Privacy Policy

Welcome to AviaSkill, operated by YMI Digital LLC ("we," "our," or "us"). We are committed to protecting your personal information and your right to privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our aviation exam preparation platform and free aviation tools.

This policy applies to all users, including visitors using our free tools (no account required), free trial users, and paid subscribers.

Information We Collect

Information You Provide

• Account Information: Name, email address, password (when you create an account)
• Profile Information: Aviation certifications, study preferences, exam goals, target certification
• Payment Information: Processed securely through Stripe — we do not store your full card number, CVV, or billing address on our servers
• Communications: Messages you send through our contact form, support emails, or AI chat tutor
• Referral Information: When you participate in our referral program, we store your referral code and track successful referrals to apply discounts

Automatically Collected Information

• Usage Data: Study sessions, question responses, progress metrics, exam simulation results, time spent on platform features
• Device Information: IP address, browser type, operating system, screen resolution
• Analytics Data: Page views and visitor counts (via Vercel Analytics — privacy-focused, no personal data), Core Web Vitals performance metrics (via Vercel Speed Insights — no personal data)
• Error Data: Error reports and performance traces (via Sentry — includes error context and session replay for debugging, but not personal data)
• Tool Usage: When you use our free aviation tools (crosswind calculator, METAR decoder, unit converter), we collect anonymous usage analytics. No personal data is collected from unauthenticated tool usage.

How We Use Your Information

• Provide Services: Deliver personalized study experiences, track your progress, generate study recommendations, and power exam simulations
• Authentication: Verify your identity and manage your account via Supabase Auth
• Payment Processing: Process subscription payments, manage billing, and apply promotional/referral discounts via Stripe
• AI Features: Generate personalized explanations, study recommendations, and chat responses — see the AI Data Handling section below for details
• Improve Platform: Analyze anonymous usage patterns, monitor performance (page load times, error rates), and develop new features
• Communications: Send transactional emails (welcome, password reset, billing receipts), subscription notifications, and occasional product updates — see the Email Communications section below for details
• Security: Detect fraud, enforce rate limits, prevent abuse, and enforce our Acceptable Use Policy
• Legal Compliance: Comply with applicable laws and regulations
• Referral Program: Track referral codes, apply discounts to both referrer and referred user, and cap rewards per our program terms

Third-Party Services

We use the following third-party services to operate AviaSkill. We share only the minimum data necessary for each service to function:

We do NOT:

• Sell your personal information to anyone
• Share your data with advertising networks
• Use tracking pixels from social media platforms
• Allow third parties to use your data for their own marketing
• Use your study data to train AI models (OpenAI's API does not use API inputs for training)

How We Use AI

AviaSkill uses OpenAI's API to power two features:

1. AI Explanations: When you answer a practice question, we may send the question text, answer options, and your selected answer to OpenAI to generate a personalized explanation. We do NOT send your name, email, or any personal identifiers.
2. AI Chat Tutor: When you use the chat tutor, your conversation messages are sent to OpenAI to generate responses. Conversations are stored in our database (Supabase) for your convenience. We do NOT send personal identifiers with chat requests.

Important facts about our AI usage:

• OpenAI does NOT use API inputs to train their models (per their API data usage policy)
• We do not build user profiles from AI interactions
• AI responses are not used for advertising or sold to third parties
• You can delete your chat history at any time from your account settings

How We Protect Your Data

We implement industry-standard security measures:

• Encryption in Transit: All data transmitted using TLS/SSL (HTTPS enforced)
• Authentication: Secure password hashing and session management via Supabase Auth
• Database Security: Row-level security (RLS) policies ensure users can only access their own data
• Access Controls: Role-based access control with least-privilege principles
• Rate Limiting: Protection against brute force attacks via Upstash Redis
• Security Headers: Content Security Policy, HSTS, and other HTTP security headers via Vercel
• Monitoring: Real-time error tracking (Sentry) and performance monitoring
• Dependency Security: Automated dependency vulnerability scanning via Dependabot

No system is 100% secure. While we take reasonable measures to protect your information, we cannot guarantee absolute security. If we discover a data breach affecting your personal information, we will notify you and relevant authorities as required by law.

How Long We Keep Your Data

Your Rights

Depending on your location, you may have the following rights:

• Access: Request a copy of the personal data we hold about you
• Correction: Update or correct inaccurate information (most changes can be made directly in Settings)
• Deletion: Delete your account and all associated personal data (available in Settings > Account)
• Export: Download your study progress data
• Opt-Out: Unsubscribe from product update emails at any time (transactional emails like password resets and billing receipts are still sent)
• Restriction: Request that we limit how we process your data in certain circumstances
• Portability: Receive your data in a structured, machine-readable format
• Withdraw Consent: Where processing is based on consent, you may withdraw it at any time

To exercise these rights, contact us at privacy@aviaskill.com. We will respond within 30 days (or sooner if required by your local law).

