Privacy Policy

PilotAI is built by Fatih Sarıçiçek, an individual developer in the Republic of Türkiye (“we”, “us”). This policy covers both this website (playpilotai.com) and the PilotAI Trainer mobile app.

What changed on 3 August 2026. Earlier versions of the app stored everything on your device and sent us nothing, and earlier versions of this policy said so. That is no longer accurate: the app now has accounts and saves your progress to a server so it survives changing or reinstalling on a device. This policy replaces the previous one in full.

The website (playpilotai.com)

If you join the waitlist, we collect the email address you submit, for one purpose: to email you when PilotAI is available to download. The form is processed by Formspree, a third-party form service that stores the submission on our behalf so we can reach you at launch. We don’t sell, rent, or share this list with anyone else. You can ask us to remove your email at any time.

The app (PilotAI Trainer) — what we store on our servers

All of it is tied to your account. None of it is sold, rented, or shared for advertising.

• Your email address and a one-way hash of your password — to identify your account and let you sign in and reset your password. We never store the password itself and cannot read it.
• Your profile — callsign, rank, home base, chosen aircraft, and your in-app settings (sound, music, vibration, reminder preferences) — so the game looks and sounds the same on any device you sign in from.
• Your progress — XP, fuel, flight credits, flight hours, flights completed, lessons read, questions answered and their results, weather reports reviewed, missions completed. This is the thing an account exists to protect: it is why you can reinstall the app and not start over.
• Your logbook — one entry per completed flight, with its time, duration, score and mission.
• Your trial and subscription status — when your free trial started and ended, and whether a subscription is active.
• Anonymous usage events— for example “a lesson was opened” or “this question was answered correctly,” with the content id, a per-session random number and the app version. They contain no email address, no callsign and no text you have typed.
• Crash and error reports — the technical error message, the file and line of our code that produced it, and which screen was open, so that a screen that breaks on your phone is something we can find and fix.

What stays on your device and is never uploaded

• Your profile photo (avatar).If you add one, it is kept in the app’s private storage on your handset. It is never uploaded, transmitted, or backed up to any server we control.
• Your saved / bookmarked items and your study-reminder schedule.
• Your acceptance of the licence terms.

What we do NOT collect

• No name, phone number, postal address, or date of birth.
• No location, contacts, camera stream, or microphone data.
• No advertising identifiers, no third-party advertising SDKs, and no cross-app or cross-site tracking.
• No behavioural profiling and no automated decision-making about you.
• No IP-address-based tracking or fingerprinting of any kind.
• We do not sell or rent personal data to anyone, for any purpose.

Where your data is held, and who can reach it

Our database and account system are operated for us by Supabase, acting as our processor, on servers located in Ireland (European Union). Data in transit is encrypted with TLS, and access to your rows is enforced at the database level so that one account cannot read another’s. The developer is based in the Republic of Türkiye and administers the database from there, so your data may be accessed from outside the European Economic Area. Türkiye has its own personal-data law (KVKK) and we apply the protections described in this policy wherever the data is accessed from.

Like any hosting provider, Supabase keeps standard server access logs, which include the IP address a request came from, for security and for operating the service. Our own code never reads, stores, or acts on your IP address.

Notifications / study reminders

If you opt in to reminders, the app schedules local notifications on your device. They are generated on-device by your operating system, no reminder content is sent through our servers, and enabling them sends us no data. Your reminder preferences (how often, quiet hours) sync with your profile so they follow you to a new device. You can turn reminders off at any time in the app or in your device settings.

Purchases and subscriptions

The app offers an optional subscription after a free trial. Any purchase is processed entirely by the Apple App Store or Google Play under their own terms and privacy policies. We do notreceive or store your card number or payment details. We receive only the subscription status needed to unlock content (for example, “active” or “expired”), which we store against your account.

How long we keep it

Your account data is kept for as long as your account exists. When you delete your account it is erased immediately (see below) — there is no retention period and no recovery window. The only thing that survives is an anonymous counter recording that an account was deleted, how many days it had existed and whether it was subscribed; it carries no account identifier and cannot be traced back to you.

Your rights, and how to use them

Under Türkiye’s Personal Data Protection Law (KVKK) and the EU General Data Protection Regulation (GDPR) you have the rights of access, rectification, erasure, restriction, objection, and data portability. Three of them are built into the app, under Profile → Account:

• Get a copy of your data (access and portability). “Export my data” returns everything we hold about you, plus the part that lives only on your device, as one machine-readable JSON document you can copy out.
• Correct your data (rectification). Edit your callsign, home base and aircraft in your profile at any time.
• Delete your account (erasure).“Delete Account” removes your account, profile, progress, logbook and usage history from our servers immediately and irreversibly, and clears the app on your device. Instructions are also published at playpilotai.com/delete-account.

For anything else — including a copy sent to you by email, or a question about how we handled a request — email hello@playpilotai.com. We answer within 30 days. If you are unhappy with the outcome you may complain to your national data-protection authority, or in Türkiye to the Personal Data Protection Authority (KVKK).

Children

PilotAI is intended for a general audience interested in aviation and is not directed at children. Because it requires an account, you must be at least 13 years old to use the app — or older where your country sets a higher age for consent to online services (16 in parts of the EU) unless a parent or guardian consents. We do not knowingly create accounts for children below that age; if you believe we have, contact us and we will delete the account.

Security

Passwords are stored only as an irreversible hash. Traffic between the app and our servers is encrypted with TLS. Access to your data is restricted at the database level, per account, so that being signed in as one player grants no access to another player’s rows. No system is perfectly secure, and we do not claim otherwise.

Changes

If our data practices change, this policy is updated and the effective date above revised. Material changes are surfaced inside the app. The change of 3 August 2026, described near the top, is an example of that.

Contact

Questions about this policy or your data? Email hello@playpilotai.com.