← UAS SkyCheck|

Privacy Policy

Effective: September 13, 2026 (supersedes September 11, 2026)

This Privacy Policy describes how UAS SkyCheck, a product of SudoKodes LLC (“we,” “us,” or “our”) collects, uses, and shares information when you use UAS SkyCheck at uas-skycheck.app (the “Service”). By using the Service you agree to the practices described here.

Our Commitment

We built UAS SkyCheck to help drone pilots make better preflight decisions, not to collect or monetize personal data. Our data practices follow directly from that purpose:

  • We do not sell your data. Your personal information, flight check history, and location queries are never sold to third parties, data brokers, advertisers, or anyone else. This is an unconditional commitment, not subject to exceptions or future policy changes without explicit notice.
  • We do not use your data for advertising. We have no advertising partners. We do not build behavioral profiles, serve targeted ads, or share data with ad networks. UAS SkyCheck is ad-free by design.
  • Data is used only to serve you. The information we collect exists for one purpose: to provide accurate preflight intelligence and improve the product for pilots. Usage patterns help us understand which features matter most and which data gaps need filling. That is the full extent of it.
  • No AI provider receives your data. Flight check requests are processed entirely on our own infrastructure. No data is sent to OpenAI, Anthropic, Google, or any other AI or machine learning provider.

1. Information We Collect

Information you provide

  • Account information: when you sign in with Google, Supabase receives your Google identity and we store the email address and the name your Google account shares. The profile picture Google shares is shown in the app from your sign-in session and is not stored by us.
  • Payment information: billing details entered during checkout are processed directly by Stripe. We do not store payment card numbers.
  • Saved locations: if you save a location, we store the name you give it and its coordinates against your account, so it is there on your next flight, together with any alert settings you turn on for it (whether alerts are on, and your wind threshold). Delete one at any time and the record is removed.
  • Condition alerts: if you turn on alerts for a saved location (Captain), a scheduled job checks that location’s conditions and emails you when a TFR appears or the wind crosses your threshold. If you also turn on push alerts on a device, we store that device’s push subscription (the endpoint and keys your browser issues) so the same alert can reach it. Turning alerts off, or the push toggle off, removes the corresponding record.
  • Flight logs: if you save a briefing to your flight log, we store the location, altitude, safety score, resulting status, the full briefing data for that flight, which of your aircraft it was, and the fields you fill in: the purpose of the flight, your crew role, a LAANC authorization number if you enter one, the outcome, and any notes. This is a compliance record you chose to keep; it is yours, and deleting an entry removes it. A log saved while you are offline waits in your browser’s storage until it can be sent.
  • UAV profiles: the aircraft details you enter -- name, weight class, maximum altitude, and, if you provide them, your FAA registration number, the aircraft’s Remote ID serial, and a battery cycle count with the threshold you want to be warned at. The registration and serial fields are optional and appear only on your own briefings. We never transmit them to the FAA or to any third party.
  • Part 107 certificate date: if you enter the expiry date of your Part 107 recency, we store it against your profile and email you a reminder 90 and 30 days before it. Clear the field and the reminders stop.
  • Support communications: messages you send to admin@sudokodes.com.

Updated September 11, 2026. Four things the software already stored were missing from this list: alert settings and push subscriptions for saved locations, the Part 107 certificate date, the Remote ID serial and battery cycle count on an aircraft profile, and the purpose, role, LAANC number and outcome fields on a flight log. Each is something you enter yourself and can remove yourself; none was collected without your action. The list now matches the tables.

Information collected automatically

  • Location queries: the coordinates, zip code, city, or airport identifier you enter when running a pre-flight check. These are sent to our backend API to generate your results. They are not written to your account: the exceptions are the ones you choose above, a location you save or a briefing you write to your flight log. Two things do happen with a query in the course of answering it. The weather and airspace results for a coordinate are held in a short-lived server cache (minutes, keyed on the coordinate, not on you) so the next check nearby is faster. And to name the place a coordinate falls in, the backend sends the coordinate, and nothing else, to OpenStreetMap’s Nominatim service, which returns a locality name. Our product analytics record the two-letter state a check fell in, never the query you typed. If you use the Share feature, your check coordinates are included in the shareable URL as query parameters (e.g., ?lat=37.62&lng=-122.38&alt=200). Anyone with the link can view these coordinates and re-run the check for current conditions. Do not share links if you do not want the location known to the recipient.
  • Usage data: the number of checks you run per day, associated with your account when signed in to enforce subscription limits, and which paid features you touch during a trial, used to personalise the end-of-trial email.
  • Product analytics events: when you run a check, view a tab, hit a limit or tap an upgrade prompt, the app records the event with a random session identifier kept in your browser and, when you are signed in, your account id, plus a few properties (the state a check fell in, the airspace class, the score, the verdict, the altitude, the page). We read these in aggregate to see which features matter and where the data is thin. They are linked to your account rather than anonymous; when your account is deleted the link is removed and the events remain under the session identifier alone.
  • Device and log data: IP address, browser type, operating system, and request timestamps collected in standard server logs. Logs are retained for up to 90 days and used solely for security, debugging, and abuse prevention.

Updated September 11, 2026. This section said location queries were “not stored beyond the immediate request” and that usage data was “aggregate, anonymized”. Neither was exact. A coordinate’s results sit in a short-lived server cache, a coordinate is sent to OpenStreetMap to be named, and analytics events carry your account id when you are signed in. None of this is new behavior; the description is.

