pgpilot Privacy Policy

Last updated: May 11, 2026

1. Data Controller

eide.ai AS
Norway
Contact: pgpilot@eide.ai

pgpilot is a paragliding flight instrument and communication app. This policy explains what personal data we collect, why, on what legal basis, and what rights you have.

2. Account & Identity

pgpilot offers several ways to sign in:

Regardless of sign-in method, your Supabase user ID, display name, and authentication tokens are stored.

3. Pilot Profile (optional)

After signing in you may optionally fill in a pilot profile. The following fields are synced to the cloud (Supabase):

• Pilot name, glider type, glider ID, competition class, all-up weight
• XContest username, OGN ID, OGN enabled flag
• Garmin InReach MapShare ID (inreach_mapshare_id), if you choose to enable satellite position relay

Your XContest password is stored locally on your device only and is never persisted on our servers. When you upload a flight to XContest, your credentials are transmitted to our backend server over HTTPS, used for a single session to authenticate with xcontest.org on your behalf, and immediately discarded.

4. Location Data

pgpilot uses GPS (or an external BLE vario GPS, if connected) to provide flight instruments, map display, and pilot tracking. Your location is:

• Broadcast in real-time to other pilots via Supabase Realtime, so they can see you on the map.
• Stored locally on your device as flight recordings (track logs) in IndexedDB.
• Uploaded to Supabase cloud for signed-in users: flight metadata (launch coordinates, duration, distance, XC score), a simplified track polyline, and the full IGC file are uploaded when a flight is saved. During active flights, live track data (GPS position, altitude, and ground speed at approximately 1 Hz) is uploaded incrementally for crash recovery and live viewing by other pilots.
• Sent to third-party tile/data providers implicitly through map tile requests (OpenFreeMap, OpenTopoMap, MapTiler, AWS elevation tiles, thermal.kk7.ch) and explicitly for wind station and takeoff site queries (winds.mobi, ParaglidingEarth).
• Published to the Open Glider Network (OGN) only if you explicitly enable OGN in settings. OGN positions are publicly visible on tracking sites like glidertracker.org.
• Relayed from Garmin InReach MapShare only if you set an InReach MapShare ID on your profile. The backend periodically polls your public MapShare KML feed, broadcasts the latest position to other pgpilot users in real-time, and persists track points server-side in the external_tracks table. Opt-in: nothing is fetched unless you provide a MapShare ID.
• Received from the Meshtastic mesh network if Meshtastic ingest is configured. The backend subscribes to the public mqtt.bircom.in MQTT broker, decrypts packets using the published default Meshtastic keys, and broadcasts node positions to other pgpilot users. Meshtastic is a public network: anyone running a node on the same channel is visible, and your own node, if you operate one, is visible to other listeners.

5. Social Flight Feed

Saved flights are public by default. Other pgpilot users can see your flight on the social feed, including your pilot name, glider type, launch location, flight statistics, XC score, simplified track polyline, and full GPS track (IGC file). Only flights that exceed minimum thresholds (duration, distance, and track length) appear in the feed.

You can toggle any individual flight to private at any time from within the app. Private flights are visible only to you.

6. Microphone & Audio

The microphone is used for push-to-talk (PTT) voice communication and voice messages within group flights. Audio is:

• Relayed in real-time to other pilots in the same group via Supabase Realtime - never stored on our servers.
• Voice messages in chat are stored in Supabase and locally on your device.
• Transcribed automatically using OpenAI’s Whisper API. When a voice message is sent, the audio is forwarded from our backend server to OpenAI (a US-based service) for speech-to-text transcription. The resulting text is stored alongside the message in Supabase so other group members can read the transcript. OpenAI’s data usage policy applies to audio sent for transcription; see openai.com/policies. OpenAI states that API data is not used to train their models.
• If VHF radio bridging is enabled (see Section 8), your microphone audio may also be transmitted over VHF radio frequencies, and VHF radio audio from other users may be relayed to your group over the internet.

