Privacy Policy

Welcome to AviaSkill, operated by YMI Digital LLC ("we," "our," or "us"). We are committed to protecting your personal information and your right to privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our aviation exam preparation platform and free aviation tools.

This policy applies to all users, including visitors using our free tools (no account required), free trial users, and paid subscribers.

Information We Collect

Information You Provide

• Account Information: Name, email address, password (when you create an account)
• Profile Information: Aviation certifications, study preferences, exam goals, target certification
• Payment Information: Processed securely through Stripe — we do not store your full card number, CVV, or billing address on our servers
• Communications: Messages you send through our contact form, support emails, or AI chat tutor
• Referral Information: When you participate in our referral program, we store your referral code and track successful referrals to apply discounts

Automatically Collected Information

• Usage Data: Study sessions, question responses, progress metrics, exam simulation results, time spent on platform features
• Device Information: IP address, browser type, operating system, screen resolution
• Analytics Data: Page views and visitor counts (via Vercel Analytics — privacy-focused, no personal data), Core Web Vitals performance metrics (via Vercel Speed Insights — no personal data)
• Product Analytics: Page views, click interactions, session recordings (screen activity), and device/browser information (via PostHog — for product improvement and understanding user behavior). None of this is collected in your browser until you accept analytics in the consent banner. Session recordings automatically mask password inputs and sensitive form fields. No cross-site tracking or advertising use.
• Error Data: Error reports and performance traces (via Sentry). An error report carries the page you were on, browser and device, the stack trace, and the request that failed — which can include what a form you were filling in had submitted. Before it leaves us we redact email addresses, security tokens, payment identifiers and card numbers from it. Your account identifier and IP address are kept, because they are what makes an error traceable to the person it broke for. Error reporting runs whether or not you accept analytics, so a broken page can be fixed; the session replay attached to an error is added only if you do.
• Service Events: A short list of milestones our servers record whether or not you accepted analytics in your browser, because we need them to run, bill and measure the service: an account being created, a sign-in, a subscription starting, an exam result you told us about, a graded practice exam, and AI usage — which model answered, how many tokens it used and how long it took, what the request cost us (in our own billing records), which built-in study tool the tutor ran, whether a request hit a usage cap, and whether a message matched one of our own topic labels — the label itself is a phrase from our list, such as "checkride", recorded because your message contained it. Beyond that they carry your account identifier, counts, costs and outcomes: no question you typed, no chat message, no answer you gave. None of it is used for advertising.
• Tool Usage: When you use our free aviation tools (crosswind calculator, METAR decoder, unit converter), we collect anonymous usage analytics. No personal data is collected from unauthenticated tool usage.

How We Use Your Information

• Provide Services: Deliver personalized study experiences, track your progress, generate study recommendations, and power exam simulations
• Authentication: Verify your identity and manage your account via Supabase Auth
• Payment Processing: Process subscription payments, manage billing, and apply promotional/referral discounts via Stripe
• AI Features: Generate personalized explanations, study recommendations, and chat responses — see the AI Data Handling section below for details
• Improve Platform: Analyze anonymous usage patterns, monitor performance (page load times, error rates), and develop new features
• Communications: Send transactional emails (welcome, password reset, billing receipts), subscription notifications, and — only if you opt in — product updates and marketing; see the Email Communications section below for details
• Security: Detect fraud, enforce rate limits, prevent abuse, and enforce our Acceptable Use Policy
• Legal Compliance: Comply with applicable laws and regulations
• Referral Program: Track referral codes, apply discounts to both referrer and referred user, and cap rewards per our program terms

Third-Party Services

We use the following third-party services to operate AviaSkill. We share only the minimum data necessary for each service to function:

We do NOT:

• Sell your personal information to anyone
• Share your data with advertising networks
• Use tracking pixels from social media platforms
• Allow third parties to use your data for their own marketing
• Use your study data to train AI models (OpenAI's API does not use API inputs for training)

How We Use AI

AviaSkill uses OpenAI's API to power two features:

1. AI Explanations: When you answer a practice question, we may send the question text, answer options, and your selected answer to OpenAI to generate a personalized explanation. We do NOT send your name, email, or any personal identifiers.
2. AI Chat Tutor: When you use the chat tutor, your conversation messages are sent to OpenAI to generate responses. Conversations are stored in our database (Supabase) for your convenience. We do NOT send personal identifiers with chat requests.

