees an aircraft land, our server reads the touchdown figures Infinite Flight records for it (rate, g-force, speeds, distance from the centre line and the aiming point, ground roll, time) from the pilot's logbook — one read, a few more if Infinite Flight hasn't written them yet. An aircraft that leaves the session low over an airport, a slow one that stops there, or one that comes down to a runway and climbs away again (a touch-and-go) is looked up the same way and only counts if Infinite Flight recorded a touchdown. For this hour we keep the flight id, the pilot's Infinite Flight username, callsign, aircraft, airline, airport and those figures in a short-term store (Valkey) — nothing in a database, no history per pilot. While a landing still waits for its figures, the pilot's Infinite Flight user id, the flight id and where the landing was seen are kept there as well, so a restart of our server doesn't lose it — for at most an hour, and deleted as soon as the figures are in. The ten softest landings and the records show the pilot's Infinite Flight username and callsign; the hardest landing is shown without them (aircraft, airport and rate only) and is never part of the named lists. Every landing is deleted after one hour. If you are signed in and your account carries your Infinite Flight name (typed on your profile or verified by signing in with Infinite Flight), the map tells you when a landing under that name is among the ten softest of the hour; which of these notes you have already seen is remembered only in your browser (localStorage). You can share such a landing as a card: its facts (airport, rate, g-force, distance from the centre line, rank, server, the time and date of the landing, aircraft, airline and your Infinite Flight username) are written into the link itself and signed, so they can't be altered — we keep no copy, and whoever you send the link to sees exactly those facts. Legal basis: Art. 6(1)(f) GDPR (showing Infinite Flight's public live traffic); for the card, sharing it is your choice.

4.2 Map tiles and weather layers

Map tiles, satellite imagery, terrain, rain radar and fonts are all served by our own server. Your browser never contacts the data providers; our server fetches them from OpenFreeMap (map tiles and map fonts), EOX IT Services GmbH, Austria, EU (satellite imagery "Sentinel-2 cloudless 2025") and Amazon Web Services (terrain) without passing anything about you. Fonts an airline has chosen for its website hosted with us or for its crew centre are fetched on demand by our server from Google Fonts (Google Ireland Limited, Ireland) and served by us; again your browser never contacts Google and nothing about you reaches Google. The fonts of all other pages are stored on our server. The satellite pictures of Skydle and of the route videos come the same way: your browser never contacts EOX, and no personal data is sent to EOX. From zoom 14, and for Skydle pictures of airports in these countries, the satellite view uses government aerial imagery (orthophotos), which our server fetches from the public authorities that publish it: in Germany the surveying and geodata offices of the 16 states, in Switzerland the Federal Office of Topography swisstopo, in Austria basemap.at, in France the IGN, in the Netherlands PDOK / Beeldmateriaal Nederland, in Spain the Instituto Geográfico Nacional, in Czechia the land survey office ČÚZK, in Luxembourg the Administration du cadastre et de la topographie, in Belgium the National Geographic Institute (NGI), in Portugal the Direção-Geral do Território, in Estonia the Land and Spatial Development Board, in Slovakia the Geodetický a kartografický ústav Bratislava, in Slovenia the Geodetska uprava Republike Slovenije, in the United States the U.S. Geological Survey and in Japan the Geospatial Information Authority of Japan (GSI). Here too your browser never contacts these authorities, and no personal data is sent to them — our server only asks for the image of a map square. The pictures you guess in Skydle's rounds come from Esri World Imagery by Esri, Inc. (Redlands, California, USA). Our server fetches them through the ArcGIS Location Platform with Waypoint's own key; the request contains only the map square — never your IP address, account or anything else about you — and your browser never contacts Esri. Because Esri's terms let one picture serve one player only, our server keeps a picture in its memory for at most 15 minutes for the player who asked for it, under your account id or, signed out, a one-way hash of your IP address and browser identifier; nothing of it is written to disk. Skydle's night pictures come from NASA (Black Marble, through NASA's Global Imagery Browse Services, USA). Our server fetches them; the request contains only the map square, and your browser never contacts NASA. They are public domain and our server keeps them like its other pictures. The map style itself and the world map of the simplified map and of the share previews are files stored in our own software — nothing is fetched for them at all. No personal data arises.

Apple satellite imagery (our iOS app only). In our iOS app, the satellite view can show Apple's satellite imagery (Apple Maps, through Apple's MapKit, which is part of iOS) underneath our map instead of the imagery described above. Then — and only then — your iPhone or iPad requests the map pictures itself, directly from Apple Inc. (One Apple Park Way, Cupertino, California, USA), the same way Apple's own Maps app does. Apple receives your IP address, the usual technical details of your device (such as device type, iOS version and language) and which part of the map you are looking at (map area and zoom level). We send Apple nothing about you — no account, no username, no flights — and our server is not involved. Apple processes these requests under its own privacy policy (apple.com/legal/privacy). Legal basis: Art. 6(1)(f) GDPR (sharp satellite imagery at no extra cost) and § 25(2) no. 2 TDDDG (loading the map you chose to see). Transfer to the USA: Apple Inc. (SCC). At present this is switched on only on single devices of our team, for testing; for everyone else the satellite view works as described above. Our website (in any browser) and our Android app never contact Apple for maps, and neither do the other map styles.

Weather radar. When you switch on the radar (live map, ATC scope, Nav Display), your browser loads the radar pictures only from our server. Our server fetches the underlying data from public weather authorities: Deutscher Wetterdienst (Germany), EUMETSAT (Germany), NOAA/National Weather Service (USA), Environment and Climate Change Canada (Canada) and — for the worldwide satellite estimate outside the radar areas — NOAA/NESDIS Enterprise Rain Rate, fetched through NOAA Open Data Dissemination at Amazon Web Services (USA). These requests contain only the map area, zoom level and time of the picture — never your IP address, account, location or anything else about you. We combine and re-colour the data on our server and keep the finished pictures for a few hours in our cache and at Cloudflare. No personal data is processed for this.

4.3 "Most tracked"

So the map can show which flight is followed most, your browser creates a random id in sessionStorage (gone with the tab) and reports it regularly together with the selected flight. Our server stores it together with a shortened hash of your IP address, made with a secret additional value, so nobody can push a flight up with invented ids, and deletes the entry after 100 seconds at most. We do not link it to your account.

When the map loads, the browser also reports once whether it supports WebGL2 ("yes" or "no"), so we know how many devices a future map version would exclude. Only those two counts per day are kept, plus the number of map loads per hour for three days and per version of our site for 30 days (so failures below can be set against them; the version is the time our build was made, the same for every visitor) — no identifier, IP address or browser details. Legal basis for both: Art. 6(1)(f) GDPR (running and developing the map, protection against manipulation).

When the map fails on your device, the page reports that as an anonymous counter — otherwise we only hear about such faults when somebody writes to us. The report is exactly one of six fixed events (an earlier load of the map in the same tab never finished; one in another tab or window of this browser never finished — open tabs are asked first, inside your browser only; the restart protection from section 4.4 switched to the lighter or the 2D map; the WebGL map gave up; the graphics context was lost; the map came back after such a loss), plus the map mode (full, lite, 2D), a fixed reason code and the version of our site (the time our build was made, the same for every visitor). No error texts, addresses, map view, flight or account are transmitted. From the browser identification (User-Agent) your browser sends with every request anyway, our server keeps only the device family — operating system, with the major version on phones, and browser, for example "iOS 26 WebView" — and discards the rest. All that is stored is how often each of these combinations occurred per day, for 30 days, and, without the device family, mode and reason, how often each event occurred per hour, for three days, and per site version, for 30 days; there is no identifier, no per-visitor record and no cookie, and the page reads no further information from your device for this. Your IP address is used only for the usual abuse protection from section 2 (shortened hash, here for one hour at most), which limits the number of reports. Legal basis: Art. 6(1)(f) GDPR (detecting and fixing faults of the map).

4.4 Local storage in the browser

Your browser stores settings and page state in localStorage or — only until you close the tab — in sessionStorage. Our keys start with wp_, ctr_ or skydle and belong to these groups:

• Map and display: settings (wp_settings), map view (wp_map_view), open panels, tabs and cards, layers, 2D mode, customised bars and colour schemes, and the map's restart protection (wp_map_boot, wp_map_lite, and a random tab id wp_tab in sessionStorage that only tells a reload of the same tab from another tab): if the map page restarts several times within a few minutes on your device, it notes this and shows a lighter map for 24 hours; if the map loses its graphics context again and again (wp_gl_fail), it notes the time and shows the 2D map for up to 30 minutes instead of retrying in a loop.
• Profile: a copy of your profile details (wp_profile) and the chosen profile view; the sign-in itself is in the cookie (section 5).
• Favourites, friends, fleets and alerts: friend and fleet lists, favourite real-world flights, flight alerts, push token and topics, keys for widgets and Live Activity, the last flight you followed.
• Planning, EFB and controller tools: SimBrief username, planner pre-fill, EFB data, NOTAMs read, taxi routes, strips and settings of the ATC mode, the connection to Infinite Flight on your own device, ATC Academy progress, saved boarding passes.
• Games: Skydle scores, stats, rounds, duels and parties, the random player id and your player name, the Skydeck deck, and (keys wp_deco_…) whether this browser used the live map during a seasonal event and the map extras chosen on it; (key wp_streak_day) the date this browser last reported for your daily streak.
• Crew centres and airline websites: chosen tab, collapsed navigation, NOTAMs and chat read, drafts in the website and course editors, hints for staff, your last picks in the crew centre's search (wp_va_search:…, section 7.5).
• Chat and Contrail: read state and mutes in the pilot chat, Contrail colour scheme and welcome.
• Hints already seen and technical markers: news, recaps, introductions, a one-time reload after an update (wp_chunk_reload) and the "Most tracked" id (wp_vid, section 4.3).

These entries are needed for functions you explicitly use (§ 25(2) no. 2 TDDDG), so we do not ask for consent first. They are not passed to third parties; they reach our server only where a function needs it and this policy describes it, such as the Skydle player id or, when you are signed in, the settings we keep on your account (section 6). Only the SimBrief username goes to SimBrief, on your click (section 4.6). You can delete the entries at any time in your browser settings. Further processing rests on Art. 6(1)(f) GDPR (the page remembers your settings) or (b) where it belongs to a function you use. For Skydle duels and parties a random player id is created and sent to our server so the other players recognise you within the round; it is not linked to you as a person.