6b. Camera & Photos

The camera is used to scan QR codes (for importing shared tasks) and to capture flight photos. Photos taken during flight are stored locally on your device. You may also import photos from your device gallery. Camera data is not uploaded to our servers unless you explicitly share a photo through the app in the future.

7. Bluetooth

Bluetooth Low Energy (BLE) is used to connect to external PTT buttons and BLE variometer instruments (e.g. XCTracer, SkyDrop, SkyBean, BlueFlyVario). BLE scanning uses the neverForLocation flag - it is not used for Bluetooth-based location tracking.

When a BLE vario is connected, the instrument may provide GPS position, altitude, vario readings, battery level, and FLARM traffic data (nearby aircraft). If the vario provides GPS, it replaces the phone GPS as the primary position source. This data then follows the same collection and sharing paths described in Sections 4 and 5 - it is broadcast to other pilots, uploaded to the cloud as part of flight recordings, and visible in the social flight feed.

BLE PTT button data (button press events) stays on your device.

8. VHF Radio (Android only)

pgpilot supports the KV4P HT VHF radio module, an external hardware device that connects to your phone via USB. When connected, it enables voice communication over VHF frequencies (e.g. 154.175 MHz, 143.9875 MHz) commonly used in paragliding.

• USB accessory data: The app communicates with the radio module over USB serial (CP210x bridge). No USB data is sent to our servers.
• VHF transmission: When you press PTT, your voice is encoded and transmitted over VHF radio frequencies via the connected hardware. VHF transmissions are not encrypted and can be received by anyone on the same frequency. You are responsible for complying with local radio regulations.
• VHF reception: Audio received by the radio module is decoded and played on your device.
• LTE–VHF bridging: If you are in a group and have bridging enabled, audio received over VHF radio is relayed to other group members via the internet (Supabase Realtime), and voice from group members is transmitted over VHF. This means third-party radio transmissions on your frequency may be forwarded to your online group, and internet voice traffic may be broadcast over VHF. Bridged audio is not stored on our servers.
• Radio settings: Your frequency, CTCSS tone, power level, and filter preferences are stored locally on your device only.

VHF radio functionality requires a foreground service with connectedDevice type to maintain the USB serial connection while the app is in the background.

9. Analytics

We collect usage events (e.g. connection events, error reports, performance snapshots) sent to Supabase. Each event includes:

• Your user ID and a random session ID
• Event name, category, and technical properties
• App version and platform

Performance-related events recorded during flights may also include:

• Battery level and drain rate
• Device capabilities (memory, CPU core count)
• User agent string (browser/device identifier)
• Frame rate and rendering performance metrics

We do not collect IP addresses or precise coordinates in analytics. For guest users, analytics data cannot be linked to a real-world identity. For users who signed in with email, Google, or Apple, the user ID is linked to their Supabase account.

10. Bug Reports

When you submit a bug report from within the app, the following data is collected and stored in Supabase:

• Your current GPS position (latitude and longitude) at the time of submission
• A snapshot of app state (active tab, flight status, sensor status, group info, permission status)
• Device information (platform, app version, user agent string, screen dimensions, language)
• Recent console log entries (approximately the last 500 lines, which may include error messages and debug data)
• Recent analytics events (approximately the last 20 events)

Console log entries may include error payloads such as request URLs and short response snippets, and the recent analytics events embedded in the report may include your display name. Bug reports are used solely for diagnosing and fixing issues. Guest users can submit bug reports; these are stored with a null user ID.

11. Legal Basis for Processing

We process personal data on the following grounds (GDPR Art. 6):

• Performance of contract (Art. 6(1)(b)) - account creation, authentication, pilot profile storage, real-time position sharing, voice communication, flight recording, and cloud sync are necessary to provide the service.
• Legitimate interest (Art. 6(1)(f)) - anonymous analytics for product improvement and service reliability, and the social flight feed for community engagement (flights are public by default; you can set any flight to private). You can object to this processing (see Your Rights below).
• Consent (Art. 6(1)(a)) - OGN position publishing and XContest uploads are opt-in only.

