Privacy

Who is responsible

Sustainable Aviation Lab GmbH Averhoffstraße 8, 22085 Hamburg, Germany Amtsgericht Hamburg HRB 165615 · USt-IdNr. DE335608543 Represented by Stephan Uhrenbacher info@futureaero.org · +49 172 579 4663

If you only read the site

You can read every airfield page, guide and forum thread without an account and without accepting anything. No account is created, and no analytics or advertising cookie is set.

Our web server is configured without an access log, so no persistent record of your IP address and the pages you visited is written to disk. Errors are written to the operating system's journal for diagnosis and rotate automatically.

Two things still reach other companies when a page draws a map or a video, because your browser fetches those directly. They are listed under “Who else sees data” below.

If you have an account

Creating an account requires an email address, a username and a password. The password is stored only as a bcrypt hash; we never see it.

Everything else is optional and is there because you chose to add it: display name, profile picture, short bio, home airfield, aircraft types, licences and ratings, country, phone number, websites, and whether you are open to flying with others.

We record when you last signed in and when you were last active, so the site can order people by who is around and so the weekly email knows whether to bother you.

Legal basis: Article 6(1)(b) GDPR — processing necessary to provide the service you asked for. The optional profile fields rest on your consent, Article 6(1)(a), which you withdraw by deleting them.

What you publish is public

Airfield notes, photographs, ratings, wiki sections, forum posts and video links are published under your username and are visible to anyone, including search engines. That is the point of the site — a note about where to park is worth nothing if only you can read it.

Your full name is not shown anywhere public. Pilots are identified by username throughout, including in emails. A profile can be set to private in your profile settings, and photographs, home airfield and tail numbers each have their own visibility switch.

Photographs may carry EXIF metadata, including the time and the coordinates where they were taken. We read the capture time and location to place a photo, and they remain in the stored file.

Email

We send you an address-verification link when you register, a weekly round-up of activity at the airfields you follow if you have not turned it off, notifications you switched on, and — only if you ticked the box — occasional news about CAVOK.

Every one of those can be turned off in your profile settings, and marketing email is off unless you actively opt in. Legal basis: Article 6(1)(b) for service email and Article 6(1)(a) for the news list.

Cookies and local storage

There is nothing else. The banner offers optional analytics, and no analytics service is running on CAVOK at the moment — if that changes it will appear here first and it will stay behind the banner.

cavok_session

A signed token that keeps you logged in. Strictly necessary, so it needs no consent. Thirty days, or until you sign out.

cookie-consent (local storage)

Remembers which button you pressed on the cookie banner, so it stops asking. Stored in your browser, never sent to us.

Who else sees data

Reference data comes from OurAirports, openAIP and the national AIPs. Those are downloads of aeronautical data and involve nothing of yours.

We do not sell personal data and we do not share it for anyone else's marketing.

Hetzner Online GmbH (Germany)

Hosting. All data sits on a server in Germany. Processor under a data-processing agreement.

Resend (USA)

Sends our email. Receives your address and the message. Third-country transfer on EU Standard Contractual Clauses.

CARTO (Spain/USA)

The street map on airfield pages. Your browser requests the tiles, so CARTO sees your IP address whenever a map renders.

National mapping agencies

Aerial imagery comes from each country's own orthophoto service — for example the German state survey offices, IGN in France, swisstopo in Switzerland. Your browser requests those tiles directly, so that agency sees your IP address.

DeepL SE (Germany)

Translates notes and forum titles into your language. The published text is sent; no personal identifier is.

YouTube / Instagram

Only on pages where somebody has added a video, and only when the embed loads. YouTube is requested through youtube-nocookie.com.

How long we keep it

Account data stays until you ask us to delete the account. Content you published stays while the account exists, because other pilots rely on it.

Verification and password-reset tokens expire and are cleared on use. Sign-in timestamps are kept for the life of the account.

Your rights

You can ask for a copy of your data, correct it, have it erased, restrict or object to its processing, and receive it in a portable form. Where processing rests on consent you can withdraw that at any time, which does not affect what was lawful before.

There is no delete-my-account button on CAVOK yet. Until there is, email info@futureaero.org and we will do it by hand — the request is honoured the same way, it is simply not self-service, and we would rather say that than imply otherwise.

You can complain to a supervisory authority. Ours is Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit, Ludwig-Erhard-Straße 22, 20459 Hamburg.

Children

CAVOK is not aimed at children and we do not knowingly collect their data.

Changes

When this notice changes the date at the top changes with it. Material changes are announced on the site.