Privacy policy

This is a translation: the French version is the legal reference. Read it in French

Who is responsible

Skypeek is published by EI Eliam Detoh, 47 rue Vivienne, 75002 Paris. The publisher is the data controller for your data.

For any question: contact@skypeek.app.

What we keep

Your account

• Your player name.
• Your password, never in plain text: the server keeps only a hash of it.
• The date your account was created.
• Your sessions: when each phone signed in and when it was last used. The token stays on your phone; the server keeps only a hash of it.
• If you sign in with Google (on Android): your Google account ID, to recognise you the next time. The token Google gives the app also contains your email address and your name: the server verifies the token, then forgets it, without keeping them. You can unlink your Google account in the Profile tab.

No email, no phone number, no real name.

Your catches

With each catch, the app sends the server:

• your location (latitude, longitude, altitude), its accuracy, and whether the phone reports it as simulated;
• the phone’s orientation: the direction you are aiming in, the tilt, the compass accuracy, the measured magnetic field;
• the plane you caught and where the viewfinder placed it.

When you aim at a plane, the app also notes the gap between the compass and the plane’s true direction. These measurements make the viewfinder more accurate.

Your game

• Your collection: cards, albums, numbers, duplicates.
• Your progress: experience, level, day streak, quests, league, Miles and their history.
• The days you open the app while signed in: the date only, not the time or the place.
• Your airport club, if you choose one.
• Your referral code, and who invited you.
• Your notification settings: the topics you chose, the reminder time, the night-time quiet hours and your time zone.
• Your friends and friend requests, your trades, your duels and their Miles stakes, your listings and purchases on the market.

Notifications

If you allow them, your phone gets a notification ID (from Apple or Google, passed on by Expo) that the server keeps in order to notify you. The server logs each notification: its topic, its text, the time, whether it was sent and whether you opened it. The time of the streak reminder is worked out from the times of your catches, unless you choose it yourself.

Rare plane alerts, if you turn them on

• “Around me”: your current location, rounded to about 1 km, sent while the app is open and forgotten after 2 hours, or as soon as you turn the option off.
• The places you save (name, place rounded to about 1 km, radius) and your watchlist (planes, types, airlines, liveries), until you remove them.
• Alerts already sent: the plane and the day.

To watch these places, the server asks for the planes in a wide area (to within about 25 km), never your exact location.

Bug reports

When you report a problem (by shaking your phone or from the Profile tab), the app sends what you write, a screenshot if you keep it, and the state of the phone at that moment: app version, operating system, screens opened just before, latest errors, permissions, sensor readings (orientation, compass, magnetic field) and, if you leave it in, your location rounded to about 1 km. On a screenshot of the map, your dot is hidden, and the screenshot is only sent along with your location; on the viewfinder, the screenshot is only sent if you add it. Everything is shown to you before sending. Bugs posted on our Discord join the same list, with your Discord name. Only the publisher reads them, to fix them.

The Android beta, if you take part

Joining the beta from our Discord takes one click. We keep your Discord name and ID, your player name if you link your account, the steps of your beta and their dates, and the days you open the app during the test. To get the test, you join the testers’ Google group with your Google account: the publisher, who manages that group, sees that account’s email address, and Google signs you up to the test. Your private beta thread on Discord can be seen only by you and the publisher.

Rejected catches

The server rejects a catch if the location is simulated or too inaccurate, if it jumped too far, if the pace is too fast or if the plane is out of range. It then notes the reason, the time, the plane and the location sent. These notes are never shown to other players.

Error reports

When the app crashes or runs into an error, it sends a report to our server, where an open-source tool installed on our own machine (GlitchTip) files it:

• the error message and its technical trace, native code crashes included;
• the last steps before the error: screens opened, buttons tapped (their technical name, never what you type);
• the screen where it happened, without player names;
• the phone’s model, its operating system and version, the free memory and storage;
• the app’s version, its build number and the installed update;
• an ID picked at random when the app is installed, to know how many phones have the same bug. It doesn’t say who you are and isn’t linked to any account.

The report isn’t linked to your account (versions before 21 October 2026 linked it to your account if you were signed in). No location, no photos, no contacts. Your IP address isn’t kept with the reports. Only the publisher reads them, to find and fix bugs.

