Waypoint is a free, unofficial live map and flight tracker for the flight simulator Infinite Flight. It shows every live flight in real time, active ATC, airport ground layouts with gates, 3D views and flight replays.

Which Infinite Flight servers does Waypoint show?

All of them — Expert, Training and Casual. You can switch servers at any time at the top of the map.

Yes. Waypoint is completely free, with no ads and no account required.

Can I track a specific pilot or flight?

Yes — search any callsign or pilot username, follow the flight live (also in 3D), share a link to it, and get optional push notifications when a pilot comes online or takes off.

← Back to the map

Privacy policy

As of 11 September 2026 · English translation for convenience — the German version is the binding one.

Waypoint (waypoint-live.app, the iOS and Android apps, and the virtual-airline websites we host) is a private, non-commercial project around the flight simulator Infinite Flight. This policy explains which data is processed, why, for how long and who receives it.

1. Controller

Julian Höke
Lingertstraße 6b, 79541 Lörrach, Germany
E-mail: [email protected]

No data protection officer is appointed, as none is required by law. Mail to the address above is received and stored at Google (Gmail).

2. Hosting, delivery and server logs

The application runs on a server rented from Hetzner Online GmbH (Gunzenhausen, Germany) in a data centre in Germany. In front of it sits the network of Cloudflare, Inc. (San Francisco, USA) as content delivery network, DNS and protection against attacks. Every request passes through Cloudflare, which technically processes IP address, time, requested address and browser identification. Cloudflare is certified under the EU-US Data Privacy Framework; the EU standard contractual clauses apply in addition.

Our own application does not write IP addresses to databases or logs. To fend off abuse (submissions, contact forms, reports, counting photo views) a shortened hash of the IP address is kept briefly — six hours at most — as a counter; the address itself is not stored. Legal basis: Art. 6(1)(f) GDPR (secure, stable operation).

3. Databases and storage

Valkey (Redis-compatible) on the same server in Germany: accounts, settings, memberships in virtual airlines, chat messages, push registrations, content of the airlines' websites.
Cloudflare D1 (Cloudflare, Inc., USA): crew-centre activity (flight reports, points, career, applications, bookings), Contrail, photo submissions, Skydeck, e-mail delivery logs.
Cloudflare R2 (Cloudflare, Inc., USA): uploaded images and videos (profile pictures, photos, Contrail posts, media of the airlines' websites) and daily backups of the Valkey database.

Section 2 applies to Cloudflare. Backups are replaced regularly by newer ones and contain only what was stored at that moment; deleted data disappears from them with the next backup round.

4. Use without an account

4.1 Live map and Infinite Flight data

The map shows flights and controllers from the public live API of Infinite Flight (Flying Development Studio LLC, USA). Our server fetches this data; your IP address is not passed on to Infinite Flight. Live data is not stored, only held in a cache for a few seconds.

4.2 Map tiles and weather layers

Map tiles, satellite imagery, terrain, rain radar, fonts and the map style are all served by our own server. Your browser never contacts the data providers; our server fetches the tiles from OpenFreeMap, CARTO, Esri, Amazon Web Services and RainViewer without passing anything about you. No personal data arises.

4.3 "Most tracked"

So the map can show which flight is followed most, your browser creates a random id in sessionStorage (gone with the tab) and reports it every 70 seconds together with the selected flight. Not linked to you.

4.4 Local storage in the browser

Settings, favourites, friend lists, fleet lists, profile details, your SimBrief username, EFB data and Skydle scores live in your browser's localStorage and only go where this policy says. For Skydle duels and parties a random player id is created and sent to our server so the other players recognise you within the round; it is not linked to you as a person.

4.5 Profile pictures

Profile pictures pilots have released from their Discord or Google account are served by our server; your browser does not contact Discord or Google for them.

4.6 SimBrief

When you generate a flight plan through SimBrief in the planner, your browser sends your SimBrief username and the plan data directly to SimBrief (Navigraph, Sweden). Only on your click.