What we do not collect

We do not collect precise GPS location beyond what you explicitly type into the search field. The app does offer a “use my location” button: tapping it reads your device’s location sensor once, with your browser’s own permission prompt, and writes the coordinates into the search field exactly as if you had typed them. Nothing happens unless you tap it. We do not access your device’s location sensor passively or in the background. We do not collect contacts, photos, microphone input, or any other device resource.

2. How We Use Your Information

Every use of your information maps directly back to providing and improving the Service. Specifically:

  • To run preflight checks: processing your location query against airspace, weather, and restriction data to generate your results.
  • To authenticate your account and enforce subscription tier limits.
  • To process payments and manage billing through Stripe.
  • To send account and service emails: a welcome note and one check-in a few days after you sign up, subscription confirmations, trial-ending, cancellation and payment-failure notices, the daily-limit notice, the Part 107 reminders and location alerts you set up, and the note that beta access is permanent. There are no password emails, because there are no passwords. We do not send marketing email without your explicit opt-in.
  • To investigate abuse, enforce our Terms of Service, and comply with legal obligations.
  • To analyze usage patterns in aggregate (which zone types pilots encounter most, which features are used, which states have thin data coverage) in order to improve the dataset and product for everyone.

We do not use your information for any other purpose. If that ever changes materially, we will notify you before it takes effect.

3. How We Share Your Information

We do not sell, rent, or trade your information. We share data only in these narrow circumstances:

  • Infrastructure providers: Supabase (authentication and database), Google (the sign-in behind it), Stripe (payments), Render (API hosting), Vercel (frontend hosting), Upstash (the short-lived result cache), Resend (transactional email), and Sentry (error monitoring) process data on our behalf under contractual data protection obligations. These providers act as processors; they cannot use your data for their own purposes.
  • OpenStreetMap (Nominatim): receives the coordinate of a check, and only the coordinate, to return the name of the locality it falls in. It receives nothing that identifies you.
  • Legal requirements: We may disclose information if required by law, subpoena, or other legal process, or to protect the rights, property, or safety of SudoKodes LLC, our users, or the public. We will notify affected users of such requests where legally permitted.
  • Business transfers: In connection with a merger, acquisition, or sale of substantially all of our assets, your information may be transferred. We will provide notice and the same data commitments described here will be required of any successor.

4. Data Retention

Account data is retained for as long as your account is active. You may request deletion of your account and associated data at any time by emailing admin@sudokodes.com. We will process deletion requests within 30 days, subject to any legal retention obligations. Anonymized aggregate usage data (which contains no personal identifiers) may be retained indefinitely.

5. Cookies and Local Storage

The Service uses browser local storage, on your device only, for: your last location, altitude, weight class and aircraft, so the search card opens as you left it; your theme choice; your last flight purpose and crew role for the flight log form; a random session identifier for our product analytics; an offline result cache of up to your 10 most recent preflight check results, so the app can show cached data when you have no network connection; flight-log entries saved while offline, until they are sent; and your authentication session, which the Supabase JavaScript client keeps in local storage by default and which is transmitted to our servers only to authenticate your requests. We do not use advertising or cross-site tracking cookies of any kind.

Analytics: we use Vercel Web Analytics, which records page views and referrers. It is cookieless: it sets no cookies, stores no device identifier, and does not build a profile of you or follow you to other sites. Separately, our own product analytics record the two-letter state a check fell in, never the query you typed, as described in section 2.

Error monitoring: errors on our backend may be reported to Sentry, a third-party error monitoring service, so that we can find and fix faults. Reports carry request metadata and stack traces. They do not carry your location queries or your flight check results. When a fault in the app itself reaches one of its error screens, the app sends us a short first-party report through the same product analytics channel as section 2: the page path (never the query string, which is where a location would be), the fault’s type and message, the first few lines of its stack trace, and the same session identifier as our other events, linked to your account when you are signed in. It carries no location query, no check result and nothing you typed, and it goes to no third party. Backend application logs are also written to our server infrastructure (Render) for debugging, and contain request metadata only.

Updated September 2026. This section previously said we used no analytics of any kind and that we did not use Sentry or any third-party error monitoring service. Neither was accurate: Vercel Web Analytics was added to the app and our backend ships with Sentry, active whenever its DSN is configured. The wording above describes what the software actually does. Nothing about what we collect changed as a result of this edit; the description did. On September 11 the local storage list was rewritten from the keys the app actually writes: it had described a “check history strip” that lives only in memory and left out the offline flight-log queue and the analytics session identifier. On September 13 the sentence “Our frontend sends no error reports anywhere” was replaced by the description of the first-party report the app began sending that day.

6. Security

We use industry-standard measures including TLS encryption in transit, row-level security on our database, and JWT-based authentication. No method of transmission over the internet is completely secure; we cannot guarantee absolute security.

7. Children’s Privacy

The Service is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe we have inadvertently collected such information, please contact us and we will delete it promptly.

8. Your Rights

Depending on your jurisdiction, you may have the right to access, correct, or delete your personal data, to object to or restrict certain processing, or to receive a copy of your data in a portable format. To exercise any of these rights, email admin@sudokodes.com. We will respond within 30 days.

9. Changes to This Policy

We may update this Privacy Policy periodically. Material changes, including any change to the data commitments in the “Our Commitment” section above, will be communicated via email and in-app notice at least 30 days before taking effect. The effective date at the top of this page reflects the most recent revision.

10. Contact

Privacy questions or requests may be sent to admin@sudokodes.com.