On airline websites we host, the browser stores in sessionStorage whether you allowed YouTube or Discord content to load (key wp_embed_ok:youtube or wp_embed_ok:discord, value "1"). It likewise remembers whether you loaded the OpenStreetMap map on a photo page (wp_embed_ok:osm) or an image from another server in a text (wp_img_ok:<server>). The entries never leave your browser and are gone when you close the tab.

4.5 Profile pictures

Profile pictures pilots have released from their Discord or Google account are served by our server; your browser does not contact Discord or Google for them.

4.6 SimBrief

When you generate a flight plan through SimBrief in the planner, your browser sends your SimBrief username and the plan data directly to SimBrief (Navigraph, Sweden). Only on your click. Legal basis: Art. 6(1)(b) GDPR (a function you asked for); Navigraph is based in the EU.

5. Cookies

We set no cookies for analytics or advertising and use no analytics services. These cookies are technically necessary for the functions you ask for (§ 25(2) no. 2 TDDDG):

• __Secure-waypoint.session — your sign-in, 14 days (ended everywhere at any time with "Sign out on all devices" in the account settings), only with an account. The authentication library also sets cookies against attacks: csrf-token and callback-url on the first page view, because the page checks whether you are signed in (until you close the browser), state and pkce only during a sign-in (a few minutes). They contain nothing about you.
• wp_locale, wp_site_lang — your chosen language, 1 year, only after you use the language switch.
• ctr_pid — which of your Contrail profiles is active, 1 year, only with an account.
• wp_pgpw_… — remembers that you entered a protected airline page's password, 30 days. wp_sprev_… — preview of an unpublished airline website, 7 days. if_oauth_pkce — protection during sign-in with Infinite Flight, 10 minutes. When you connect Infinite Flight from our iOS or Android app, the sign-in opens in your phone's browser; the same protection then sits on our server instead of a cookie, together with which account asked, for 10 minutes and one use.

6. Account

An account is optional. You sign in with Discord (Discord Inc., USA), Google (Google Ireland Limited), Apple (Apple Distribution International Ltd., Ireland) or Infinite Flight (Infinite Flight Corporation, USA); your browser is redirected to that provider, which sees your IP address. We request identity only (Discord: "identify"; Google: "openid profile"; Infinite Flight: "openid profile") — no e-mail address, no friend lists, no servers. If Apple passes an e-mail address, we do not store it.

Transfers to the USA at sign-in: Discord Inc. participates in the EU-US Data Privacy Framework and, according to Discord, additionally relies on standard contractual clauses (modules 1 and 2) for transfers from the EEA; this applies to every transfer to Discord named in this policy. Google also processes data in the USA through Google LLC, which participates in the Data Privacy Framework as well; according to Google, it additionally relies on standard contractual clauses. This applies to every transfer to Google named in this policy. Apple also processes data in the USA through Apple Inc.; according to Apple, these transfers rely on standard contractual clauses. Infinite Flight Corporation is not certified under the Data Privacy Framework and has not agreed standard contractual clauses with us. You enter your credentials there yourself; our server then only redeems the one-time sign-in code and reads your Infinite Flight id and username. Insofar as this is a transfer to the USA, we rely on Art. 49(1)(b) GDPR, because it is necessary for the sign-in you chose.

Stored: an internal id, your user id at the provider, your display name, the profile picture (a reference, or a picture you uploaded), your Infinite Flight username, your settings. So they apply on all your devices, these include friend and fleet lists, filters, widgets and profile details, the settings of the EFB and the ATC mode, the airlines you marked with the heart in the Crew Center (without an account they stay only in your browser), and up to 200 flights from the EFB calendar. To subscribe to the calendar we create a secret link; anyone who has it sees the calendar flights (route, flight number, aircraft) without signing in, so do not share it. You can renew the link at any time in the EFB calendar; the old link then stops showing any of your flights at once, and you subscribe again with the new link. Notifications to you (for example about reports, photos or crew centres) are kept as an inbox with the latest 50 entries; it expires 90 days after the last new notification. Legal basis: Art. 6(1)(b) GDPR (providing the account). Your profile picture is shown to others only if you enable it in the settings.

Sign in with Apple: When you sign in with Apple, Apple gives our server a token for Waypoint — on the website during sign-in, in the iOS app from the one-time authorisation code the app passes on. We keep one such token (normally Apple's refresh token), encrypted, for one purpose only: when you delete your account, we send it to Apple Inc. to revoke Waypoint's access to your Apple ID, as Apple requires, and then delete it with the account. We never use it to fetch data from Apple. If you last signed in with Apple before 15 September 2026, we hold no token until your next Apple sign-in. Legal basis: Art. 6(1)(b) GDPR.

If you verify your Infinite Flight username by signing in with Infinite Flight, we also store the mapping of that name to your account, so rights and precedence tied to the name (for example in the pilot chat or for pre-departure declarations) go only to the verified account. The mapping is removed when you disconnect Infinite Flight or delete your account. If you connect Infinite Flight in a crew centre for its LIVE organization features (section 7.3), we also store the access tokens Infinite Flight issues for this, encrypted, so our server can read for you; they are deleted when you disconnect Infinite Flight or delete your account, and in any case 30 days after their last use.

Terms of use: When you open Waypoint signed in for the first time, and again after a material change of the terms, we ask you to accept the terms of use and confirm the age rule (see Minimum age). We store the accepted version and the time on your account as proof of acceptance (Art. 6(1)(b) and (f) GDPR), for as long as the account exists.

Minimum age: Waypoint is for people aged 16 and over. If you are 13, 14 or 15, you may use Waypoint and create an account only with a parent's or guardian's consent. Children under 13 may not use Waypoint, and we don't knowingly collect personal data from them (as the US Children's Online Privacy Protection Act, COPPA, also requires). If we learn that an account belongs to a child under 13, we delete it and its data. Parents can reach us at the address in the Impressum. Contrail (section 11), with its public profiles, is only for people aged 16 or older, even with a parent's consent.

Take it with you: Under Settings → Account you can download everything we hold about your account as a JSON file (Art. 20 GDPR): account, memberships and every database row in your name.

Delete: Under Settings → Account you can delete your account yourself at any time. That removes everything we keep about you, also for every login linked to your account: the account, profile, profile picture, your Contrail profiles with posts, comments, likes and media, your memberships in all crew centres including e-mail address and crew photo, points, career, applications, bookings, tickets, your messages and images in every chat, your photos in crew galleries, checkride replays, EFB documents, your aircraft and airport photos, gate suggestions, Skydeck progress, Skydle games, maps and leaderboard places, the Skydle plane, event badges and map extras, notifications, flight plans, widget and Live Activity entries and the push subscriptions in your name. If you signed in with Apple, we first revoke Waypoint's access to your Apple ID at Apple and delete the stored Apple token. Your flight reports remain as anonymised rows without name or remarks in the airline's statistics. What you created or decided as staff stays without your name; gate corrections taken from your suggestions then carry no name of yours at all and credit "Community" internally. A chat or Contrail ban stays with the login ids and names it covered, its time, the id of the staff member who banned and its reason, so it cannot be lifted by deleting and signing in again. Entries in the staff action log (section 11) stay unchanged until they are deleted automatically after 12 months: this applies to entries about actions that concerned your account and — if you were part of our team — also to entries naming you with your account id and your name at the time as the person who acted. Items in the moderation inbox (section 11) that you submitted or that are about you are deleted with your account, also one decided less than 30 minutes before; an image you uploaded for an airline and a /report note or event report you sent stay there for our team's decision, without your name and account id. Review cards our bot posted to Discord before 16 September 2026 are deleted automatically 48 hours after posting. Deleted data is gone from the server backups after 7 days at the latest, and from Cloudflare D1's recovery after 30 days at the latest (section 3). If you own an airline, transfer or delete it first. Posts already published in an airline's Discord channels live with Discord and that airline. Step by step, also without signing in: waypoint-live.app/delete-account.

7. Crew centres of virtual airlines

Virtual airlines (VAs) run a crew centre with us. When you join one, its staff see your username, callsign, flight reports, hours, points, badges, bookings and — if you provide them — your e-mail address and Discord link. Applications store the answers to the questions the airline asks. If the airline asks applicants to take an entry exam from its training courses, you take it while your application waits: we grade your choices on the server and store your score, whether you passed and how many tries you needed, at most 60 days (your wrong answers are kept as for any theory exam, below); the staff who review applications see it next to yours, and a passed exam also enters your training record like any course exam. For every theory exam you take in an airline's training courses (as an applicant or a member) we keep your last and best score, whether you have passed, how many tries you needed and when, so the airline's trainers can see who took it; their devices get a push notice of each try, and the airline can also have it posted to its own Discord channel (off unless the airline switches it on). For each try we also keep the questions you got wrong, as they read then, with the answer you picked and the right one — the last 10 tries of the last 90 days — so the trainers who see the results can help you where you went wrong; you see your own wrong questions and your choice right after the try. This is deleted when you leave the airline or delete your account, and a year after your last try at the latest (the wrong answers after 90 days). A crew photo you set for an airline appears on your crew ID card and on your pilot profile in that airline, which anyone can open, and next to your name in the crew centre's pilot list, which only the airline's staff and active members see. Which questions an airline asks and how it uses your data inside the airline is the airline's decision; Waypoint provides the technology and stores the data on the airline's behalf. If the airline asks you to confirm that you have read a chapter of its handbook, we store which chapter you confirmed and when, and the airline's staff see it; it is deleted with your membership, with the airline or with your account. The Discord command /handbook lists the chapters you may read and marks the ones you still have to confirm; only you see that answer, and nothing new is stored for it. Legal basis: Art. 6(1)(b) GDPR (membership).

Reasons for a rejection or a decline: When the airline's staff reject one of your flight reports or decline your application, they may say why — one of the airline's quick reasons or their own words, at most 500 characters; it is optional. The same goes for a flight report they put on hold with a note on what to fix: you also get that note as a notification in the crew centre (above), and you can then edit the report and send it again. We store this reason with the flight report or the application in our database (Cloudflare D1, section 3). You see it on your report in the crew centre, or above the application form when you open the airline's page again; it is in the push notification about your application (section 10) and in the mail about the decision, if the airline sends one (section 8). The airline's staff who review flight reports or applications see it too; nobody else does — other pilots never see it, and it is not posted to the airline's Discord channel for decisions, only to the staff review card in its review channel (Discord Inc., below). A later decision on the same report replaces the reason. It is deleted together with the flight report or the application, and when you delete your account (section 6), the reason on your flight reports is removed with your name. Legal basis: Art. 6(1)(b) GDPR (your membership or application) and (f) (the airline's interest in explaining its decision to you).

