← Back

Privacy Policy

Last updated: July 22, 2026

Courtesy translation — the French version is legally authoritative.

This policy explains how Spin & Fly handles your personal data, in line with the General Data Protection Regulation (GDPR).

1. Data controller

The controller of your data is Thomas Berlioz, sole proprietor (micro-enterprise), 4 Place Jean Chorel, 69100 Villeurbanne, France — SIREN 927 622 696. Contact: privacy@spinandfly.app. See also the legal notice.

2. Data collected

  • Account: email address, username (handle), avatar, bio, preferred simulators and aircraft, display preferences.
  • Activity: flights you've logged, ratings, tag votes, and reports you submit.
  • Media: screenshots you upload.
  • Technical: the session cookie required to keep you signed in. Our hosts and our error-monitoring tool (Sentry) may log technical data (IP address, user-agent, error trace) for the security and sound operation of the Service. A cookieless, storage-free analytics tally (PostHog, Vercel) counts page views and a few key actions in aggregate, without identifying you.

3. Purposes and legal basis

  • Performance of the contract: providing the signed-in features (account, logbook, ratings, media).
  • Legitimate interest: keeping the Service secure, preventing abuse (anti-spam, moderation), and monitoring technical errors.

4. Retention period

Your account data is kept for as long as your account exists: you can delete it at any time from your settings (immediate erasure), or write to us at privacy@spinandfly.app (handled within 30 days). Technical data is kept minimally: the IP addresses used for anti-abuse (rate-limiting) are purged automatically within 1 hour; our hosts' logs and error traces (Sentry) are kept for at most 90 days for security purposes, then deleted or anonymized. Audience-measurement data, which is anonymous (no cookie, IP address stripped and replaced by a hashed identifier rotated daily), is kept by our provider PostHog for at most 7 years.

5. Your rights

You have the rights of access, rectification, erasure, portability, and objection over your data. You can exercise erasure and portability directly from your settings (“Delete my account” and “Export my data”). For the other rights — or if you prefer — write to privacy@spinandfly.app: we respond within 30 days at the latest.

6. Processors and third parties

The Service relies on the following providers:

  • Neon — database hosting.
  • Cloudflare R2 / Images — screenshot storage and delivery.
  • Vercel — application hosting.
  • Resend — transactional email delivery.
  • MapTiler — base map.
  • DeepL (European Union) — machine translation of community route descriptions (French ↔ English).
  • Sentry (European Union) — technical error monitoring (legitimate interest; PII minimized).
  • PostHog (EU Cloud) — cookieless analytics of the product journey, with no personal data.
  • Vercel Analytics & Speed Insights — real-world traffic and performance, with no cookie.
  • Inngest (United States) — orchestration of notification emails and scheduled jobs; processes account identifiers (userId) to trigger sends.
  • Identity providers — Discord, Google (United States) — if you choose to sign in through one of them, we receive an identifier and basic profile information to create your account; they act as independent controllers under their own policies.

Analytics (PostHog) is active and cookieless: no cookie or local storage is set, no personal data is collected, and the data is hosted in the European Union.

Transfers outside the European Union

Some providers are based in the United States, notably Vercel (hosting), Resend (email), and Inngest (notification orchestration). These transfers are governed in accordance with Chapter V of the GDPR: Vercel is certified under the EU-U.S. Data Privacy Framework and additionally applies the Standard Contractual Clauses; Resend relies on the Standard Contractual Clauses; the other providers concerned are subject to equivalent safeguards set out in their data processing agreements (DPAs).

7. Cookies

Only a strictly necessary cookie (your sign-in session) is used. Analytics and performance measurement are cookieless — no cookie or local storage is set for this purpose — so no interactive consent banner is required.

8. Minors

The Service is intended for an audience of at least 15 years old. If you are under 15, you must have your legal guardians' permission to create an account and use the Service. We do not run active age verification: this is a declarative rule, in line with Article 8 of the GDPR (the 15-year threshold in France for a minor's consent to an online service).