Your travel is yours. Here's what we keep.

This policy covers the Squawk iPhone app, this website (thesquawkapp.com) and the Live Share and pickup pages that shared links open there. It says what we collect, why, who helps us handle it, and the choices you have.

To be confirmed: the legal name and address of the business that runs Squawk and is responsible for your data will be added here before this draft becomes final.

To reach us about privacy: support@thesquawkapp.com.

You sign in with your email address and a one-time code. Sign-in is run by Clerk, which keeps your email address, your sign-in sessions, your first name if you give one, and the profile photo you upload. Clerk gives each account an ID, and that ID is the only thing our own database uses to know which rows are yours. We don't copy your email address into it.

When you set up your profile you choose a handle and a display name. The app may suggest a name from your Clerk first name or the start of your email address; whatever you save becomes your display name, and you can change it.

When you're signed in, Squawk keeps the following in its database (Neon, a hosted Postgres service), so it follows you to every device you sign in on:

• Your flight log: airline, flight number, date and route, and anything you add or import with it, such as aircraft, seat, cabin, times, gates and registration. Flights you hide stay private to you.
• Saved things: airports and routes you follow, aircraft in My Fleet, how often you've visited each airport, aircraft ratings, and your watchlist (flight numbers and the name you put against each).
• Settings: units, theme, home airport, notification choices, sharing choices, up to three passport countries (for entry rules; never passport numbers), and your wallet's loyalty programmes: name, tier, balance, expiry and the last four digits of the membership number only.
• Your profile: handle, display name, the social links you add, and the address of your cover photo.
• Social and plan records: friend requests, friendships and blocks; the Live Share links you make; your invite code and who joined with it; Family Pro memberships and invites.

Imports stay on your phone until you choose. A file you import (from Flighty, myFlightradar24, a calendar or a spreadsheet) is read on your iPhone, you review the flights it found, and only the flights you accept are sent to Squawk. When you're signed out, your preferences are kept on the phone only, in its secure storage.

We use this data to run the app for you: to show your trips, look up your flights, power your passport and stats, and share what you've chosen to share. Nothing in your log is used to train an AI model.

Plans are bought through the App Store. Apple takes the payment, and we never see your card or bank details, your billing address or your Apple Account email.

RevenueCat manages subscriptions for us. It receives your purchase records from Apple (which product, when, and whether it renews or was refunded), linked to your Squawk account ID so your plan works on every device. We don't send it your name or email. Our server asks RevenueCat which plan you have before it unlocks a paid feature, and uses it to grant referral weeks. When a referral reward is involved, we keep the product and transaction ID of the qualifying purchase.

When you add a flight, open one, or look at an airport's board, Squawk's server asks a flight-data provider about it: mainly AeroDataBox, reached through an API marketplace, and Flightradar24's data service where we use it. What they receive is the flight number, date, route or airport code. They never receive your name, email or account ID: the request comes from our server, not your phone. US flights in the past are often answered from our own copy of US Bureau of Transportation Statistics records instead.

Answers are cached for a while, so the same flight isn't looked up again for every person who asks.

Your phone asks Squawk's server for the aircraft in the part of the map on screen. Our server gets live positions from adsb.lol, a community network of receivers, in fixed map squares: adsb.lol never learns which area you're looking at, or anything about you. The map itself is drawn by Apple Maps.

Near me uses your location only if you allow it, through iOS. Your position is used on the phone to sort nearby aircraft by distance, and is not sent to us. When the map moves to where you are, the app asks for the aircraft in that part of the map just as it does anywhere else, so our server sees the area on screen, not your position, and doesn't keep it.

The optional US weather radar layer loads its map tiles on your phone, straight from the Iowa Environmental Mesonet at Iowa State University, whose servers see your IP address and the map area those tiles cover.

Aircraft photos come from Planespotters.net, and your phone loads them directly from Planespotters, with each photographer credited. To find a photo, the app sends Planespotters the aircraft's registration or transponder code, including for the aircraft on one of your own flights. Their servers see your IP address and which aircraft was asked for, as any website would. They don't receive anything else about you.