12. Third-Party Services & International Transfers

We use the following third-party services:

• Supabase (authentication, profile storage, flight storage, settings sync, real-time comms, analytics) - hosted in the EU
• Fly.io (backend hosting, Amsterdam region) - all API requests are processed through Fly.io infrastructure
• Google (OAuth sign-in, if you choose Google login)
• Apple (Sign In with Apple, if you choose Apple login)
• OpenAI (voice message transcription via Whisper API - audio is sent to OpenAI servers in the US for speech-to-text processing; see Section 6)
• OGN/APRS-IS (opt-in aircraft tracking)
• OpenFreeMap, OpenTopoMap, MapTiler, AWS (map tiles)
• winds.mobi, ParaglidingEarth (weather/site data)
• thermal.kk7.ch (thermal hotspot data)
• XContest (flight upload - credentials are used for a single session and never stored on our servers)
• Flightlog.org (optional flight upload destination - credentials are used for a single upload session and discarded afterwards, same pattern as XContest)
• Garmin InReach MapShare (opt-in - if you set a MapShare ID on your profile, the backend polls the public MapShare feed URL you provide and relays the positions to other pgpilot users)
• Meshtastic / Bircom MQTT broker (opt-in mesh-network position relay - the backend subscribes to mqtt.bircom.in and rebroadcasts decoded node positions to other pgpilot users)

Some of these services may process data outside the EU/EEA. Where this applies, transfers are protected by Standard Contractual Clauses or adequacy decisions as required by GDPR Chapter V.

13. Data Storage & Retention

• On-device: Flight recordings, settings, and auth tokens are stored locally in IndexedDB and localStorage. You can clear this data at any time via your device settings.
• Supabase cloud: Your account (user ID, email if provided, display name), pilot profile, saved flights, synced settings, chat messages, and group data are stored in Supabase for as long as your account exists. You may request deletion at any time.
• Analytics: Usage event data in Supabase is retained indefinitely for product improvement.
• Bug reports: Submitted bug reports, including the GPS position at submission time, recent console log entries, and the app-state snapshot, are retained indefinitely in Supabase for debugging.

14. Data Sharing

We do not sell or share your data with advertisers. Data is shared with:

• Other pgpilot users - your real-time position, chat messages, and voice audio are shared with pilots in the same group. Your saved flights (including pilot name, glider, launch location, flight statistics, and GPS track) are visible to all pgpilot users via the social flight feed unless you set a flight to private.
• VHF radio listeners - if you use the VHF radio feature, your voice is transmitted over unencrypted VHF frequencies and can be received by anyone with a radio on the same frequency. If LTE–VHF bridging is active, voice from your online group may also be broadcast over VHF (see Section 8).
• Third-party services - as described in Section 11, only as necessary for app functionality.

15. Children

pgpilot is not directed at children under 16. We do not knowingly collect data from children.

16. Your Rights

Depending on your jurisdiction, you have the right to:

• Access - request confirmation of whether we process your personal data, and if so, receive a copy of that data.
• Rectification - request correction of inaccurate or incomplete data.
• Erasure - request deletion of your personal data when there is no compelling reason for continued processing.
• Restriction - request that we limit how we process your data in certain circumstances.
• Data portability - receive your data in a structured, commonly used format and transmit it to another controller.
• Object - object to processing based on legitimate interests (including analytics).
• Withdraw consent - where processing is based on consent (e.g. OGN publishing), you may withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, contact us at pgpilot@eide.ai. We will respond within 30 days.

For guest accounts with no email, you can clear all local data via your device settings. Server-side analytics for guest accounts use random IDs that cannot be linked to a real-world identity.

17. Right to Lodge a Complaint

If you believe your data protection rights have been violated, you have the right to lodge a complaint with a supervisory authority. Since the data controller is established in Norway, the lead supervisory authority is:

Datatilsynet (Norwegian Data Protection Authority)
www.datatilsynet.no

If you reside in the EU/EEA, you may also lodge a complaint with your local data protection authority.

18. Changes

We may update this policy from time to time. Changes will be reflected by the "Last updated" date above.

eide.ai AS · Norway · pgpilot@eide.ai