Data is kept as long as your membership lasts; when you leave the airline or it is deleted, it is removed. Your crew photo is deleted as soon as you leave the airline or are removed from it. You can export your own airline data from the crew centre at any time. A crew centre's photo feed (photos, photo challenges, likes and the magazine's photo of the week) is visible only to the airline's active members unless the airline makes it public. Individual photos the airline's staff explicitly publish to their website are publicly visible there.

Request to register an airline: If you want to set up a virtual airline on Waypoint, we store your request with the airline's name and code, your username in the Infinite Flight Community (IFC), the IFVARB link — only if you state "listed on IFVARB" —, your note, your display name and your account id in our database on the server (Valkey, section 3). Team members from the moderator role upwards decide it in the moderation inbox of our staff console (section 11); Discord Inc. only receives a notice that a request is waiting, without your details. If you allowed push notifications, the device the request came from receives one single push notification about the decision, carrying the airline's name (section 10). An open request is kept until it is decided; a declined and an approved request alike are deleted 30 days after the decision. When you delete your account, your requests and their inbox entries go with it at once. If the request is approved, the airline is created with you as its owner; its data follows this section 7 and section 12. The decision itself stays in the staff action log (section 11). Legal basis: Art. 6(1)(b) GDPR (the registration you asked for); for the review, (f) (no airlines that belong to someone else or pretend to).

Request to change an airline's name or code: An airline's owner and its staff with the settings right can ask us for a new name and/or code in the crew centre. We store the request with the old and new name and code, the reason given, and the display name and account id of the person who asked (Valkey, section 3); the airline's staff with the settings right see it with that name. Waypoint moderators and community admins decide it in the moderation inbox (section 11); Discord Inc. only receives a notice that a request is waiting. The person who asked gets a notification in the crew centre about the decision, and the airline's own Discord channel for moderation results a short post without any account id. An open request is kept until it is decided or withdrawn, a decided one 30 days after the decision; when you delete your account, your name and account id come off it at once (the request is the airline's). The decision and the change stay in the staff action log (section 11) and in the airline's change log. Legal basis: Art. 6(1)(f) GDPR (keeping airline names and codes unique and correct).

7.1 Discord link

Airlines can connect their Discord server to Waypoint. Events (new flight reports, promotions, group flights, applications, reports) are then sent as messages to Discord Inc. (USA; EU-US Data Privacy Framework and standard contractual clauses, section 6), each with your username and the content the event concerns. If you link your Discord account to your roster entry, your Discord id is stored so slash commands recognise you. If the airline's staff enter your Discord username for you in the roster, our bot sends that name to Discord Inc. to find your Discord id among the members of the airline's linked Discord server; only the id is stored, the name is not kept. Our bot deletes review cards for flight reports in the airline's review channel 48 hours after posting (the airline can still decide in the crew centre), and a request to link your Discord account 48 hours after the decision, 9 days after posting at the latest.

Flight alerts ("Notify me"): if your airline posts a flight-alert panel in its Discord server and you press "Notify me", our bot gives your Discord account the airline's alerts role (pressing it again takes the role back); the role is kept by Discord, we store only which role and channel the airline chose. When a LIVE flight has a free seat or a fleet aircraft becomes free to book, the bot posts the flight (callsign, route, aircraft, departure time and the Infinite Flight usernames already on it) in that channel and mentions the role. If you press "Take as captain" or "Take as FO" there, we look up the roster pilot linked to your Discord account and take the seat in Infinite Flight exactly as the crew centre does (section 7.3); only you see the answer. In the crew centre you can instead switch on "Notify me about open flights": we then keep your account id in the airline's list until you switch it off, leave the airline or delete your account, and send you a crew-centre notice and a push to your devices that subscribed (section 10). To send one message for several openings and announce each only once, we keep schedule and aircraft ids with times (queue 2 hours, announced flights 12 hours, aircraft 3 hours, the alert posts' message ids and which seats were open 26 hours). Legal basis: Art. 6(1)(a) GDPR (you switched it on), for the posts in the airline's server Art. 6(1)(b) GDPR (your membership).

7.2 Crew-centre chats and support tickets

An airline's channels are visible to its members only. Messages are stored with username and time. Messages with crude insults, hate or sexual solicitation and links to outside sites are rejected automatically (section 16). Each channel keeps its latest 400 messages; older ones drop out, and a channel's history is deleted 30 days after its last message. The airline or the author can delete messages earlier; a later edit is marked with its time. Attached images are stored resized in the private storage (Cloudflare R2, section 3) and served to members only. They are deleted with the message, also when it drops out of the history; a daily check removes images no channel shows any more. Links to Waypoint pages are shown as preview cards; a link to a flight in progress shows its current position from the live data, nothing of which is stored. Mentions can be delivered as push notifications (section 10).

Support tickets you send to an airline's staff from the crew centre or with a Discord command are stored with subject, messages, username, time and status until the ticket is deleted or your membership ends. If the airline has connected a ticket channel, Waypoint mirrors each ticket into a private Discord thread of that airline which only you and its staff can see (transfer to Discord Inc., USA; see 7.1).

7.3 Infinite Flight LIVE organizations

An airline's staff can link its crew centre to the airline's organization in Infinite Flight LIVE. For this, the staff member — and every member who wants to see the organization in the crew centre — connects their Infinite Flight account once: you sign in at Infinite Flight (Infinite Flight Corporation, USA) and allow Waypoint to read the LIVE organizations you belong to (with your role in them — member, admin or owner — so staff see whether Infinite Flight will accept their changes), their aircraft and their schedules ("openid profile offline_access live:organizations.read live:aircraft.read live:schedules.read"; offline_access so it keeps working without signing in again). Staff who manage the IF LIVE link or may change schedules or approve flight requests in the crew centre are also asked, when they connect, to allow schedule changes ("live:schedules.write") — the booking sync, approved flight requests and schedule edits use it, and Infinite Flight only accepts them from owners and admins of the organization. If such a staff member's connection can only read, the crew centre tells them once (a notice; we keep for 90 days that it was sent) and asks them to reconnect. We store the tokens encrypted with your account (section 6). The connection also confirms your Infinite Flight username, as the sign-in in section 6 does.

What we read — the organization's aircraft, their last position and state, the schedules with the usernames of their crew — is shown only to members of the airline who are members of that organization in Infinite Flight themselves (Infinite Flight checks this with their own token). It is held in our server's memory for at most two minutes, so several members opening the page don't each cause a request, and it is not stored. Only to keep an aircraft of the crew centre's fleet linked to its aircraft in Infinite Flight, we keep that aircraft's Infinite Flight id (with the organization's id) until the airline is deleted, the organization is unlinked or the aircraft is deleted in Infinite Flight; when staff change a registration there, the fleet aircraft takes it over.

Shared with the crew: the staff member who linked the organization can choose, in the crew centre's admin tab, to show the fleet to the whole crew. Then every active member of the airline sees the same read — aircraft, positions, schedules with the crew's usernames, and on the live map which aircraft are the airline's — without connecting their own Infinite Flight account and without being a member of the organization in Infinite Flight; it is read with that staff member's access and, as above, not stored. Staff can switch it off at any time. Legal basis: Art. 6(1)(f) GDPR (the airline's interest in showing its own fleet to its crew).

On the airline's public map: only if staff with the settings right switch on "Show IF LIVE aircraft on the public map" in the crew centre's Map tab (it is off unless they do), the airline's embeddable live map (which anyone can open, on Waypoint or on the airline's own website) can show only the organization's aircraft flying on an Infinite Flight server right now, or always show them in addition to the flights it is set to show. While the switch is off, nothing of the organization is read or shown for the map. The map then picks these aircraft out of the public server list it draws anyway (with what that list shows: callsign, username, aircraft, position). For this we use the organization's list of aircraft (their Infinite Flight ids), read with the access of the staff member who linked the organization — or the read the crew centre or the background check made anyway — at most once every 5 minutes per organization, held only in our server's memory (never older than an hour) and not stored. Legal basis: Art. 6(1)(f) GDPR (the airline's interest in showing its own flights on its website).

Discord messages: Staff can switch on four kinds, each to a channel of their choice in the airline's Discord (Discord Inc., section 7.1): a feed of new, departed and arrived flights of the organization (with how punctual the arrival was); staff alerts about delayed, diverted and cancelled flights, flights still not off 15 minutes after their time, flights about to depart without crew and aircraft going into maintenance; technical notices when the booking sync fails or the linking staff member's connection ends; and a daily round-up of the previous day (number of flights and pilots, on-time rate, busiest aircraft, cancellations and diversions), counted when it is posted from the schedules Infinite Flight returns at that moment. The messages carry callsign, route, registration, aircraft type, times and the crew's usernames. To tell what changed and not to send an alert twice, we keep only the ids of the schedules and aircraft with their last status and which alerts were sent, for 7 days. The feed also says when a pilot is put on a flight or their flight is up next and, if staff set a crew timer, reminds them before they are taken off a flight without a time that they haven't started (the take-off is written with the access of the staff member who linked the organization); to mention the pilot we look up the Discord account linked to their crew-centre entry by their Infinite Flight username, and we keep only the schedule ids with the minute the crew was first seen and which of these messages were sent. So that the timer can't be reset by giving a flight back and taking it again, we keep, per pilot and flight, the minutes of the timer already used when the flight was given back (7 days) and, after the timer ran out, until when the pilot can't take that flight again (24 hours) – only the schedule id, minutes and times; it is deleted with your account.