Airline logos are fetched by our server and passed to the app, so the logo services involved see only our server. Some brand logos, such as the loyalty programmes in your wallet and some transit operators, load on your phone from logo.dev, which sees your IP address and which brand's logo was requested.

The app asks for access to your photo library or camera only when you choose a picture. Your profile photo is stored by Clerk with your sign-in account. Your cover photo is stored in Vercel Blob, Vercel's file storage, at a web address made of random characters: it isn't listed anywhere, but anyone given that address could open it. Replacing or removing your cover in the app deletes the old file.

Your photos are shown to your accepted friends and to anyone you send a friend request to. Your profile photo also appears to the people in your Family Pro group.

When you ask Squawky something, your question goes to our server, which sends it to an AI model through the Vercel AI Gateway. Today the models are Anthropic's Claude. To answer, Squawky can look up and pass to the model: your flight log, your friends' shared flights, your passport countries, and flight, airport and weather information.

• The gateway receives a one-way scrambled stand-in for your account ID, never the ID itself, your name or your email.
• We switch on the gateway's setting that disallows using your prompts to train models.
• We don't store your conversations. The app keeps the chat while it's open; our server logs only the scrambled ID, which tools Squawky used, and how long the answer was.

Vercel and Anthropic handle the request under their own terms for business customers.

Squawk forecasts arrivals from how flights have actually run. So when Squawk learns how a flight went (from a lookup, or from a flight in someone's log), it keeps one record of the flight, not the traveller:

• airline, flight number, origin, destination and date;
• the scheduled and actual arrival, and whether it arrived, was cancelled or was diverted;
• where the information came from, and when.

There is no account ID, seat, booking, note or anything else that links a record to a person, and records from several people on the same flight become one. They feed counted statistics (how often a flight arrives late, and by how much), not an AI model.

Because these records describe flights and can't be traced back to you, they stay after you delete your data or your account. Records that came from a flight-data provider are kept only as long as that provider's terms allow (7 days for AeroDataBox, 30 days for Flightradar24); records from logged flights have no fixed limit.

A Live Share or pickup link opens a web page that anyone with the link can see, without an account. You decide who gets it, and it can be forwarded on. The page shows:

• your first name (the first word of your display name);
• for the flights you shared only: airline, flight number, airports, dates, times, status, terminal, gate and baggage belt.

It doesn't show your email, handle, seat, other trips or friends. The link contains a coded reference to your account and flights that means nothing without our server, which checks it every time the page opens. The pages ask search engines not to index them.

• They expire: a trip link 24 hours after the last flight lands; a pickup link 48 hours after the day the flight leaves.
• You can stop them: Stop sharing in the app ends every link to that flight at once, wherever it was sent. Deleting the flight ends them too.
• The preview picture that Messages or WhatsApp made when the link was sent stays in that chat: it's a copy on someone else's phone.
• Our record of a link (its ID, flights and dates) is cleared 30 days after it ends.

Anyone signed in to Squawk can find you by searching for your handle, and sees your handle and display name. People you block can't find you or open your profile.

Accepted friends always see your display name, handle, profile photo, cover photo and social links. Everything else follows the switches under “What friends can see” in the app:

• Passport and countries is on unless you turn it off: your first passport's country, the countries you've flown to, and a page of stamps for each year.
• Flight statistics, Airports visited, Route map, Individual flights and My Fleet are off until you turn them on. The first time you have a friend, the app asks which to share, with all of them offered ticked; nothing changes until you save.
• “Flight statistics” shares totals: how many flights and how far, charts by year, month and weekday, your top airlines and the aircraft types you've flown. Never a date to the day.
• “Route map” draws the routes you've flown on your friends' map of your travels.
• “Individual flights” shares the flights in your log, upcoming ones included, but not the extra details (times, gates, seat) or any flight you've hidden. With it on, dates show to the day.
• A flight you hide is left out of everything friends see, totals included. On Squawk Free, friends see the same last year of flights you do.

If a friend shares their flights, they can appear on your live map, and Squawky can use them to answer you; the same goes for your shared flights and your friends. Sharing is only ever with people you've accepted, never the public.