We also record these AI requests — the prompt sent and the response returned, with your account id — in Langfuse, so we can diagnose a wrong, slow or failed explanation after the fact instead of asking you to reproduce it. Your chat messages and question attempts are already stored in our own database; Langfuse holds a copy of the same content alongside the model's reply.

Important facts about our AI usage:

• OpenAI does NOT use API inputs to train their models (per their API data usage policy)
• We do not build user profiles from AI interactions
• AI responses are not used for advertising or sold to third parties
• You can delete your chat history at any time from your account settings

How We Protect Your Data

We implement industry-standard security measures:

• Encryption in Transit: All data transmitted using TLS/SSL (HTTPS enforced)
• Authentication: Secure password hashing and session management via Supabase Auth
• Database Security: Row-level security (RLS) policies ensure users can only access their own data
• Access Controls: Role-based access control with least-privilege principles
• Rate Limiting: Protection against brute force attacks via Upstash Redis
• Security Headers: Content Security Policy, HSTS, and other HTTP security headers via Vercel
• Monitoring: Real-time error tracking (Sentry) and performance monitoring
• Dependency Security: Automated dependency vulnerability scanning via Dependabot

No system is 100% secure. While we take reasonable measures to protect your information, we cannot guarantee absolute security. If we discover a data breach affecting your personal information, we will notify you and relevant authorities as required by law.

How Long We Keep Your Data

Your Rights

Depending on your location, you may have the following rights:

• Access: Request a copy of the personal data we hold about you
• Correction: Update or correct inaccurate information (most changes can be made directly in Settings)
• Deletion: Delete your account and all associated personal data (Settings > Privacy & data). Deletion is scheduled 30 days out and you can cancel it from the same page at any point in that window
• Export: Download your study progress data
• Opt-Out: Turn off Product updates & marketing at any time, in Settings or with the unsubscribe link in any of those emails (transactional emails like password resets and billing receipts are still sent)
• Restriction: Request that we limit how we process your data in certain circumstances
• Portability: Receive your data in a structured, machine-readable format
• Withdraw Consent: Where processing is based on consent, you may withdraw it at any time

Most of these are self-service. Settings > Privacy & data holds your marketing and data-retention consents, the record of when you accepted our terms, a full data export, testimonial withdrawal, and account deletion; Settings > Notifications holds the per-category email switches. The analytics consent is the separate one — it is the banner's decision, kept in your browser, so changing it means clearing site data for aviaskill.com and answering the banner again.

For anything else, contact us at privacy@aviaskill.com. We will respond within 30 days (or sooner if required by your local law).

Cookies and Tracking Technologies

We use cookies and similar technologies as described in our Cookie Policy. In summary:

• Essential cookies: Authentication, security (cannot be disabled)
• Functional storage: Study preferences, theme settings (localStorage, not cookies)
• Analytics: Privacy-focused page view tracking via Vercel (no personal data), product analytics via PostHog (first-party cookies, no cross-site tracking). Browser-side product analytics and session replay are off until you accept them in the consent banner
• Payment: Stripe fraud detection cookies (only during checkout)

What we don't use: No advertising cookies, no social media trackers, no cross-site tracking, no data selling.

For full details and how to manage your preferences, see our Cookie Policy.

Free Tools & Unauthenticated Usage

AviaSkill offers free aviation tools (crosswind calculator, METAR/TAF decoder, unit converter, and more) that do not require an account or sign-in.

When you use free tools without signing in:

• We do NOT collect your name, email, or any personal information
• We collect anonymous page view analytics (via Vercel Analytics) to understand tool popularity
• Tool preferences you save (e.g., personal minimums in the crosswind calculator) are stored in your browser's localStorage on your device — not on our servers
• If something goes wrong, Sentry may capture an anonymous error report

When you use free tools while signed in:

• The same anonymous analytics apply
• Your tool preferences may be associated with your account for sync across devices (future feature)

Referral Program Data

When you participate in AviaSkill's referral program:

• We generate a unique referral code linked to your account
• When someone uses your referral code, we record the referral relationship to apply discounts
• We track the number of successful referrals to enforce the reward cap (currently 12 referrals per account)
• Referral discount details are stored in our database and shared with Stripe for coupon application
• We do NOT share your personal information with the person you referred, or vice versa

Testimonials

We sometimes invite students to write a short testimonial. It is entirely optional, and nothing is stored unless you tick the consent box on the form.