Booking sync: If staff switch it on, a booking you make on an aircraft whose registration also exists in the organization is sent to Infinite Flight as a schedule: flight number (or your callsign), departure and destination airport, the departure time you chose (or one about 20 minutes ahead) and the estimated arrival, and a note with the airline's name and the route's remarks; if your account is verified with Infinite Flight, also your Infinite Flight user id, so that you are entered as captain. If you then plan the flight in SimBrief from the crew centre, its route is written into the schedule's flight plan. If staff also switch it on for career rosters, a roster leg with a planned time and aircraft is sent the same way up to a day ahead. Before a booking we look up whether the aircraft is already flying or crewed in Infinite Flight, so it can't be booked twice. The schedule is written with the access of the staff member who linked the organization. When the booking is released, rejected or runs out, we delete the schedule again, as long as the flight hasn't started. We keep which booking belongs to which schedule (ids only) for up to 4 days. If Infinite Flight reports the flight as arrived while your booking is still open, you get a reminder in your notifications (section 6) to file your flight report — with suggested flights (7.4) on, only if the booking is still open two hours later. You file the flight report yourself, by hand or with one click on a suggested flight. When the airline checks reports automatically and your logbook doesn't confirm the flight, a schedule of the organization that Infinite Flight marks as arrived, with you on its crew, can confirm it instead; it is only compared, not stored (a one-way fingerprint of the schedule id is kept with the report so the same flight isn't filed twice).

Open flights: If staff allow it, you can put yourself on the crew of a flight the organization scheduled, or take yourself off again before departure; your Infinite Flight user id is then sent to Infinite Flight with the access of the staff member who linked the organization. If staff allow it, you can also request a flight on one of the organization's aircraft: we keep your request (the aircraft, the route, the flight number, the time you asked for and your note to staff) with your account and your Infinite Flight user id until staff decide on it, at most 7 days, and then 30 days with the decision (who decided, and a reason if they give one); it is shown to the airline's staff who manage its schedules, and staff alerts in the airline's Discord can mention it. When staff approve it, the schedule is created in Infinite Flight with their own access and your Infinite Flight user id is sent to put you on it as captain. The crew centre can also show the organization's aircraft on a map; it is only shown to members of the organization and built from the same short-lived read. On the live map, a member who connected their Infinite Flight account also sees which aircraft in the air belong to their airline's organization (with its registration): we ask Infinite Flight with your own access whether you are a member and which aircraft the organization has, keep that list for at most 5 minutes in the server's memory and store nothing.

Flight log and members: To match a LIVE flight to its flight report and show its flight time, we read the aircraft's flight log in Infinite Flight (with the access above, "live:aircraft.read"): for each flight its airports and times, which pilots flew it and when each of them was in control. You see how long you were at the controls of a LIVE flight you flew, and that time is filled into your flight report; staff reviewing a report for a LIVE flight see whether the log has a matching flight and how long its pilot was in control. Members who can open the organization's aircraft in the crew centre also see each aircraft's flight log there: every flight, also ones that weren't scheduled, with its airports, times, status, length and callsign, the Infinite Flight usernames of the pilots who flew it and when each of them was at the controls, and the aircraft's total airframe time; it is read when the aircraft is opened or more flights are asked for. The log is held in our server's memory for a few minutes and not stored; with a report for a LIVE flight we keep only which schedule and aircraft it belongs to (ids), for 90 days. When you file a report for a LIVE flight, the log is read once more, together with the crew centre's record of who handed the flight to whom: your time as pilot flying decides whether the report is approved automatically. If it is shorter than the time you filed, or the log can't be read, the report goes to staff, and the reason (for example your time as pilot flying and the flight's length, or why the log couldn't be read) is kept with the report for staff, for 180 days. If the schedule of a LIVE flight you file has a debriefing, it is shown above your report's comment field, and you can add it to your comment with one click; it is only kept if you file the report with it, like any comment. From the same flight log, staff see a weekly report of their airline's LIVE aircraft — flights, hours per aircraft, and per roster pilot (matched by Infinite Flight user id) their flights and time at the controls — and can have it posted to their Discord once a week; it is computed when it is shown or posted, held in our server's memory for at most 10 minutes and not stored — we keep only whether the post is on, its day and its Discord channel. When staff have it on, they can also compare the organization's member list in Infinite Flight with the crew centre's roster: for this we read, with an additional permission they grant ("live:members.read"), each member's Infinite Flight username and user id, role, joining date and active lifts. It is shown only to that airline's staff with settings rights, held in memory for at most 10 minutes and not stored. Only one part of it goes to the whole crew: the members who lift the organization right now, with their Infinite Flight username and number of active lifts, in a "Supporters" list in the IF LIVE tab (read the same way, not stored). The same list, read once per organization with the access of the staff member who linked it (or of another staff member who granted the permission), is also used to check whether a pilot is in the organization — by their Infinite Flight user id, instead of asking Infinite Flight with each pilot's own access — and lets staff who assign a pilot to a LIVE flight find a pilot who hasn't connected Infinite Flight by the Infinite Flight username on the roster; for this, too, the list is only held in memory for at most 10 minutes and nothing is stored. Legal basis: Art. 6(1)(b) GDPR (your membership), for the review and the member comparison also (f) (the airline's interest in checking its flights and keeping its roster in line with its organization).

Ready reports, crew notices and status: When a LIVE flight you were crew on has ended and the aircraft's flight log shows you at the controls, a ready-to-submit report waits on your desk, as with automatic PIREPs: for it we keep the ids of the schedule, the aircraft and the log entry, the end time and your minutes at the controls, for 7 days; route and flight number are read from Infinite Flight again when you look at it or submit it. When staff put you on a LIVE flight, when its crew timer is about to run out, when the timer took you off it and, if staff switched it on, when your flight has left the gate and then stood without you for longer than the time they chose (the aircraft on an Infinite Flight server with nobody in it, read from the public server list we already load for the map), you get a crew-centre notice (the bell, a one-time card and a push to your devices that subscribed); for this we match the flight's crew to the roster by your Infinite Flight user id and keep, for one day, a note that the notice for a seat already went out (the schedule id and part of the user id), and for a standing flight only its schedule id with the minute it was first seen standing and how many reminders went out (at most three), in the background check's state described above. On a LIVE flight shared by a captain and a first officer the flight time goes to the pilot flying: when the controls change hands in the crew centre (a handover, or a takeover after the flight stood with nobody flying it for the time the airline chose, judged from the same public server list, or, if the airline switched it on, automatically after such a standstill), we keep the Waypoint account of the new pilot flying, the time and how it happened, and for the flight when it began to stand, when taking over became allowed and when that ended, for 72 hours (ids and times only); the first pilot flying is read from the aircraft's flight log when needed and not stored. Both pilots get a crew-centre notice when the controls change hands, and the other pilot one when they may take over. For staff's connection status we keep per airline when the background check last read the organization and when and with which HTTP status it last failed (14 days), and count Infinite Flight's answers per minute without any content (10 minutes); when Infinite Flight refuses our requests for all airlines we keep a flag with its start time (at most 2 hours) and send the Waypoint owner a Discord message without personal data. Legal basis: Art. 6(1)(b) GDPR (your membership), for the status also (f) (keeping the service running).

Infinite Flight Corporation is not certified under the Data Privacy Framework and has not agreed standard contractual clauses with us; insofar as this is a transfer to the USA, we rely on Art. 49(1)(b) GDPR, because it is necessary for the connection you chose or, for the sync, for the crew centre of the airline you are a member of. Legal basis: Art. 6(1)(b) GDPR (the connection you chose; your membership), for the sync and the feed also (f) (the airline's interest in running its LIVE organization together with its crew centre). You can disconnect Infinite Flight in your profile at any time; staff can switch off the feed and the sync or unlink the organization at any time, and the link is deleted with the airline.

7.4 Flights ready to submit

If you are an active member of an airline's crew centre and your Waypoint profile carries the same Infinite Flight username as your crew entry, Waypoint suggests your finished flights for that airline as flight reports that you submit with one click. Nothing is filed without your click. While you fly, our server recognises your flight in the live data it already fetches for the map (section 4.1) and keeps, for as long as the flight is on the map and at most two days, only its Infinite Flight flight id, your Infinite Flight user id and username, which accounts it could be suggested to, when it was first and last seen and whether it was in the air (in our database on the server, section 3). Once you have left the flight, our server reads your Infinite Flight logbook once and looks at that flight: departure and arrival airport, aircraft type, flight time, date, callsign and number of landings. Infinite Flight sometimes keeps a flight in the logbook under another id than the live one; to find it then, our server holds the flight's callsign, aircraft, livery, planned departure and last position in its working memory while the flight is on the map (not stored), and takes the one logbook entry with the same callsign, aircraft and livery that started while the flight was on the map and landed where it was last seen — if there is not exactly one, nothing is suggested.

A flight is suggested only when it matches one of your open bookings or roster legs in that airline, its callsign scheme or a route in its routes database; a flight shorter than 10 minutes, without a landing or without a departure or arrival airport, and every other flight, is not suggested, and nothing about it is kept. For a suggested flight we keep, until you act and at most 7 days, only ids and times: the Infinite Flight flight id, your Infinite Flight user id, your account, the airline, why it matched (and the id of the booking or roster leg) and when it ended and was suggested — not the flight's details. You get a notification (section 6), and the flight waits on your desk in the crew centre. Its details are read again from your logbook whenever they are shown and when you submit (held for up to 15 minutes, section 4.1). In the airline's Discord the bot's /pirep command shows you the same — your newest waiting flight, else your newest matching one — in a reply only you can see; it stores nothing beyond what is described here.

Submit stores the flight report in the airline's logbook exactly like one you file by hand — flight number, departure, arrival, aircraft, flight time, date, operator, the booking or roster leg it belongs to and, if the airline collects it, fuel — marked as submitted with one click, with a one-way fingerprint of the Infinite Flight flight id so the same flight isn't filed twice. The airline's usual checks then approve it or put it in its review queue; its staff see and can edit or reject it like any report, and it may be posted to the airline's Discord (7.1). Edit opens the normal form filled in; what you file there is stored like any report you file by hand, with the same fingerprint. Dismiss deletes the suggestion. Either way the suggestion is then deleted, and otherwise after 7 days.

The airline can switch suggestions off for all its pilots in the crew centre's admin area, and you can switch them off for yourself on your desk in the crew centre. Suggestions are deleted with your membership, with the airline and with your account at once; flights still being watched are deleted with your account at once and otherwise after two days at the latest. Reports you submitted stay in the airline's logbook like any other until your membership, the airline or your account is deleted. Legal basis: Art. 6(1)(b) GDPR (your membership in the airline) and (f) (the airline's and your interest in a complete logbook without typing every flight by hand). Reading your logbook sends Infinite Flight only your Infinite Flight user id, which it already knows.