5. Cookies

We set no cookies for analytics or advertising and use no analytics services. These cookies are technically necessary for the functions you ask for (§ 25(2) no. 2 TDDDG):

__Secure-waypoint.session — your sign-in, 30 days, only with an account. During sign-in the authentication library sets short-lived cookies against attacks (csrf-token, state, pkce, callback-url).
wp_locale, wp_site_lang — your chosen language, 1 year, only after you use the language switch.
ctr_pid — which of your Contrail profiles is active, 1 year, only with an account.
wp_pgpw_… — remembers that you entered a protected airline page's password, 30 days. wp_sprev_… — preview of an unpublished airline website, 7 days. if_oauth_pkce — protection during sign-in with Infinite Flight, 10 minutes.

6. Account

An account is optional. You sign in with Discord (Discord Inc., USA), Google (Google Ireland Limited), Apple (Apple Distribution International Ltd., Ireland) or Infinite Flight (Flying Development Studio LLC, USA); your browser is redirected to that provider, which sees your IP address. We request identity only (Discord: "identify"; Google: "openid profile"; Infinite Flight: "openid profile") — no e-mail address, no friend lists, no servers. If Apple passes an e-mail address, we do not store it.

Stored: an internal id, your user id at the provider, your display name, the profile picture (a reference, or a picture you uploaded), your Infinite Flight username, your settings. Legal basis: Art. 6(1)(b) GDPR (providing the account). Your profile picture is shown to others only if you enable it in the settings.

Minimum age: Waypoint is for people aged 16 and over. Younger pilots may create an account only with a parent's or guardian's consent.

Take it with you: Under Settings → Account you can download everything we hold about your account as a JSON file (Art. 20 GDPR): account, memberships and every database row in your name.

Delete: Under Settings → Account you can delete your account yourself at any time. That removes the account, profile, profile picture, your Contrail profiles with posts, comments and media, your crew-centre memberships including e-mail address, points, career, applications, bookings, Skydeck progress, photo submissions, the Skydle plane and the push subscriptions in your name. Your flight reports remain as anonymised rows without name or remarks in the airline's statistics. If you own an airline, transfer or delete it first. Posts already published in an airline's Discord channels live with Discord and that airline.

7. Crew centres of virtual airlines

Virtual airlines (VAs) run a crew centre with us. When you join one, its staff see your username, callsign, flight reports, hours, points, badges, bookings and — if you provide them — your e-mail address and Discord link. Applications store the answers to the questions the airline asks. Which questions an airline asks and how it uses your data inside the airline is the airline's decision; Waypoint provides the technology and stores the data on the airline's behalf. Legal basis: Art. 6(1)(b) GDPR (membership).

Data is kept as long as your membership lasts; when you leave the airline or it is deleted, it is removed. You can export your own airline data from the crew centre at any time.

7.1 Discord link

Airlines can connect their Discord server to Waypoint. Events (new flight reports, promotions, group flights, applications, reports) are then sent as messages to Discord Inc. (USA), each with your username and the content the event concerns. If you link your Discord account to your roster entry, your Discord id is stored so slash commands recognise you.

7.2 Crew-centre chats

An airline's channels are visible to its members only. Messages are stored with username and time until the airline or the author deletes them. Mentions can be delivered as push notifications (section 10).

8. E-mail

Waypoint sends e-mail only if you entered an address in a crew centre and confirmed it through the link in our mail (double opt-in; consent, Art. 6(1)(a) GDPR). There are newsletters of the respective airline and automatic notices (promotion, review of a flight report, inactivity warning, event reminder, badge, monthly recap, career events), each of which an airline switches on or off. Every mail carries an unsubscribe link; you can change or remove the address in the crew centre at any time and so withdraw your consent for the future.

Every mail names the sender in its footer (Waypoint, Julian Höke, Lörrach) with links to the Impressum and this policy. Delivery through Brevo SAS (Paris, France; servers in the EU). We log recipient, subject, time and delivery status of each mail for 90 days to spot delivery problems; a bounce removes the address automatically.

On airline websites a visitor can join a newsletter list. The address is added only after the click on the confirmation link; unconfirmed entries are deleted after 48 hours. The list belongs to the airline, which sends with its own tool and must use the unsubscribe link we hand it for every address. You can leave through that link, by writing to the airline or to us.

