Privacy Policy

Greaser is built on a simple principle: collect little, keep less. All flight data processed here is simulator data — positions, altitudes and speeds of a simulated aircraft — never your real-world location. This policy describes what is processed, why, and the rights you have under applicable data protection law, in particular the Swiss Federal Act on Data Protection (FADP) and, where it applies, the EU General Data Protection Regulation (GDPR).

1. What is processed, and why

• Account data — email address, username, password (stored exclusively as a salted hash; it cannot be read back), account settings and feature switches. Purpose: providing and securing your account. Legal basis: performance of the agreement with you (Art. 6(1)(b) GDPR).
• Flight data — the telemetry your simulator sends while the Greaser app runs (simulated position, altitude, speeds, aircraft type) and the analyses derived from it (landings, scores, statistics). This is the service itself. Filed flights, tracks and trips are private by default and shared only where you switch sharing on. Your live position on the shared map — the simulated aircraft’s coordinates, never your real location — is visible to other signed-in users by default and can be switched off at any time on your account page. Legal basis: performance of the agreement.
• Sign-in records — hashed device tokens for the desktop app and EFB, and one entry per signed-in browser (browser and operating system from the user agent, last-seen time). No IP addresses are stored with them. Purpose: letting you see and revoke your own sessions. Legal basis: performance of the agreement; security (legitimate interest, Art. 6(1)(f) GDPR).
• Usage statistics (self-hosted) — visits are counted by this service itself: a visitor is recorded as a truncated, salted hash of network address and browser signature. The salt is secret, the value cannot be reversed into a person and is never linked to your account. Referrer domains (never full URLs) and per-day page counts are kept for up to 400 days. No third-party analytics, no advertising, no tracking cookies. Legal basis: legitimate interest in understanding whether the site is used.
• Contact messages — what you submit on /contact, including your address so a reply is possible. Legal basis: your request (Art. 6(1)(b) GDPR).
• Diagnostics — a verbatim log of what your client sends exists only while it has been switched on for your account, is capped in size and is deleted when switched off. Short-lived event logs for interrupted flights are pruned automatically. Legal basis: performance of the agreement (troubleshooting you asked for).
• Cookies and local storage — one session cookie (to keep you signed in; no tracking) and browser-local preferences such as the theme. Nothing else.

2. What is deliberately not done

• No sale or disclosure of personal data to advertisers; no ad networks; no profiling; no tracking across other websites.
• No real-world location data — the simulator’s coordinates are fiction.
• No readable storage of IP addresses or user agents in the usage statistics.

3. Recipients and processors

• Render (render.com) — hosting of the application and database. Depending on the service region, data may be processed in the EU or the United States; where personal data leaves Switzerland or the EEA, it is safeguarded by the standard contractual clauses and certifications Render provides.
• Resend (resend.com) — delivery of transactional email (verification, password reset, service notices). Receives your email address.
• Windy.com — only if the wind-overlay feature is enabled for your account and you open it, map content loads from Windy’s servers.
• Google Fonts — the site’s typefaces may be loaded from Google’s servers, which then see your IP address as with any web request.

Beyond the live map default described above, other users see only what you have explicitly shared, for as long as the share and — where applicable — the friendship stands.

4. Retention and deletion

• Registrations whose email address is never confirmed are deleted automatically after 24 hours.
• Your flights are kept until you delete them or your account.
• Deleting your account deletes your personal data — flights, tracks, tokens, settings — enforced by the database itself. Messages you sent via the contact form may be retained.
• Backups are rotated; deleted data disappears from them as they age out.

5. Your rights

You have the right to request access to your personal data, its correction or deletion, a machine-readable copy, and — under the GDPR — the restriction of processing and an objection to processing based on legitimate interest. Contact the operator via the contact form. You may also lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC) or, under the GDPR, with your local supervisory authority.

6. Security and incidents

Passwords and access tokens are stored only as salted hashes; transport is encrypted (HTTPS). Should a data breach occur that is likely to result in a high risk to you, the competent authority will be informed and affected users will be notified without undue delay.

7. Children

The service is not directed at children under 16, and their data is not knowingly collected.

8. Changes

This policy may be updated; material changes will be announced on the website or by email. The current version is always available at /privacy.