7.5 Search in the crew centre

The crew centre has a search box for its tabs, settings, pilots, routes and help answers. The search runs in your browser on what the crew centre already shows you; the route list is loaded once from our server like in the Routes tab. Your browser remembers your last few picks per airline (section 4.4). When a search of three or more characters finds nothing, your browser sends us that search once, so we can learn which answers are still missing. We store only the search text — in lower case, trimmed and cut to 80 characters — and the language of the page, with how often and when it was first and last searched: not your account, not the airline, not your IP address. Searches that contain an "@" or five or more digits in a row are never stored. An entry is deleted 90 days after it was last searched, and the list keeps at most 1,000 entries; only Waypoint's site admins can see it. To guard against floods, the server counts all such requests per minute together, without telling them apart. Legal basis: Art. 6(1)(f) GDPR (our interest in a search that answers what crews ask).

8. E-mail

Waypoint sends e-mail only if you entered an address in a crew centre and confirmed it through the link in our mail (double opt-in; consent, Art. 6(1)(a) GDPR). There are newsletters of the respective airline and automatic notices (promotion, review of a flight report, inactivity warning, event reminder, badge, monthly recap, career events), each of which an airline switches on or off, and now and then a personal message an airline's staff write to you alone (at most 30 per airline and day). Every mail carries an unsubscribe link; newsletters and automatic notices also carry a one-click unsubscribe header, which mail programs such as Gmail show as an “Unsubscribe” button and which removes the address for that airline only. You can change or remove the address in the crew centre at any time and so withdraw your consent for the future. An address you give on an airline's application form receives only mail about that application — a confirmation that it arrived, the decision, and the welcome mail on acceptance, each of which the airline switches on or off (Art. 6(1)(b) GDPR); it is used for nothing else, and once the application is decided nothing more is sent to it.

Every mail names the sender in its footer (Waypoint, Julian Höke, Lörrach) with links to the Impressum and this policy. Delivery through Brevo SAS (Paris, France; servers in the EU). We log recipient, subject, time and delivery status of each mail for 90 days to spot delivery problems; a bounce removes the address automatically.

On airline websites a visitor can join a newsletter list. The address is added only after the click on the confirmation link; unconfirmed entries are deleted after 48 hours. The list belongs to the airline, which sends with its own tool and must use the unsubscribe link we hand it for every address. You can leave through that link, by writing to the airline or to us.

9. Pilot chat and position data

Signed-in pilots who are flying in Infinite Flight can chat with pilots within 150 nm and in a global channel. Stored: message, username, time and — for the radius — the position from the live picture, for one hour at most (radius) or the last 100 messages (global). A word filter automatically holds back messages with crude insults, hate or sexual solicitation; messages with ordinary swear words are delivered but flagged; links are not allowed (section 16). Held-back, flagged and reported messages are stored with text, username and account id in the moderation inbox of our staff console, where our moderators decide (no action, a timeout or a ban; section 11); a message nobody decides on is deleted from it after 30 days, a decided one about 30 minutes after the decision, while the decision itself stays in the staff action log. Discord Inc. (USA; Data Privacy Framework and standard contractual clauses, section 6) only receives a notice that something is waiting (the kind of item, how many are waiting and a link to the console, without name, account id or text); our bot deletes the notice 48 hours after posting. Legal basis: Art. 6(1)(b) GDPR (chat) and (f) (moderation, protecting users, many of them minors). The position never leaves our server: others see only message, name and time, and only signed-in users can read the nearby chat. Pilots you mute are stored as a list of up to 200 usernames on your account, so their messages stay hidden on all your devices and their mentions don't notify you; for this we also remember for up to 30 days which account your username belongs to. The list stays until you unmute someone or delete your account (Art. 6(1)(b) GDPR).

Names and bans: The name you chat under is reserved for your account for 12 hours. If you verified it by signing in with Infinite Flight, it stays reserved for you for up to 30 days after your last chat message. So nobody chats under a string of other pilots' names, we count an account's name changes for 12 hours; more than six new names in 12 hours are not possible. Bans and timeouts cover every login linked to your account and your pilot name, meaning the verified Infinite Flight username and the name used in the chat. For a ban we record which login ids and names it covered; it stays until it is lifted, a timeout until it ends. With a ban we also store its time, the staff member who banned and the reason the pilot was given. Legal basis: Art. 6(1)(f) GDPR (protection against abuse and against posing as other pilots).

10. Push notifications

Push notifications exist only if you allow them in the browser or the app. Stored: your browser's push address with its encryption keys (Web Push) or the device token (Apple, Google) and the topics you subscribed to — including topics carrying your Infinite Flight username (for example "when someone mentions me"). The registration expires 90 days after the last app launch. Delivery goes through your browser's push service or through Apple Inc. (APNs, USA) and Google LLC (Firebase Cloud Messaging, USA), which see the device token and the message. You can unsubscribe in the settings at any time; that deletes the registration. Google LLC participates in the EU-US Data Privacy Framework and additionally relies on standard contractual clauses for Firebase; according to Apple, Apple Inc. relies on standard contractual clauses for transfers from the EU. Which push service a browser uses is decided by its maker (for example Google for Chrome, Apple for Safari, Mozilla for Firefox). Where that provider is neither certified nor bound by standard contractual clauses, we rely on Art. 49(1)(b) GDPR, because the transfer is necessary for the delivery you asked for. The desktop app cannot receive push notifications and therefore checks for new alerts regularly; for this we keep the latest 15 alerts per topic (title and text) for 2 hours. Legal basis for push notifications: Art. 6(1)(b) GDPR (notifications you asked for).

Live Activity (iOS app): When you start a Live Activity, we store its Apple push token, the server, the chosen flight if any and your pilot name, and your account if you are signed in. The app also sends a random device key; we store only a hash of it with the token, so only your device can change or end the Live Activity. An entry not updated for 12 hours expires; the token for starting a Live Activity expires 60 days after the app was last opened. Both are delivered through Apple Inc. (APNs). Legal basis: Art. 6(1)(b) GDPR.

Airline widgets and the airline Live Activity (iOS and Android app): If you are a member of a virtual airline, the app can show your next flight, open seats, your airline in the air, your rank and its next event in widgets, and your booked flight as a Live Activity (a countdown from about 30 minutes before departure, the flight, and after landing your landing rate, credited time and PIREP state). For this the signed-in app receives a random link token; we store only a hash of it with your account id, for 180 days after its last use, at most five per account. For a running airline Live Activity we store its Apple push token, your account id, a hash of the device key, the booking or schedule id, the route, flight number, booked departure and the pilot name whose flight it shows, until it ends and at most 16 hours without an update; the token for starting it for your own booked flight, 60 days after the app was last opened; your next departure time for 10 minutes. "Follow this flight" shows a colleague's flight of the same airline once, only when you tap it, and is never started by itself. The landing rate is taken from the past hour and only shown, never stored. On Android the airline Live Activity is an ongoing notification: instead of Apple's push token we store the app's Firebase Cloud Messaging token (Google LLC) for the same time; without one, the app asks our server for the newest state every couple of minutes while the notification is up, and for that we keep the activity's last state (stage, times, route progress, altitude and speed, crew names as shown, credited time and PIREP state, never the landing rate) with the record, at most 2 hours after it ended. Signing out in the app or deleting your account deletes all of it. Delivery through Apple Inc. (APNs) or Google LLC (Firebase Cloud Messaging, see above). Legal basis: Art. 6(1)(b) GDPR.

11. Contrail, photos, Skydeck and Skydle

Contrail is a public photo feed. Profiles, posts, videos, comments, likes, stories and follows are visible to everyone; reports, blocks and bans are stored for moderation. A ban covers every login linked to the account and the verified Infinite Flight username; we record which ids and names it covered, and its reason. Before your first post you accept the rules and the terms of use. Reporters get an acknowledgement and the outcome; whoever's content is removed learns the reason in their notifications and can contest the decision. You can delete posts at any time. A new post sets off one line in a channel of our own Discord server saying that a new photo or video is there, with a link to the feed — no picture, no caption, no name and nothing about the flight, and in a way that stops Discord loading a preview of the linked page as well (Discord Inc., USA; section 6). Legal basis: Art. 6(1)(b) GDPR (providing the feed); for reports, blocks and bans (f) (protecting users and the platform). When videos are hidden provisionally after reports is explained in section 16.

Links in Contrail: On verified profiles, https links in captions and comments are clickable; everywhere else a link stays plain text. When a verified profile writes or edits a post with a link, our server fetches the linked page once (for YouTube: YouTube's public oEmbed interface) and stores the link, the page's title and site name in our database (Cloudflare D1, section 3) and a reduced copy of its preview image in Cloudflare R2, public storage (section 3). The linked website sees a request from our server — not from you and not from readers — and it carries no data about you. Your browser loads only our copy; the linked website is contacted only when you open the link, which always goes through a notice that shows the full address first. The entry belongs to the link, not to an account. It is deleted at the latest 12 months after it was last fetched; moderators remove a preview earlier on request, after which only the link's address remains as a marker so that it is not fetched again. Legal basis: Art. 6(1)(f) GDPR (showing where a link leads without passing readers' data to third parties).

Contrail photos on a VA's website: When you post, you can choose to wear the badge of a virtual airline you are an active member of. That VA's staff can then show the photo of such a post in the photo section of the VA's website (including a website under the VA's own domain), credited with your Contrail name; a VA can also name Contrail profiles — meant for its own — whose badge posts appear there automatically. Nothing is copied: the website reads the post when the page is opened, so if you edit the post, remove the badge or delete the post, it changes or disappears there as well. The composer says so where the badge is chosen. We store only the VA's selection (post numbers and the named profiles), deleted with the VA. Legal basis: Art. 6(1)(b) GDPR (the badge is a function you choose per post) and Art. 6(1)(f) GDPR (a VA presenting its members' published photos).

Verification request (the blue plane): If you ask for your Contrail profile to be verified, we store the profile's name (handle) and id, your Discord name and your name in the Infinite Flight Community where you give them, your note (up to 400 characters) and your account id as an entry in the moderation inbox (below), in our database on the server (Valkey, section 3). Team members from the moderator role upwards decide it; Discord Inc. only receives a notice that a request is waiting, without your details. If nobody decides it, the entry expires after 90 days; after the decision it is deleted about 30 minutes later. What then remains stored is only whether your profile is verified, and the decision in the staff action log (below). If you delete your account while the request is still open, its entry is deleted with it. We limit requests to three per hour and account. Legal basis: Art. 6(1)(b) GDPR (the review of your profile you asked for); for the review itself, (f) (genuine profiles).