9. Pilot chat and position data

Signed-in pilots who are flying in Infinite Flight can chat with pilots within 150 nm and in a global channel. Stored: message, username, time and — for the radius — the position from the live picture, for one hour at most (radius) or the last 100 messages (global). A word filter blocks crude violations automatically; reported or flagged messages are forwarded with text, username and account id to a non-public moderation channel at Discord Inc. (USA) so moderators can act. Legal basis: Art. 6(1)(b) GDPR (chat) and (f) (moderation, protecting users, many of them minors).

10. Push notifications

Push notifications exist only if you allow them in the browser or the app. Stored: your browser's push address with its encryption keys (Web Push) or the device token (Apple, Google) and the topics you subscribed to — including topics carrying your Infinite Flight username (for example "when someone mentions me"). The registration expires 90 days after the last app launch. Delivery goes through your browser's push service or through Apple Inc. (APNs, USA) and Google LLC (Firebase Cloud Messaging, USA), which see the device token and the message. You can unsubscribe in the settings at any time; that deletes the registration.

11. Contrail, photos, Skydeck and Skydle

Contrail is a public photo feed. Profiles, posts, videos, comments, likes, stories and follows are visible to everyone; reports, blocks and bans are stored for moderation. Before your first post you accept the rules and the terms of use. Reporters get an acknowledgement and the outcome; whoever's content is removed learns the reason in their notifications and can contest the decision. You can delete posts at any time.

Photos (aircraft and airport photos) are reviewed by us before publication. Stored: image, caption, your name as photographer and the capture date read from the image. Photos are removed on request at any time.

Skydeck compares the flight details you enter with Infinite Flight's live API and stores only the result (cards, levels, coins) and a checksum of the flight so it cannot count twice — no positions.

Skydle keeps scores locally in your browser; leaderboards and duels run under your account or the random player id from 4.4. A logo you upload for your Skydle plane is shown publicly.

12. Airline websites we host

Airlines can run a public website with us. The airline is responsible for its content. Section 2 applies to visits. In addition:

Contact form: name, e-mail address and message are stored for the airline and — if the airline set it up — forwarded to its Discord server (Discord Inc., USA).
Visitor counter: we count views per day and page without IP address, cookie or individual profile; daily figures are deleted after 120 days.
Embeds: if an airline embeds a YouTube video (youtube-nocookie.com, Google Ireland Limited) or the Discord server widget (Discord Inc., USA), your browser contacts Google or Discord when loading them — only after you click "load" — and transmits your IP address.

13. Widgets and apps

For the home-screen widget you may share your location ("Use my location"). The coordinates are then stored with the widget key to show aircraft near you and deleted 120 days after the last use. Alternatively you enter an airport code.

The iOS and Android apps show the same website. They ask for permissions only for the function at hand: camera and motion sensors for the AR sky view (images are neither stored nor transmitted), location for AR and the widget, notifications for push, local network for the connection to Infinite Flight on your own device.

14. Donations

Donations run through Ko-fi (Ko-fi Labs Ltd., United Kingdom) on their website. Ko-fi tells us the display name, amount and message of a donation; we show these in our Discord server and do not store them.

15. Data sources without personal data

For schedules, airports, weather and route networks our server queries further services without transmitting anything about you: AeroDataBox (via RapidAPI), AirLabs, adsb.lol (ADS-B data, ODbL), OpenSky Network (aircraft register, CC-BY 4.0), OpenFreeMap, CARTO, Esri, Amazon Web Services and RainViewer (map tiles, 4.2), VAT-Spy (airspace boundaries), aviationweather.gov and NOAA, FAA, Bureau of Transportation Statistics, OpenStreetMap (Overpass), X-Plane Scenery Gateway, OurAirports and the Infinite Flight forum. All sources and their licences are listed under Credits & data sources.

16. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection to processing based on legitimate interests (Art. 21). Consent you have given can be withdrawn at any time with effect for the future (Art. 7(3)). Write to the address in section 1.

You may also complain to a data protection authority, for example the Landesbeauftragter für den Datenschutz und die Informationsfreiheit Baden-Württemberg, Lautenschlagerstraße 20, 70173 Stuttgart, Germany.

17. Changes

This policy is updated whenever services or features change. The version published on this page applies; the date is at the top.

The terms of use apply, and for airline websites the hosting rules. Provider identification in the Impressum.