Last updated: 22 October 2026
Privacy Policy
This policy explains what personal data AvioADSB collects, why we collect it, how long we keep it, and your rights as a data subject under the GDPR.
1. Who we are
AvioADSB operates the open aviation data network at avioadsb.org. For data protection purposes, AvioADSB is the data controller. You can contact us at [email protected].
2. What data we collect and why
| Data | Purpose | Legal basis |
|---|---|---|
| Email address | Account registration, verification emails, password resets, and the warning before an inactive account is deleted | Contract (account operation) |
| Username | Account identification | Contract |
| Password hash (bcrypt) | Authentication — we never store the plain password | Contract |
| Station name & approximate location (rounded to a ~28 km grid) | The public receiver map. Station names are public: don't use your real name if you'd rather not be identified | Contract / Legitimate interest |
| Station precise location & antenna height, where you provide them | Checking that reported traffic is physically receivable from your position, and drawing your range plot. Never returned by any API and never shown to anyone. | Legitimate interest (data quality) |
| Station UUID or feed token | Telling your station's data apart from everyone else's; the UUID is also how you claim a station | Contract / Legitimate interest |
| Feeder IP address of a connecting station | Estimating a location when you haven't given one, the "am I feeding?" check, and abuse review | Legitimate interest (fraud prevention) |
| Station statistics: when it last shared data, aircraft and messages per day, maximum range per compass sector, and the H3 cells (~12,000 km²) it heard aircraft in | Station status, your "My station" page and ranking, whether your API key has the contributor tier, and the coverage map (which shows only a count of stations per cell, never which ones) | Contract / Legitimate interest |
| API key (stored only as a SHA-256 hash) and your monthly request count | Authenticating API requests and enforcing your quota | Contract |
| Contact form submissions (name, email, topic, message) and the IP address they were sent from | Responding to your enquiry; the IP address for abuse review | Legitimate interest |
| Host-a-receiver applications: name, email, country, area and site description, an approximate point (rounded to a ~28 km grid), and the IP address they were sent from | Assessing your application and, if it's accepted, sending you a kit; the IP address for abuse review | Steps you asked us to take before a contract |
| Usage analytics via PostHog: pages viewed, clicks, browser and device type, approximate location from IP address. Without your consent, only counted with a hash of your IP address and browser that changes daily, and nothing is stored on your device. With your consent, also an analytics cookie and session recordings (what you type in forms is masked) | Understanding how the site is used and improving it | Consent (cookies, session recordings) / Legitimate interest (cookieless counting) |
| Request IP address (server logs); for rate limiting, only the network (IPv4 /24, IPv6 /64) is used, held in memory for up to a day | Rate limiting, abuse prevention | Legitimate interest |
3. Aircraft data and the people behind it
Aircraft broadcast ADS-B and Mode S messages openly, and anyone with a receiver can decode them. A private aircraft's address, callsign or registration can lead to its owner or operator, so its live position can be personal data about them. We process it on the basis of legitimate interest: providing open, live flight data for research, education and hobby use, from signals that are public by design.
- Live aircraft data is held in memory for about a minute. We don't record where aircraft have been: the coverage map keeps only which areas were heard, with no aircraft in it.
- Registration and type details come from public aircraft registries and community databases (see the terms).
- We can't know who is on board or who owns an aircraft we receive, so we can't tell them individually; this section is how we inform them.
Hiding an aircraft. If you own or operate an aircraft and want it hidden, email [email protected] with its registration and something that shows it's yours, such as the registration certificate. Once we've checked it, everything we receive for its address is dropped as it arrives, so it no longer appears on the live map, in the API or in any export. Other tracking services are independent of us; you'd need to ask them separately.
4. Cookies
We set a session cookie (avioadsb_token) that keeps you logged in, and a short-lived pass (avio_live) when you open the live map. Analytics cookies (PostHog) are set only if you accept them in the cookie banner; no advertising cookies are used. Fonts, scripts and the API documentation are served from our own domain. See our Cookie Policy for full details.
5. How long we keep it
- Account data: for as long as your account exists. Deleting your account deletes it, with your stations, API key and statistics, straight away from the live database and in any case within 30 days. If none of your account's stations has connected for 90 days, we email you a warning and delete the account 7 days later unless one reconnects.
- Stations: until you delete a claimed station, or we delete an unclaimed one on request. A station's feeder IP address is cleared once it hasn't connected for 90 days.
- Coverage cells: 24 hours.
- Contact submissions: up to 2 years, then deleted. The IP address is cleared after 90 days.
- Host-a-receiver applications: up to 2 years if pending or not accepted, then deleted; as long as you host a sponsored kit if accepted. The IP address is cleared after 90 days.
- Server logs: rolling files of limited size, overwritten as they fill; never archived.
- Analytics: kept by PostHog for the retention period set in our PostHog project; we delete your events on request.
6. Who receives it
We do not sell personal data, and we never sell, license or hand over station locations or who feeds (see the data policy). We use a small number of processors to run the service; see the list of processors. Some are based outside the EU, notably Resend (email, USA) and Cloudflare (network, global); transfers to them rely on the European Commission's Standard Contractual Clauses or the EU-US Data Privacy Framework. Station names and approximate locations, and your station page if you share it, are public by design. We disclose personal data to authorities only when the law requires it.
7. Your rights (GDPR)
You have the right to:
- Access — request a copy of the personal data we hold about you.
- Rectification — correct inaccurate data (you can update your username and email in the Dashboard).
- Erasure — delete your account and all associated data from the Dashboard, or ask us to.
- Restriction — ask us to stop using your data while a question about it is resolved.
- Portability — receive your data in a machine-readable format.
- Objection — object to processing based on legitimate interest, including aircraft data (see section 3).
- Withdraw consent — where processing is based on consent, you may withdraw it at any time, for analytics with Cookie settings in the site footer.
To exercise any right, email us at [email protected]. We will respond within one month. You also have the right to lodge a complaint with your national data protection authority (in Italy, the Garante per la protezione dei dati personali).
8. Security
All data in transit is encrypted via TLS. Passwords are hashed with bcrypt (cost factor 12). We apply rate limiting and input validation at all API endpoints.
Receiver locations. The location shown on the public map is always rounded to a ~28 km grid. If you provide a precise location for your station, it is stored separately and used only server-side to check that the traffic you report is physically receivable from where you are, and to measure your range. It is never included in any API response — including to other signed-in users — and that guarantee is enforced by an automated test in our build, not only by policy. You can change or remove a precise location at any time from your dashboard, and deleting a receiver deletes it outright.
9. Children
AvioADSB is not directed at children under 16. We do not knowingly collect data from minors.
10. Changes to this policy
We may update this policy from time to time. The "last updated" date at the top will reflect any changes. Material changes will be communicated via email to registered users.