Photos (aircraft and airport photos from Infinite Flight and real-world aircraft and airport photos) are reviewed by our team before publication. Stored: image, caption, your name as photographer (for the web form, the name you enter), the photo details, the capture date read from the image, the time you confirmed the image rights and — if you are signed in — your account. Our moderators review submissions in the moderation inbox of our staff console on the website (see "Moderation inbox" below). Discord Inc. (USA; Data Privacy Framework and standard contractual clauses, section 6) only receives a notice in a non-public channel of the Waypoint team that a new item is waiting — the kind of item, how many are waiting and a link to the console, without image, name, account reference or photo details; our bot deletes the notice 48 hours after posting, and for this we store only the ids of channel and message and the time. If a photo is declined or removed, you learn the reason as a notification on the website and — if your account is linked to Discord — as a direct message from our Discord bot; for real-world photos you also learn of the approval the same way. Likewise, new profile pictures and logos for the Skydle plane (shown at once) and images crew centres upload for their pages are listed with the image and the uploader's name in the moderation inbox, so we can remove pictures that break the rules. Declined or removed uploads are deleted from our storage with the decision, at the latest about 30 minutes after it. Review cards our bot posted to Discord before 16 September 2026 are deleted 48 hours after posting, or 48 hours after the decision where only the card could decide. Photos are removed on request at any time.

Photographer profile and credit name: If you create a photographer profile, we store name, location, website, cameras and a short bio and show them publicly with your photos; a name belongs to the first account that uses it. If you claim a credit name, we store that link to your account. If you want to change the credit name of photos you submitted through Discord, we store the request with old and new name, your Discord id and the number of photos for up to 30 days, and our moderators decide it in the moderation inbox; Discord only receives a notice without these details. We store the accepted name permanently with your Discord id, so it also applies to future submissions; the request and its inbox entry are deleted about 30 minutes after the decision. Legal basis for photos and profile: Art. 6(1)(b) GDPR (publication at your request); for review and moderation (f) (lawful and safe content).

Gate data (suggestions on /airports and on the map): with a suggestion we store the airport, stand, airline, your note, your user id, your display name and the time. Our editors and moderators review suggestions; nothing is applied automatically. Your name is not published. An accepted correction says "community correction", and one an editor made says "corrected by Waypoint editors" — no display name is in the map data either way. Only if you tick "Credit me publicly with my display name" on the suggestion form (off by default) does your name appear at that stand, and you can take that back at any time under Settings → Account, which removes it from the corrections themselves and stops any future one from carrying it; that switch is also how you object to this use under Art. 21 GDPR. Until 16 September 2026 the map named everyone who corrected a gate, editors included; those names were removed. Decided suggestions are kept for up to a year, at most the latest 600. When you delete your account or ask us to, your name is replaced by "Community". Legal basis: Art. 6(1)(f) GDPR (accurate gate data for everyone, and an internal record of who suggested a correction), and Art. 6(1)(a) GDPR — your consent — for the public credit.

Pre-departure declarations (pushback time, arrival time and take-off weight you enter as the pilot of a live flight at the gate): we store them with the flight, departure and destination airports, your Infinite Flight username and the time, and show them to everyone tracking the flight. With a declaration we also store a shortened hash of your account, made with a secret additional value, and whether your name is verified with Infinite Flight, so no other account can overwrite it; neither is shown publicly. Everything expires with the declaration after 30 hours. Legal basis: Art. 6(1)(b) GDPR, and (f) for the protection against overwriting.

Planned flights: If you plan a flight while signed in (departure and destination airport, times, aircraft, flight number), we store it with your Infinite Flight username and show it publicly on the departure and arrival boards of both airports: the time, the other airport, the aircraft, the flight number and your pilot name. Only you, signed in, can see the full list of your planned flights. A plan expires 6 hours after the planned arrival (without an arrival time, after departure), after 40 days at the latest; you can delete it earlier. Legal basis: Art. 6(1)(b) GDPR.

Community events: Signed-in pilots can create their own events (the "Events" page and the event pages below it); anyone can look at them. For an event we store in our database (Cloudflare D1, section 3) the title, the description, start and end, departure and destination airport including the individual legs, aircraft, flight number, planned block time, server, a participant cap, a repeat interval, optionally a flight plan (route, cruise altitude, fuel, time enroute, distance and up to 400 waypoints), a gate and load setup, plus the account id of the host and their co-hosts and the time; an event image the host uploads only appears once it has been reviewed in the moderation inbox (below). A new public event sets off one line in a channel of our own Discord server saying that an event was created, with a link to the events page — no title, route, server, time or host's name; that notice stays there until somebody deletes it by hand (Discord Inc., USA; Data Privacy Framework and standard contractual clauses, section 6). Private events are listed too, but joining goes through a request the host approves; we no longer hand out secret invite links. When you sign up, we store your account id, your Infinite Flight username, the time and whether you are on the roster or on the waiting list; the host sees open requests with the name. If the event assigns gates, your gate and your passenger and cargo figures are stored with it. On a public event the roster and the leaderboard are visible to everyone (Infinite Flight username, status, score, the aircraft flown, legs completed, gate and load); on a private event only participants, the host and our team see them. Whether you flew it we check after the event in your own Infinite Flight logbook (the first two pages, from the start until 6 hours after the end); we store only the result — status, score, aircraft, legs completed and the time — and a receipt of the logbook flight we matched, so the same flight cannot count twice. We do not store positions for this. From 30 minutes before the start until 30 minutes after the end we compare the participants' usernames with the general live picture to show who is "flying now"; the positions are only passed through, and only the status is stored. The event chat is a room of its own per event (Valkey, section 3): message, Infinite Flight username, account id and time, no position. The last 80 messages are kept; the room is deleted once nobody has written in it for 30 days — every new message restarts that period. Participants and the host may write; on a public event anyone can read along, even without an account, on a private one only the participants, the host and our team. The same word filter, the same ban on links, the same 5-second wait and the same bans and time-outs as in the pilot chat apply (section 9); a message the filter rejects is not stored. The host and our team can delete individual messages. While you are signed in the page also asks which running event you may currently write in; nothing is stored for that. The calendar file ("Add to calendar", .ics) is available without signing in for every event, including a private one: it contains the title, description, route, aircraft, server, times and the link, but no participants. Reminders (24 hours before, 1 hour before, at the start and as a recap) go out as push notifications to everyone signed up (section 10); for an event hosted by a virtual airline also by e-mail (section 8) and into that airline's Discord channel, if the airline switched that on. Retention: the event, the sign-ups, the gate assignments and the results have no expiry — they stay stored until the host or our team deletes the event. If you leave an event, we delete your sign-up together with your gate details; a result that was already verified stays in the database, but is no longer shown on the leaderboard. If you delete your account, we delete your sign-ups, gate details, results and chat messages — and the events you created yourself as well, together with their chat room, their legs and every other participant's sign-up and result. An event you created as a team member FOR an airline belongs to that airline and stays; its "created by" field then holds a stand-in instead of your id. Legal basis: Art. 6(1)(b) GDPR for creating, joining, the chat, the calendar file and the reminders, and Art. 6(1)(f) GDPR for the notice in Discord, the moderation of the chat and protection against abuse.

Skydeck compares the flight details you enter with Infinite Flight's live API and stores only the result (cards, levels, coins) and a checksum of the flight so it cannot count twice — no positions. Legal basis: Art. 6(1)(b) GDPR. Ready to log: when you open Skydeck, we look once at page 1 of your Infinite Flight logbook (the same read as logging a past flight by hand, kept for 15 minutes) and offer a finished flight that isn't in your deck yet, with one button. Nothing about the suggestion is stored; if you dismiss it, we keep only that flight's checksum for 14 days so it isn't offered again. Friend battles: you can challenge a pilot by their Infinite Flight name or with a link. The challenged pilot (with a link: whoever answers it first) sees your name and the categories, and after the battle your cards and the result. We keep a challenge, its answer and the result for 8 days; the result counts in the battle ranking like a live battle. When you delete your account, your challenges go with it. Legal basis: Art. 6(1)(b) GDPR.

Skydle keeps scores locally in your browser; leaderboards and duels run under your account or the random player id from 4.4. A logo you upload for your Skydle plane is shown publicly. Waypoints, Skydle's in-game currency, are only earned in the game; they cannot be bought with money. What you buy in the Skydle shop is stored with your account, as are the last 100 bookings of your balance. In duels, parties and battle royales the other players see your name, flag, aircraft and the emotes you play (we keep emotes for 1 minute, the rooms for 3 hours). Lobby chat: before a party starts, the pilots in the room can write short messages (up to 140 characters) to each other; the others in the room see your name, text and time. We keep the last 40 messages with the room for 3 hours; the chat is not shown during the game. The same word filter as in the pilot chat applies (section 16), and every player can report a message; a reported or flagged message goes to our moderation inbox with your name, account or player id and the text (section 11). Legal basis: Art. 6(1)(b) GDPR (chat) and (f) (moderation, protecting users, many of them minors). Watching: running duels, parties and battle royales can be followed 15 seconds behind, with the players' names, flags, guesses and points. Public games are listed on the watch page for everyone, private rooms can be watched by anyone with the link, and your friends see in their friends list that you are playing and can watch; for this we note for 3 hours which game you are in. Legal basis: Art. 6(1)(b) GDPR. Async duels and challenge links: in an async duel the pilots play the same airports at different times; the others in the game see your name and, once they have played themselves, your points per round and the result; open games are listed for every signed-in pilot with the names of the players already in them. A challenge link turns one of your finished games into a link: everyone who opens it sees your name, and after playing it the leaderboard with the names and totals of everyone who played it. We keep both for 30 days. When you delete your account your challenge links go with their leaderboards, your runs leave other pilots' leaderboards, and in an async duel with other players your seat only stays as "Deleted pilot". Legal basis: Art. 6(1)(b) GDPR. If you found or join a Skydle club, the club page and member list show your name, flag, role, join date and club XP publicly; when you delete your account you leave the club (an owner's club passes to another member, the last member's club is deleted). Once a day our bot posts one line in a channel of our own Discord server saying that the daily puzzle is live, with a link — no picture, no answer and no players' names (Discord Inc., USA; section 6). Legal basis: Art. 6(1)(b) GDPR; for the review of logos and reported maps (f).

