Privacy policy

This policy explains what personal information Avitrace collects when you use avitrace.net, what we do with it and the choices you have. We collect as little as we can, we don’t sell it, and we don’t use advertising or tracking cookies.

1. Who we are

Avitrace (avitrace.net) is the data controller for the personal information described here.

For anything about your personal information, email [email protected].

2. What we collect

When you create an account

• Email address. Used to sign in, confirm your account and reset your password. It’s stored encrypted and never shown to anyone else.
• Username and display name. These are public.
• Password. We only store a secure one-way hash of it, never the password itself.

Things you add

• Profile details you choose to add: bio, profile picture and banner.
• Photos, with the date, place and caption you give them. When you upload a photo we remove its camera data (EXIF), including any GPS position, before storing it. If your camera recorded a position, we only use it at upload to suggest the nearest known location, which you can change.
• Contributions to aircraft records, such as timeline entries and sources. We keep a record of who made each change so editors can review it.
• Comments, likes and follows.

Collected automatically

• Sign-in sessions: when you sign in, we store a scrambled copy of your session token with your device’s IP address and browser type. This keeps you signed in and helps us spot misuse of your account.
• Failed sign-in attempts: a scrambled copy of the email address tried and the IP address, used to slow down password guessing.
• Photo views: to count each visitor once a day, we use an identifier scrambled from your account (or, if you’re not signed in, your IP address and browser). It changes every day, so it can’t be used to follow you, and it’s deleted within two days.
• Server logs: our web host and content delivery network may record standard technical logs (IP address, pages and files requested, browser) for security and troubleshooting.

If you become a supporter

Payments are handled by Stripe. We never see or store your card details. We keep your Stripe customer and subscription references, your plan, and whether your subscription is active.

3. What other people can see

• Always public: your username and display name, and photos accepted into the Avitrace gallery, which are credited to you.
• Public if you make your profile public (an account setting, off by default): your bio, your personal gallery photos marked “show on my profile”, your collection and your followers and following.
• Public when you post them: your profile picture and banner, comments, and the number of likes a photo has.
• Never public: your email address, password, sign-in history and payment details.

People with a private profile and no accepted photos don’t appear in the people directory or search.

4. Why we use it (and our lawful basis)

• To provide the service you signed up for (contract): your account, photos, profile, comments, following and supporter benefits.
• To keep Avitrace secure and accurate (legitimate interests): preventing abuse and password guessing, moderating content, reviewing contributions and keeping a history of changes to aircraft records.
• To run the site (legitimate interests): counting photo views and understanding how features are used, without tracking individuals.
• To meet legal obligations (legal obligation): for example, keeping payment records for tax purposes.

We only email you about your account (confirming your email, password resets and important changes). If we ever offer a newsletter, it will be opt-in.

5. Who we share it with

We don’t sell your information. We only share it with service providers who help us run Avitrace, under contracts that limit how they can use it:

• Krystal, our UK web host, which runs the site and stores its database and photos.
• Amazon Web Services, whose content delivery network (Amazon CloudFront) delivers the site’s images and files from servers around the world, and which sends our account emails (Amazon SES).
• Stripe, which takes supporter payments.

Some providers may process data outside the UK. Where they do, we rely on UK adequacy regulations or the UK’s approved contract terms to protect it. We may also disclose information if the law requires it, or to protect people’s safety or our rights.

6. How long we keep it

• Your account and what you’ve added: for as long as you have an account.
• Sign-in sessions: they expire 30 days after you last use them.
• Failed sign-in attempts: 1 day.
• Email confirmation and password reset links: they expire after 24 hours and 1 hour.
• Photo view identifiers: deleted within 2 days.
• Payment records: up to 6 years, as tax law requires.

If you ask us to delete your account, we delete your profile, email address, photos and comments. Changes you made to aircraft records stay, because they form the public history of each aircraft, but they’re no longer linked to you. Backups are overwritten in the normal course of time.

7. Your rights

Under UK data protection law you can ask us to:

• give you a copy of your personal information;
• correct anything that’s wrong;
• delete your information;
• restrict or object to how we use it;
• send it to you, or another service, in a portable format.

You can change most of your details yourself on your account page. For anything else, including deleting your account, email [email protected]. We’ll reply within one month.

If you’re unhappy with how we’ve handled your information, please tell us first. You can also complain to the Information Commissioner’s Office at ico.org.uk.

8. Cookies

Avitrace only uses cookies that are needed for the site to work, so we don’t ask for consent:

We don’t use analytics, advertising or social media cookies.

9. Children

You must be 13 or over to create an Avitrace account. If you believe a child under 13 has an account, email [email protected] and we’ll remove it.

10. Changes to this policy

If we make significant changes, we’ll update the date at the top and, where it matters, tell you by email or on the site before they take effect.