Last updated: August 1, 2026
Flight Owl ("we", "our", "the app") is operated by TBM Solutions LLC. This policy describes how we collect, use, and protect your personal data when you use the Flight Owl mobile application.
Data controller: TBM Solutions LLC, a Wyoming limited liability company, United States. Contact: [email protected].
| Data | Purpose | Stored where |
|---|---|---|
| Email address | Account authentication | Our authentication provider |
| Display name | Profile personalization | Our servers (EU) |
| Profile photo, if you set one | Profile personalization | Our servers (EU), on your account record. Remove it any time from Profile |
| Tracked flights | Flight alerts and predictions | Our servers (EU) |
| Flight journal entries | Travel history (user-created) | Our servers (EU) |
| Feature requests & votes | Community product feedback (user-submitted) | Our servers (EU) |
| Device push token | Push notifications | Our servers (encrypted at rest) |
| Precise location, if you turn it on | Nearby airports and in-flight positioning | In-memory only (not persisted) |
| Rough area (city level), worked out from your internet address | Nearby airports, without asking for a location permission | Saved on your own device. Our servers do not keep it |
| Purchase history | Subscription management | Our subscription processor, which is separate from the app store that handles payments |
| Crash reports | Bug fixing | Our crash-reporting processor |
| Anonymous usage events + masked session recordings | Feature analytics | Our analytics processor (EU, no user ID sent, IP discarded) |
Under Article 6 of the GDPR, every use of your data needs a legal basis. Ours are:
| What we do | Legal basis |
|---|---|
| Create and run your account, track your flights, produce predictions, store your journal, manage your subscription | Performance of a contract (Article 6(1)(b)). You asked us to provide this service. |
| Send flight alerts and achievement notifications, use your precise location, store a profile photo | Consent (Article 6(1)(a)). Every one of these is off until you turn it on, and you can withdraw at any time. |
| Work out the rough area you are in from your internet address, so we can show nearby airports | Legitimate interests (Article 6(1)(f)). Your internet address reaches our servers whenever the app talks to them. We turn it into a city, never a precise position, and it is kept on your own device. You can object at any time. |
| Send occasional travel recaps: your year in review, and a note if you have not flown in a while | Legitimate interests (Article 6(1)(f)). These are not marketing and contain no offers, so they are on by default. You can turn them off in the app at any time and we stop immediately. |
| Fix crashes, prevent abuse, enforce rate limits, keep the service secure | Legitimate interests (Article 6(1)(f)). Our interest is a working, non-abused service; the data involved is minimal. |
| Measure anonymous feature usage | Legitimate interests (Article 6(1)(f)). No user identifier is sent and IP addresses are discarded. |
| Keep audit and deletion records | Legal obligation (Article 6(1)(c)) and legitimate interests, so we can show that a deletion request was honoured. |
Where we rely on legitimate interests, you have the right to object. See "Your Rights" below.
You can sign in with email/password, Apple, or Google. Authentication is handled by a third-party authentication provider on our behalf. When you sign in with Apple, you may choose to hide your email address; Apple provides a private relay address instead. We accept either.
Flight alerts are off until you allow notifications. When you first allow them, we switch on a standard set so that allowing them actually does something: delays, gate changes, departures, arrivals, and achievements. Baggage alerts stay off. You can change any of these at any time in Notifications, and we only do this on the first grant, never later, and never to a choice you have already made. You also get a reminder the day before a flight you are tracking.
Travel recaps are on by default, and are the one exception. These are your year in review, and an occasional note if you have not flown in a while. They carry no advertising, offers, prices or upgrade prompts, so we rely on legitimate interests rather than consent (see the table in section 2). You can switch them off in the app under Notifications at any time, and we stop immediately. That is your right to object under Article 21.
When you change any notification setting, we record the time it changed. Device tokens are encrypted at rest using AES-256-GCM.
Subscriptions are processed by the app store you installed Flight Owl from, which on iPhone is Apple's App Store. We verify subscription status through a third-party subscription processor. We do not process or store payment details. See Apple's privacy policy for payment data handling.
| Type of processor | Data shared | Purpose |
|---|---|---|
| Authentication provider | Email, account ID | Signing you in |
| Push delivery providers | Device token, notification content | Push notifications and Live Activity updates |
| Subscription processor | Account ID, subscription status | Subscription management |
| Crash-reporting processor | Account ID, crash traces | Error monitoring |
| Analytics processor (EU) | Anonymous event names, masked session recordings (IP discarded) | Privacy-first analytics |
| Team messaging tool | Your email address and an excerpt of feedback you submit | Routing in-app feedback to our team |
We name categories rather than individual vendors here, as Article 13(1)(e) of the GDPR permits. If you want the specific processors behind any category, ask us at [email protected] and we will tell you.
Our own servers are in the European Union, and our analytics runs on EU infrastructure. Your data stays in the EU for everything we host ourselves.
Some of the processors above are operated from the United States, so using them involves transferring personal data outside the EU and EEA.
Those transfers rely on the European Commission's Standard Contractual Clauses, which are built into the data processing agreement we have with each provider, and on the EU-US Data Privacy Framework where the provider is certified under it. You can ask us for more detail at [email protected].
TBM Solutions LLC is established in the United States and does not currently have an establishment in the European Union.
Under the EU General Data Protection Regulation, you have the right to:
Device tokens are encrypted at rest with AES-256-GCM. All communication uses HTTPS with TLS 1.2+. API requests from the app include HMAC-SHA256 attestation signatures. Database access uses least-privilege roles.
Flight Owl is not directed at children under 16 and you need to be at least 16 to create an account. We do not knowingly collect data from children. If you believe a child has given us personal data, write to [email protected] and we will delete it.
We may update this policy. Significant changes will be communicated through the app. Continued use after changes constitutes acceptance.
For privacy questions or data requests: [email protected]. We are the data controller for the personal data described here, and that address reaches us directly.
For anything else, see our support page.