Seasonal events: during a seasonal event we note whether an account used the live map in the event's period, and keep which of the extras for the map earned this way you chose to show; we use this only for event badges and extras. Without an account the note stays in your browser instead (a short signed marker in localStorage, section 4.4); if you sign in later, it is moved to your account. We keep it with your account until you delete the account. Legal basis: Art. 6(1)(b) GDPR.

Daily activity streak: when you open a Waypoint page while signed in, your browser tells us its local date once a day, and we count how many days in a row your account opened Waypoint. We do not keep a list of those days: only the current and the best count and the last day that counted. If you miss a day and have a Skydle streak freeze, one is used automatically; we note how many freezes were used and, for the last 14 days, which days they saved. We also note the milestones reached (7, 30, 100 and 365 days) and the last one we congratulated you for. Your browser remembers the date it last reported (wp_streak_day, section 4.4) so it reports only once a day. The count and the milestone badges can be shown on your profile; a milestone image opens only with the link you share. We keep it until you delete your account. Legal basis: Art. 6(1)(b) GDPR.

Airport Passport: For your passport we store the name to be printed on it and the issuing airport; the stamps are worked out from your Skydeck flights and approved flight reports. Legal basis: Art. 6(1)(b) GDPR.

Content reports (Report button and report page, Art. 16 DSA): we store the kind and address of the reported content, where applicable an internal reference (such as a chat message id), the reason, your explanation, your good-faith confirmation, the time and — only if you give it — your e-mail address; when you are signed in, also your account and display name. Your IP address is only counted as a shortened, keyed hash for at most one hour to limit abuse. At Waypoint, only the operator (owner role) sees and processes reports, in the staff console; other team members see neither the reports nor the explanation, name or e-mail address. An internal Discord channel of the team only receives a notice that a report is waiting — the kind of item, how many are waiting and a link to the console, without the report number, the reported content or anything about you (Discord Inc., USA; Data Privacy Framework and standard contractual clauses); our bot deletes the notice there automatically 48 hours after posting. A report of child sexual abuse or exploitation is handled differently from every other report, and by a machine before it reaches a person: the moment it arrives, the reported content is switched off automatically — the stored file is moved out of public reach and the entry is hidden — and nobody at Waypoint opens, downloads, copies or forwards it, neither our team nor the operator. The operator is told at once, by Discord direct message and by e-mail (sent through Brevo, section 8, to our mailbox at Google, see "Enquiries by e-mail" in section 1), that a report with that number and that kind of content exists — without the address, without your explanation, name or e-mail address, and without any preview. The address is not shown in the staff console either. We report the case to the Bundeskriminalamt through its reporting portal (u-entrance.bka.de); the assessment is theirs, not ours, and we delete the file afterwards. We do not pass such a report to NCMEC, to the British National Crime Agency, to jugendschutz.net, to eco/FSM or to Discord. Whoever posted the content receives a statement of reasons (Art. 17 DSA) that names the category, says the block was automatic and explains how to object; if the report turns out to be wrong, the content comes back and we say so. Once such a report is decided, we delete your explanation and automatically keep only a process record: number, kind and address of the content, decision, reason, actions taken (such as removal or a ban), who decided and the times. We do not store the reported material itself, not even as a copy, and we keep no "evidence copy" of it. You get a confirmation and later the outcome in your notifications or by e-mail (Brevo, section 8). Anyone affected by a decision receives a statement of reasons with the way to object. Reports and decisions are kept for 400 days so objections within six months can be answered; if you delete your account, the link to you is removed. Legal basis: Art. 6(1)(c) GDPR with Art. 16 and 17 DSA, and Art. 6(1)(f) GDPR (a safe platform).

Reports about events: The Report button on an event page leads into content reports (the paragraph above). Alongside it there is a simple way to put an event before the team directly while signed in. It stores the event's id and title, your reason text (up to 500 characters), your account id and your Infinite Flight username as an entry in the moderation inbox (below), in our database on the server (Valkey, section 3). Team members from the admin role upwards decide it, because only they hold the host tools of every event. Discord Inc. only receives a notice that a report is waiting — without your name, your id and your text. So the same report does not arrive twice, we remember for one hour that you reported this event; on top of that, at most ten reports per hour and account are possible (section 2). If nobody decides it, the entry expires after 90 days; after the decision it is deleted about 30 minutes later, while the decision itself stays in the staff action log (below). If you delete your account while the report is still open, your id and your name are removed from the entry; the report itself stays until it is decided, at the longest until it expires after 90 days, because it is about someone else's event. Legal basis: Art. 6(1)(f) GDPR (a safe platform and events that follow the rules).

Moderation inbox: Our team decides every moderation matter on our website, in a non-public staff console: photo submissions, images crew centres upload, requests to register an airline, credit name changes, Contrail verification requests, chat messages that were held back, flagged or reported, new profile pictures and Skydle logos, notes sent with the Discord command /report and reports of events. For each item we store what the decision needs (for example the image or where it is stored, the text, the name and account id of the person concerned) and, while someone works on it, which team member is handling it and since when (15 minutes). Discord Inc. (USA; Data Privacy Framework and standard contractual clauses) only receives a notice in one internal channel of the team that something is waiting: the kind of item, how many are waiting and a link to the console — never names, account or Discord ids, images or texts. There is at most one notice per kind every five minutes, and our bot deletes it 48 hours after posting. Team members can turn on push notifications for new items on their own devices; these carry the same notice. Once an item is decided, its details are deleted about 30 minutes later, and rejected uploads (for example a declined image waiting in private storage) are deleted with the decision, at the latest about 30 minutes after it. Items nobody decides on leave the inbox after 30 days (chat messages, profile pictures, Skydle logos, credit name changes) or 90 days (Contrail verification requests, /report notes, event reports); uploads and airline registrations waiting for approval stay until they are decided, and the entry for an image an airline published without review stays 7 days. The request to register an airline itself (the airline's name and code, the IFC username, the IFVARB link, the note, display name and account id) is kept until it is decided; a declined and an approved request alike are deleted 30 days after the decision. The data of an airline created this way follows sections 7 and 12. What such a request contains in detail is set out in section 7; what a Contrail verification request and a report about an event contain, in the paragraphs above. The decision itself — who decided, when, what and why — is kept in the staff action log (12 months, below); decisions on reports are kept for 400 days (see "Content reports"). Legal basis: Art. 6(1)(f) GDPR (lawful and safe content, protecting users) and, for statements of reasons, Art. 6(1)(c) GDPR with Art. 17 DSA.

Staff action log: When a member of our team takes a moderation or administrative action — for example removing or approving content, suspending or deleting an airline, banning someone from the chat, deciding a report or adjusting Skydeck coins — we record who acted, when, through which channel (the website, the Discord bot or an automated job), what was done and to which content or account, with brief facts such as the rule applied or a short excerpt. This serves accountability and the documentation of moderation decisions (Art. 5(2) GDPR, Art. 17 DSA). Entries about decisions on reports are visible to the operator only. The log is kept in Cloudflare D1 (section 3); if D1 cannot be reached, an entry is stored instead in our database on the server (at most the latest 500). Legal basis: Art. 6(1)(c) and (f) GDPR. Entries are deleted automatically in both stores after 12 months. They contain the account id and the name at the time of the staff member who acted and stay unchanged even if that staff member or the person concerned deletes their account, so decisions remain traceable.

Bug reports from support tickets: When a Waypoint team member hands a support ticket to the developer with the Discord command /fix, the bot copies the ticket's recent messages (up to 40, with author names) into a private Discord message to the developer (Discord Inc., USA; Data Privacy Framework and standard contractual clauses), so the reported error can be reproduced and fixed. Waypoint does not store this transcript in its own databases; it keeps only the ID of that Discord message and when it was sent, and deletes the message from Discord 30 days after sending. Legal basis: our legitimate interest in fixing reported errors (Art. 6(1)(f) GDPR).

12. Airline websites we host

Airlines can run a public website with us. The airline is responsible for its content. Section 2 applies to visits. In addition:

• Contact form: name, e-mail address and message are stored for the airline and — if the airline set it up — forwarded to its Discord server (Discord Inc., USA; Data Privacy Framework and standard contractual clauses). We keep at most the latest 200 messages per airline. Legal basis: Art. 6(1)(f) GDPR (passing your message to the airline, which you initiate yourself).
• Visitor counter: we count views per day and page without IP address, cookie or individual profile; daily figures are deleted after 120 days (Art. 6(1)(f) GDPR, reach of the website for the airline).
• Embeds: if an airline embeds a YouTube video, its latest YouTube videos (youtube-nocookie.com or youtube.com, Google Ireland Limited) or the Discord server widget (Discord Inc., USA), we first show only a placeholder. Only when you click "Load" there does your browser contact Google or Discord, transmitting your IP address (legal basis: your consent, Art. 6(1)(a) GDPR, § 25(1) TDDDG). Google also processes the data in the USA; Google LLC and Discord Inc. participate in the EU-US Data Privacy Framework and additionally rely on standard contractual clauses (section 6). Your browser remembers the choice per provider for the current session (see 4.4); once you close the tab, you are asked again on your next visit.
• Images from other servers: if an airline links an image in pages, news or texts that is not stored with us, we first show only a button naming that server. Only after your click does your browser load the image; the operator of that server then receives your IP address, browser details and the page address (legal basis: consent, Art. 6(1)(a) GDPR, § 25(1) TDDDG). If that server is in a country outside the EU without an adequacy decision, the transfer rests on your explicit consent (Art. 49(1)(a) GDPR); a comparable level of data protection may not exist there, and authorities could access the data.

Map on photo pages: the location map on a photo page comes from OpenStreetMap (OpenStreetMap Foundation, United Kingdom; the UK is covered by an EU adequacy decision). It loads only after you click "Load map from OpenStreetMap", which sends your IP address and browser details to OpenStreetMap (legal basis: consent, Art. 6(1)(a) GDPR, § 25(1) TDDDG).

13. Widgets and apps

For the home-screen widget you may share your location ("Use my location"). The coordinates are then stored with the widget key to show aircraft near you and deleted 120 days after the last use. Alternatively you enter an airport code. Legal basis: Art. 6(1)(b) GDPR (a widget you set up).

The iOS and Android apps show the same website. They ask for permissions only for the function at hand: camera and motion sensors for the AR sky view (images are neither stored nor transmitted), location for AR and the widget, notifications for push, local network for the connection to Infinite Flight on your own device. You can revoke permissions at any time in your device settings. Legal basis: Art. 6(1)(b) GDPR (a function you use).