Each airport has a public chat for spotters. What you post there is public: anyone viewing that airport's chat can read it, with your display name, handle and profile photo, whether or not they're signed in. Don't post anything you wouldn't say out loud at the fence.

• Kept 7 days: messages are deleted automatically a week after they're posted. You can delete your own sooner.
• Reports: anyone signed in can report a message. Each report is emailed to us with the message, the airport and its author's account ID so we can act on it, and a message reported by three people is hidden until we review it.
• Bans: we remove messages that break the chat rules and ban the accounts that post them from chatting.
• Blocking: people you block are kept in your account settings and their messages are hidden on your phone. They aren't told.

Your messages, reports and any ban are deleted with your account, and your account export includes the messages you've posted.

With spotter mode on you can add a place to watch aircraft from to an airport's map: its position, a name, notes, which way it faces, how you get in and, if you like, a photo. We check each one before anyone else sees it. Once approved it is public, with your handle and display name beside it.

• Location: only the pin you place is kept. If you tap “Where I am”, your phone's position moves the map to you and is not sent or stored.
• Photos: the app removes the camera's details (where and when the photo was taken, and on what) before it's sent, and we refuse a photo that still has them. Photos are stored by Vercel Blob at a random address.
• Review and reports: each new spot and each report is emailed to us with the spot and its author's account ID, so we can approve, refuse or remove it. A spot reported by three people comes off the map until we review it.

You can delete your spots at any time. They, their photos, the reports you've made and any bar on adding spots are deleted with your account, and your account export includes them.

If you join the beta list on thesquawkapp.com, we keep your email address, whether you asked for a beta invite or the launch notice (or both), which page you signed up on, and when. We use it only to confirm that you've joined, to send beta invites and to tell you when Squawk launches. It isn't linked to a Squawk account, and we don't keep your IP address (it's used for a moment to stop spam sign-ups, then forgotten).

These emails are sent through Resend, an email delivery service, which receives your address and the message in order to deliver it. They carry no tracking pixels or tracked links.

Every email from the list ends with a “Remove me from the list” link. It opens a page where one press of the button deletes your address from the list; the Unsubscribe button some mail apps show does the same. You can also email support@thesquawkapp.com from that address and we'll delete it.

A beta invite goes out through Apple's TestFlight, so we give Apple the email address to invite. TestFlight then shares with us the feedback and screenshots you choose to send, crash reports, and basic details such as which build you installed, under Apple's privacy policy.

• Widgets: the app writes a small file for its widgets with up to four upcoming flights (flight numbers, airports, times, gates and seat), this year's travel stats and your passport's country. It sits in the app's own protected storage on the phone, is read only by Squawk's widgets, and is never sent anywhere. On the Free plan it holds no flights.
• Reminders: check-in and doors-closing reminders are scheduled by your phone, and send nothing to our server. Gate and time alerts come from our server: see Flight alerts.
• Squawk Card and share images are made on your phone and go only where you send them. Sharing to Instagram Stories hands the picture to Instagram.
• Ride apps: if you tap to book a ride, Squawk opens Uber, Lyft or another ride app with the airport or terminal as the pickup or drop-off point. That app takes it from there, under its own privacy policy. Yandex Go links pass through Yandex's own link service on the way.

Gate changes, new times, cancellations and diversions are sent by Squawk's server, for the flights in your account. When you turn one of these alerts on:

• the app gives our server this phone's push token, a code Apple uses to reach the app, with the app's version and whether it's a test or App Store build. While a Live Activity is on your Lock Screen, its own token is sent too, so the server can update it;
• to follow a flight, our server gives AeroDataBox its flight number, and AeroDataBox tells us when its gate or times change. Nothing about you goes with it;
• Apple delivers each push. It sees the token and the alert itself: the flight, gate and time, never your name or booking.

We delete a token when Apple says it no longer works, when its Live Activity ends, and with your account. Turning the alerts off, or notifications off for Squawk in iOS Settings, stops them reaching you.