• We store your quote, the display name you chose, the certification you are studying for, a broad score band, and the fact and time of your consent
• Nothing is published until we review and approve it — writing one does not put it on the site
• What is published is the quote, your chosen display name, and the certification. Your email address is never shown
• You can withdraw a testimonial at any time from Settings > Privacy & data, which removes it from the site. Deleting your account withdraws it immediately, without waiting for the 30-day deletion window

We never publish a quote we were not given permission to publish.

Emails We Send

We send the following types of emails:

Transactional (cannot be unsubscribed):

• Welcome email when you create an account
• Password reset requests
• Billing receipts and subscription confirmations
• Security notices when your password or email address changes
• Account deletion confirmation

Study and progress emails (each can be turned off):

• Study reminders at a time you choose, and streak reminders
• Nudges when a topic you had learned is due for review
• Milestones — streaks, achievements, exam results and follow-ups
• Messages and activity from an instructor you are connected to

Product updates & marketing (off unless you opt in; can be turned off at any time):

• New feature announcements and release notes
• New certification or tool launches
• Nudges when you have been away or your readiness slips
• A periodic digest of what you saved to your Library, at a frequency you choose

Settings > Notifications controls all of these: your reminder time, streak reminders, progress and study nudges, how often the library digest arrives, and the one Product updates & marketing switch, which is also your marketing consent under Privacy & data. You can keep the ones you find useful and turn off the rest without unsubscribing from everything.

We do NOT send:

• Third-party marketing emails
• Emails on behalf of advertisers
• Promotional emails to non-users

You can unsubscribe at any time using the link in any email footer, from Settings > Notifications, or by contacting support@aviaskill.com.

Children's Privacy

AviaSkill is not intended for children under 13 years old (or 16 in jurisdictions where GDPR applies). We do not knowingly collect personal information from children under these ages.

If you believe a child under these ages has provided us with personal information, please contact us at privacy@aviaskill.com. We will promptly investigate and delete the information.

Note: Student pilots must be at least 16 years old to obtain a Student Pilot Certificate from the FAA, which aligns with our minimum age requirements.

International Data Transfers

AviaSkill's servers and third-party service providers are primarily located in the United States. If you access our platform from outside the United States, your information may be transferred to and processed in the US.

We ensure appropriate safeguards are in place:

• Our hosting provider (Vercel) and database provider (Supabase) maintain appropriate security certifications
• Payment processing through Stripe is PCI DSS Level 1 compliant globally
• We process data lawfully based on contractual necessity, legitimate interests, or your consent

If you are in the European Economic Area (EEA), UK, or other regions with data transfer restrictions, your continued use of AviaSkill constitutes consent to the transfer of your data to the United States, subject to the safeguards described above.

California Privacy Rights (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act:

• Right to Know: What personal information we collect, use, share, or sell
• Right to Delete: Request deletion of your personal information
• Right to Opt-Out of Sale: We do NOT sell your personal information, so there is nothing to opt out of
• Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights

To exercise these rights, email privacy@aviaskill.com with "CCPA Request" in the subject line. We will verify your identity and respond within 45 days.

European Privacy Rights (GDPR)

If you are in the European Economic Area (EEA) or the United Kingdom, you have rights under the General Data Protection Regulation:

• Right of Access: Obtain a copy of your personal data
• Right to Rectification: Correct inaccurate or incomplete data
• Right to Erasure: Request deletion of your data ("right to be forgotten")
• Right to Restrict Processing: Limit how we process your data
• Right to Data Portability: Receive your data in a structured format
• Right to Object: Object to processing based on legitimate interests
• Right to Withdraw Consent: Where processing is based on consent, withdraw it at any time

Legal bases for processing:

• Contract: Processing necessary to provide the services you signed up for
• Legitimate interests: Analytics, security, service improvement
• Consent: Product updates & marketing emails, optional cookies
• Legal obligation: Tax records, fraud prevention

Data Protection Authority: You have the right to lodge a complaint with your local data protection authority if you believe your rights have been violated.

To exercise your GDPR rights, email privacy@aviaskill.com with "GDPR Request" in the subject line.

Changes to This Policy

We may update this Privacy Policy when we add new features, change service providers, or adapt to new privacy regulations. When we make significant changes, we will:

• Update the "Last Updated" date at the top of this page
• Post a notice on our website for at least 30 days
• Email active account holders about material changes

Continued use of AviaSkill after changes constitutes acceptance of the updated policy. If you disagree with changes, you may delete your account at any time.

Contact Us

If you have questions or concerns about this Privacy Policy or our data practices:

We aim to respond to all privacy inquiries within 30 days.