On your phone

• Your session token and your player name, in the phone’s secure storage.
• A copy of your collection, erased when you sign out.
• A few settings, such as whether you have already seen the welcome screens, and your notification settings.
• Reminders scheduled by the phone itself (streak, follow-ups), without sending anything to the server.

What we don’t take

• No location in the background: the app only reads it while it is open.
• No microphone, no contacts, no photos from your gallery.
• No advertising ID, no tracking from one app to another.

Phone permissions

• Location, only while the app is open: to show the planes around you and check that a plane is in range.
• Camera: the viewfinder. The image stays on your phone: no photo is taken or sent.
• Motion and orientation: to know where you are aiming.
• Notifications: asked for on the welcome screens or after a catch. They are used for streak reminders, news from your friends, your trades, your duels and your league, and rare plane alerts if you turn them on. You choose the topics in the Profile tab.

You can withdraw each permission in your phone’s settings. Without location, no catches.

To show nearby planes, the app asks the server for those in an area around you. This request isn’t tied to your account.

Why, and on what legal basis

Running the game

Account, catches, collection, friends, market, trades, duels, leagues, clubs. Basis: performance of the contract, that is, the terms of use.

Checking catches and preventing cheating

Location, accuracy, simulated location, rejected catches. Basis: our legitimate interest in keeping the game fair for everyone.

Improving the viewfinder

Orientation and compass readings. Basis: our legitimate interest in making the viewfinder more accurate.

Protecting the service

Session hashes, limited sign-in attempts, technical logs, backups. Basis: our legitimate interest in keeping the service secure and available.

Fixing bugs

The app’s error reports. Basis: our legitimate interest in fixing what doesn’t work.

The Android beta

Discord name, Google account address in the testers’ group, steps and days you opened the app. Basis: your request to join the beta. You can leave it whenever you want, on Discord or by writing to us.

Letting you know

Notifications and rare plane alerts, with your current location and your saved places. Basis: your consent, given in the system prompt and by turning on the alerts. You can withdraw it in the Profile tab or in your phone’s settings.

Using the phone’s sensors

Basis: your consent, given in the system prompt. You can withdraw it in the settings.

Who sees what

Your friends

Your catches in their feed: the card, the plane’s photo, the time, the experience earned. Never the place. Trades and duels happen between friends.

Everyone

• Your public profile: player name, level, league, club, number of catches and cards, sign-up date, your three best cards.
• Your name and your experience for the week, in your league group and in your club’s ranking.
• Your name on your market listings.

The publisher

A dashboard reserved for the publisher shows each account in full: sessions, catches with the phone’s location, last catch location, Miles, market, trades, duels, friends, rejected catches. It also shows the app’s error reports and the list of Android beta testers. The testers’ Google group shows the publisher their addresses. It is used to run the game, spot cheating, tune the viewfinder and fix bugs. Nobody else has access to it.

Nobody else

We don’t sell, rent or hand over your data to anyone. No advertising, neither in the app nor anywhere else.

Hosting and third-party services

• The server and the database are hosted in France, on a machine run by the publisher. Backups stay on that machine.
• Cloudflare carries the traffic between the app and the server. It sees your IP address, like any network intermediary. Cloudflare is based in the United States: this transfer is covered by the EU–US Data Privacy Framework and the European Commission’s standard contractual clauses.
• Expo (650 Industries, Inc.), the tool the app is built with, provides its updates: each time the app opens, the phone asks Expo whether there is one. Expo also receives technical statistics, to check that the app runs properly: app opens, installed version and update, phone model and operating system, start-up and screen display times, error reports, and an ID picked at random when the app is installed. Not your player name, your location or your photos; player names that appear in a screen’s address are removed before sending. Expo sees your IP address. Expo is based in the United States: this transfer relies on the European Commission’s standard contractual clauses.
• Notifications go through Expo’s service, then through Apple’s (iPhone) or Google’s (Android), which deliver them to your phone: they see the notification ID and the text of the notification, never your location. These companies are based in the United States: these transfers rely on the EU–US Data Privacy Framework and the European Commission’s standard contractual clauses.
• Our Discord is a service of Discord Inc., based in the United States: what you write there, your beta thread included, is hosted by Discord. For the Android beta, Google (Google Ireland Limited) runs the testers’ group and your sign-up to the test, with your Google account. These transfers rely on the EU–US Data Privacy Framework and the European Commission’s standard contractual clauses.
• The base maps come from Apple Maps on iPhone and OpenFreeMap on Android. Your phone loads them directly: these services see your IP address and the area shown.
• Plane photos are loaded from Planespotters, Wikimedia Commons, Flickr or airport-data. These sites see your IP address, as with any image online.
• The name of a catch’s city comes from your phone’s geocoding service (Apple or Google), based on the plane’s position.
• If you choose “Continue with Google”, Google (Google Ireland Limited) knows that you are signing in to Skypeek, as with any service where you use your Google account. Google is based in the United States: this transfer relies on the EU–US Data Privacy Framework and the European Commission’s standard contractual clauses.