Squawk has no advertising, and it contains no analytics, advertising or tracking SDKs. We don't sell your personal data, share it for advertising, or use Apple's advertising identifier, so the app never asks to track you across other apps.

thesquawkapp.com sets no advertising cookies, and no analytics cookies unless you accept them, and its fonts are served from our own site. It counts page visits with Vercel Web Analytics, which uses no cookies and doesn't identify you across sites: it records the page, the referring site, and your rough country, device and browser, and we strip the private part of shared links (Live Share, pickup and invite addresses) before anything is counted. The marketing pages also run Google Analytics in Google's Consent Mode. Until you choose "Accept" in the cookie banner it sets no cookies and sends Google only cookieless pings (the page address without its query, your browser details and your IP address, which Google Analytics uses for rough location and doesn't store), which Google uses to estimate visits. If you accept, it also sets analytics cookies (named _ga and _ga_ followed by an id) to count return visits; advertising features stay off either way. It never runs on shared-link pages, and "Cookie settings" at the foot of every page changes your answer. The app itself has no analytics. Like any website, our host keeps standard server logs (such as IP addresses and the pages requested) for a limited time, for security and to keep the service running.

These services handle data for Squawk. Each gets only what its job needs, and the ones that work for us handle it on our instructions. adsb.lol and the public data sources our server reads (OpenStreetMap, weather and transit services) receive no personal data at all.

We may also disclose data if the law requires it, or to protect people from harm.

• Your account data: until you delete it or ask us to close your account.
• Live Share link records: 30 days after the link ends.
• Anonymous flight records: as described above, and after your account is gone.
• The beta list: until Squawk launches and the launch notice has gone out, or until you remove yourself with the link in our emails, or ask us to.
• Server logs and our providers' backups: for the limited periods those services keep them.

In the app, go to Settings → Account → Delete account. Squawk says what goes and asks you to confirm twice, then deletes your account and everything on it straight away. To delete your data but keep your account, or if you can't get into the app, email support@thesquawkapp.com from the address you sign in with.

Deleting your account removes

• your flight log, saved airports, routes and aircraft, airport visits and watchlist;
• your settings, including your wallet, passport countries and home airport;
• your profile, handle, social links and aircraft ratings;
• your friendships and sharing choices, and your invite code, referral and Family Pro records (a family you pay for ends, and its members lose the Pro it gave them);
• your Live Share and pickup links, which stop working at once;
• the push tokens our server holds for your phones;
• your cover photo, and your Clerk sign-in account with your email and profile photo.

What stays

• The anonymous flight records described above, which can't be linked to you.
• Your beta-list entry, unless you ask for that too.
• Purchase records that Apple and RevenueCat must keep for tax and accounting.

Deleting your account or the app doesn't cancel a subscription. Cancel it first in your iPhone's Settings: tap your name, then Subscriptions. The app links there before it deletes anything.

Your flight log is yours to take elsewhere. In the app, go to Settings → Account. Export my data saves your flight log, saved places, watchlist and settings as a JSON file, and Flight log as CSV saves a file that Squawk (and most spreadsheets) can read back. For a copy of everything else we hold, such as your profile, friends and invites, email us from the address you sign in with and we'll send it.

Depending on where you live (for example under the GDPR in the EU and UK, or California's privacy laws), you have the right to know what we hold about you, get a copy, correct it, delete it, take it elsewhere, and object to or restrict how we use it. We'll answer such requests without charge, and we won't treat you differently for making one. We don't sell personal data or share it for targeted advertising.

Where the GDPR applies, we use your data to provide the app you've asked for, for our legitimate interests in keeping Squawk secure and improving its forecasts with anonymous records, and with your consent for things like your location, which you can withdraw in iOS Settings at any time. You can also complain to your local data protection authority.

Squawk isn't directed at children under 13, and we don't knowingly collect personal data from them. If you believe a child under 13 has given us personal data, contact us and we'll delete it.

Our service providers run their systems in the United States and other countries, so your data may be processed outside the country where you live. Where the law requires it, we rely on safeguards such as the European Commission's standard contractual clauses that these providers offer.

We'll update this policy when Squawk changes what it does with data, and change the date at the top. If a change matters, we'll tell you in the app or by email before it takes effect.

Questions, requests or complaints about privacy: support@thesquawkapp.com. The terms of use cover the rest of how Squawk works.