Cookies and Tracking Technologies

We use cookies and similar technologies as described in our Cookie Policy. In summary:

• Essential cookies: Authentication, security (cannot be disabled)
• Functional storage: Study preferences, theme settings (localStorage, not cookies)
• Analytics: Privacy-focused page view tracking via Vercel (no personal data)
• Payment: Stripe fraud detection cookies (only during checkout)

What we don't use: No advertising cookies, no social media trackers, no cross-site tracking, no data selling.

For full details and how to manage your preferences, see our Cookie Policy.

Free Tools & Unauthenticated Usage

AviaSkill offers free aviation tools (crosswind calculator, METAR/TAF decoder, unit converter, and more) that do not require an account or sign-in.

When you use free tools without signing in:

• We do NOT collect your name, email, or any personal information
• We collect anonymous page view analytics (via Vercel Analytics) to understand tool popularity
• Tool preferences you save (e.g., personal minimums in the crosswind calculator) are stored in your browser's localStorage on your device — not on our servers
• If something goes wrong, Sentry may capture an anonymous error report

When you use free tools while signed in:

• The same anonymous analytics apply
• Your tool preferences may be associated with your account for sync across devices (future feature)

Referral Program Data

When you participate in AviaSkill's referral program:

• We generate a unique referral code linked to your account
• When someone uses your referral code, we record the referral relationship to apply discounts
• We track the number of successful referrals to enforce the reward cap (currently 12 referrals per account)
• Referral discount details are stored in our database and shared with Stripe for coupon application
• We do NOT share your personal information with the person you referred, or vice versa

Emails We Send

We send the following types of emails:

Transactional (cannot be unsubscribed):

• Welcome email when you create an account
• Password reset requests
• Billing receipts and subscription confirmations
• Account security alerts (e.g., sign-in from new device)
• Account deletion confirmation

Product Updates (can be unsubscribed):

• New feature announcements
• New certification or tool launches
• Study tips and platform updates

We do NOT send:

• Third-party marketing emails
• Emails on behalf of advertisers
• Promotional emails to non-users

You can unsubscribe from product update emails at any time using the link in the email footer or by contacting support@aviaskill.com.

Children's Privacy

AviaSkill is not intended for children under 13 years old (or 16 in jurisdictions where GDPR applies). We do not knowingly collect personal information from children under these ages.

If you believe a child under these ages has provided us with personal information, please contact us at privacy@aviaskill.com. We will promptly investigate and delete the information.

Note: Student pilots must be at least 16 years old to obtain a Student Pilot Certificate from the FAA, which aligns with our minimum age requirements.

International Data Transfers

AviaSkill's servers and third-party service providers are primarily located in the United States. If you access our platform from outside the United States, your information may be transferred to and processed in the US.

We ensure appropriate safeguards are in place:

• Our hosting provider (Vercel) and database provider (Supabase) maintain appropriate security certifications
• Payment processing through Stripe is PCI DSS Level 1 compliant globally
• We process data lawfully based on contractual necessity, legitimate interests, or your consent

If you are in the European Economic Area (EEA), UK, or other regions with data transfer restrictions, your continued use of AviaSkill constitutes consent to the transfer of your data to the United States, subject to the safeguards described above.

California Privacy Rights (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act:

• Right to Know: What personal information we collect, use, share, or sell
• Right to Delete: Request deletion of your personal information
• Right to Opt-Out of Sale: We do NOT sell your personal information, so there is nothing to opt out of
• Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights

To exercise these rights, email privacy@aviaskill.com with "CCPA Request" in the subject line. We will verify your identity and respond within 45 days.

European Privacy Rights (GDPR)

If you are in the European Economic Area (EEA) or the United Kingdom, you have rights under the General Data Protection Regulation:

• Right of Access: Obtain a copy of your personal data
• Right to Rectification: Correct inaccurate or incomplete data
• Right to Erasure: Request deletion of your data ("right to be forgotten")
• Right to Restrict Processing: Limit how we process your data
• Right to Data Portability: Receive your data in a structured format
• Right to Object: Object to processing based on legitimate interests
• Right to Withdraw Consent: Where processing is based on consent, withdraw it at any time

Legal bases for processing:

• Contract: Processing necessary to provide the services you signed up for
• Legitimate interests: Analytics, security, service improvement
• Consent: Marketing emails, optional cookies
• Legal obligation: Tax records, fraud prevention

Data Protection Authority: You have the right to lodge a complaint with your local data protection authority if you believe your rights have been violated.

To exercise your GDPR rights, email privacy@aviaskill.com with "GDPR Request" in the subject line.

Changes to This Policy

We may update this Privacy Policy when we add new features, change service providers, or adapt to new privacy regulations. When we make significant changes, we will:

• Update the "Last Updated" date at the top of this page
• Post a notice on our website for at least 30 days
• Email active account holders about material changes

Continued use of AviaSkill after changes constitutes acceptance of the updated policy. If you disagree with changes, you may delete your account at any time.

Contact Us

If you have questions or concerns about this Privacy Policy or our data practices:

We aim to respond to all privacy inquiries within 30 days.