Tools for pilots, controllers and streamers:

• Shared cockpit in the EFB: anyone who joins with a crew code appears with the name they enter (24 characters at most) and their role; the session with the ticked checklist items expires 6 hours after the last change.
• Coordination in the ATC mode: we store the names of the participating controllers, their chosen position, entries on aircraft, short messages, point-outs and runway configuration, and a hash of the session password; the session expires after 12 hours.
• ATC Academy: scenarios you create while signed in (texts, questions, positions), up to 100 per account, until you delete them or your account.
• Stream overlay: if you enter a YouTube channel, our server asks Google (YouTube Data API; Google LLC, USA; Data Privacy Framework and standard contractual clauses) for the running stream and its live chat. We keep the latest 30 chat messages (viewers' display name and text) for 2 minutes for the overlay, and the channel lookup for 24 hours.
• Center notices: when a controller opens a Center frequency in Infinite Flight, our server sends an internal Discord channel of our team nothing but the line that a Center came online, with a link to the map — their username, the airspace and the time have not gone there since 16 September 2026.

Legal basis: Art. 6(1)(b) GDPR (a function you use); for the viewers' chat messages and the Center notices (f) (showing the chat for the streamer, accurate airspace display).

14. Donations

Donations run through Ko-fi (Ko-fi Labs Ltd., United Kingdom; the UK is covered by an EU adequacy decision) on their website. Ko-fi tells us the display name, amount and message of a donation; none of it is passed on to our own Discord server (Discord Inc., USA; Data Privacy Framework and standard contractual clauses), which gets nothing but the line that somebody supported Waypoint. We do not store your details; only the donation's id is kept for 24 hours so the same notice does not appear twice. Who gave what, the operator reads in his own Ko-fi account. Legal basis: Art. 6(1)(f) GDPR (thanking supporters in our community). Ko-fi is responsible for the payment itself; for its own transfers outside the United Kingdom and the EEA, Ko-fi names standard contractual clauses.

15. Data sources

For schedules, airports, weather and route networks our server queries further services without transmitting anything about you: AeroDataBox (via RapidAPI), adsb.lol (ADS-B data, ODbL), OpenSky Network (aircraft register, CC-BY 4.0), OpenFreeMap, EOX IT Services GmbH (Austria, EU) and Amazon Web Services (map tiles, satellite imagery and terrain, 4.2), the surveying and mapping authorities of the German states, swisstopo, basemap.at, IGN (France), PDOK, IGN España, ČÚZK, ACT Luxembourg, NGI Belgium, DGT Portugal, the Estonian Land and Spatial Development Board, GKÚ Bratislava, GURS Slovenia, the U.S. Geological Survey and GSI Japan (aerial imagery, 4.2), Deutscher Wetterdienst, EUMETSAT, NOAA/National Weather Service, Environment and Climate Change Canada and NOAA/NESDIS Enterprise Rain Rate through NOAA Open Data Dissemination (AWS) (weather radar, 4.2), VAT-Spy (airspace boundaries), aviationweather.gov and NOAA, FAA, Bureau of Transportation Statistics, OpenStreetMap (Overpass), X-Plane Scenery Gateway, OurAirports and the Infinite Flight forum. All sources and their licences are listed under Credits & data sources.

Real-world flight data: the ADS-B data from adsb.lol contains the identifier (hex code), callsign, registration, type, position, altitude, speed and transponder code of real aircraft; for privately operated aircraft this can be personal data. ADS-B is an unencrypted radio broadcast that anyone with a receiver can hear. Only the aircraft's own broadcast: since 16 September 2026 we keep a record only when adsb.lol marks it as ADS-B or ADS-R; positions worked out by multilateration (MLAT), TIS-B rebroadcasts, ADS-C and Mode S or Mode A-only tracks are dropped at intake, before the map, the panel, the widget, the traces or our collections see them. From the record we also no longer read cockpit values — indicated airspeed, Mach, selected altitude, altimeter setting and the broadcast wind and temperature; wind and temperature in the panel come from the GFS weather model at the aircraft's position. What we do with it: we show it live on the map, in the aircraft panel, in the "nearest aircraft" widget and — where a virtual airline switches that on — as a live badge on its routes; on the photo page we ask, for one registration, whether that airframe is airborne right now. We also build two collections without positions from it: observed stand use per airport (120 days) and route observations per callsign behind the Route Builder. For an aircraft on screen we fetch model, serial number, year of build and operator from AeroDataBox; those details sit in our database for 7 days and are then fetched again. Alerts: since 16 September 2026, take-off and landing alerts for one individual real aircraft exist only for identifiably commercial flights — that is, where the callsign is a known airline designator followed by a flight number. For privately operated aircraft we do not send them and they cannot be subscribed to; the server checks this when a device registers and again before anything is sent. History: for a replay feature we record the world picture every 10 seconds on our server; that recording is deleted after 7 days and only our team can reach it. The history of an individual aircraft — its earlier flights and their tracks — has also, since 16 September 2026, been reachable only by our team, and every such look is written to the staff log (section 11). What stays public is the track of the flight in progress, which is the live picture. In memory we hold the last 20 minutes of trail. From the OpenSky aircraft register we keep owner and operator names in our private storage to assign flights to the right airline; the file is replaced with every update. Legal basis: Art. 6(1)(f) GDPR (showing publicly broadcast flight data). You can object (section 16) — and for an aircraft you can do so without giving a reason, see immediately below.

Asking us not to identify an aircraft (suppression list): whoever owns, operates or flies an aircraft can ask us to stop naming it. An e-mail to the address in section 1 with the registration and, if you know it, the hex code is enough; the address is also on the Credits & data sources page. We ask for no proof — the worst an unfounded request can do is leave one aeroplane fewer with a name on it. From then on the aircraft appears on the map only as an anonymous dot: position, heading, altitude and speed remain, but there is no registration, no callsign, no operator, no aircraft type, no photos, no trail, no history and no alerts; the id we carry it under becomes a random token instead of the hex code, and we stop asking adsb.lol, AeroDataBox or OpenSky anything about it. Our own recording (above) skips it too. What we store for this: the hex code and/or the registration, the date and a short internal note — in a list that is part of our software; we do not publish the list itself. Legal basis: Art. 6(1)(f) GDPR (protecting the person concerned) and, where the request is an objection under Art. 21 GDPR, Art. 6(1)(c) GDPR. You need no account, and you can undo it the same way. Take-off and landing alerts are restricted to commercial flights anyway, independently of this list (above).

16. Your rights

You have these rights towards us:

• access to the data stored about you and a copy of it (Art. 15 GDPR);
• rectification of inaccurate and completion of incomplete data (Art. 16);
• erasure (Art. 17), unless a duty or an overriding reason to keep the data applies;
• restriction of processing (Art. 18);
• notification of a rectification, erasure or restriction to recipients, and information about those recipients (Art. 19);
• data portability (Art. 20);
• objection (Art. 21, see below);
• withdrawal of consent at any time with effect for the future (Art. 7(3)); processing up to then remains lawful;
• not to be subject to a decision based solely on automated processing (Art. 22, see below);
• complaint to a supervisory authority (Art. 77, see below).

Right to object (Art. 21 GDPR): Where we process data on the basis of Art. 6(1)(f) GDPR, you can object at any time on grounds relating to your particular situation. We then stop processing the data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims. We do no direct marketing.

How to exercise your rights: Write to the e-mail address in section 1. You can also do a lot yourself: under Settings → Account you download all data about your account as a file (access, data portability) and delete your account (section 6); you change profile details in the settings; you unsubscribe from e-mail with the link in each mail or in the crew centre (section 8); you switch off push notifications in the settings and app permissions in your device settings, and a permission for embeds ends when you close the tab. This is free of charge. We answer within one month; if a request is particularly complex, the period can be extended by up to two months, and we tell you so (Art. 12(3) GDPR). If we have reasonable doubts that a request comes from you, we may ask for confirmation, for example from the account concerned. For data a virtual airline manages in its crew centre, you can also contact the airline.

Complaint to a supervisory authority: You can complain to any data protection supervisory authority, in particular in the EU member state where you live or work or where the alleged infringement took place (Art. 77 GDPR). The authority competent for us is the Landesbeauftragter für den Datenschutz und die Informationsfreiheit Baden-Württemberg (the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg), Lautenschlagerstraße 20, 70173 Stuttgart, Germany (postal address: Postfach 10 29 32, 70025 Stuttgart), phone +49 711 615541-0, e-mail [email protected], website www.baden-wuerttemberg.datenschutz.de.

No automated decisions: We make no decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR). Some protective measures run automatically; they are provisional or purely technical, and people review them:

• Word filter: in the pilot chat, messages with crude insults, hate or sexual solicitation are not delivered and are forwarded for review to the moderation channel (section 9); messages with ordinary swear words are delivered and also reported there; messages with links are rejected. In crew-centre chats, messages of the first group and links to outside sites are rejected. Only people impose timeouts and bans.
• Contrail: a video is hidden provisionally as soon as two trusted accounts have reported it — accounts that accepted the Contrail rules, are not banned, have a Contrail profile at least 7 days old and are not the author. The author immediately receives a statement of reasons saying the measure was automatic; our team reviews the video, usually within 24 hours, and restores it if it breaks no rule. Each account can file at most 20 reports a day.
• Skydle maps: a published map is hidden as soon as three different signed-in accounts have reported it, until our team has reviewed it; if the team restores it, those reports do not count again. Each account can report at most 20 maps a day.
• Skydle clubs: reported clubs (name, tag, description) are reviewed by hand by our team and deleted if they break the rules; we store which account reported.
• Skydle lobby chat: messages with links, crude insults, hate or sexual solicitation are not delivered, and those of the second group are forwarded for review to the moderation inbox; messages with ordinary swear words are delivered and also forwarded there. Players can report a message; each player can report each message once and file at most 10 reports in 10 minutes.
• Limits: limits per minute, hour or day for messages, reports, uploads and name changes prevent abuse; whoever reaches a limit can try again later.

You can object to any moderation decision (section 11 and the terms of use).

Obligation to provide data: You are under no legal or contractual obligation to give us data. You can use the map without an account; functions with an account need the details named for them, and without them the function is not available.

17. Changes

This policy is updated whenever services or features change. The version published on this page applies; the date is at the top.

The terms of use apply, and for airline websites the hosting rules. Provider identification in the Impressum.