Your Google account data

Only if you choose “Continue with Google” in the app (on Android), or if you link your Google account in the Profile tab.

• What we receive: Google gives the app a signed token that contains your Google account ID, your email address, whether it is verified, your name and your profile picture. The app asks for no other access to your Google account (no contacts, no Drive, no Gmail).
• What we do with it: the server verifies the token with Google, then uses it only to sign you in to your Skypeek account or to create it. Nothing else: no advertising, no profiling, no training of artificial intelligence models.
• What we keep: your Google account ID, linked to your Skypeek account, in our database in France. Your email address, your name and your picture are never stored.
• How we protect it: the token travels encrypted (HTTPS) and is never stored; the ID is kept on our server in France, which only the publisher can access.
• Who we share it with: nobody. Your Google account data is not sold, transferred or shown to other players.
• How to erase it: unlinking your Google account in the Profile tab, or deleting your account, erases the ID straight away. You can also remove Skypeek’s access at myaccount.google.com/connections.

Skypeek’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Aircraft data

Plane positions, details and photos are data about the planes, not about you.

Planes whose owners have had them hidden are never shown. Private owners are never named.

How long we keep it

• Account and game, catch locations included: as long as your account exists. Erased as soon as you delete it.
• Sessions: until you sign out.
• Notification IDs: until you sign out, or as soon as your phone no longer recognises them.
• Notifications sent: 90 days, then erased automatically.
• Bug reports: up to one year after they are fixed, or as soon as you delete your account.
• Android beta (Discord name, steps, membership of the testers’ group): until the end of the beta, then erased, the group included; sooner if you leave it or ask. Days you opened the app: as long as your account exists.
• Location for alerts: 2 hours. Saved places and watchlist: until you remove them.
• Sign-in attempts: counted for 15 minutes, in memory only.
• Technical logs of the server (requests received, errors): erased automatically, within a month at most.
• Error reports from the app: 90 days, then erased automatically. Those that were linked to your account (versions before 21 October 2026) go with it.
• Backups: one a day, kept for 14 days, and one a month, kept for a year. Erased data therefore disappears from the backups within a year at most. They are only used to restore the service after a failure.
• On your phone: until you sign out or uninstall the app.

Security

• Traffic between the app and the server is encrypted (HTTPS).
• Passwords and tokens are stored as hashes.
• Sign-ins are slowed down after several failed attempts.
• Only the publisher has access to the server.

Your rights

You can ask to access your data, to correct it, to erase it or to receive it in a readable format to take it elsewhere. You can object to processing based on our legitimate interest, or ask for it to be restricted. You can also say what happens to your data after your death.

Write to contact@skypeek.app with your player name. We reply within one month. To erase everything, see how to delete your account.

If you think your rights are not being respected, you can lodge a complaint with the CNIL, the French data protection authority: cnil.fr/fr/plaintes.

Minimum age

Skypeek is open to anyone aged 13 or over. Under 15, you also need the consent of a parent, or of the person who holds parental authority, to create an account. That is the rule under French law (article 45 of the French Data Protection Act, the loi Informatique et Libertés).

A parent who thinks their child under 13 has an account can write to us: we will delete it.

Changes

If this policy changes, the new version is published here with its date. Any important change is also announced in the app.