Privacy Policy
The short version
Study Airlines works without user accounts, without cookies, without tracking and without analytics tools. Your study content stays with you: what you learn is never recorded anywhere.
Controller
S&A Solutions UG (haftungsbeschränkt), Augustaanlage 38, 68165 Mannheim, Germany. Email: kontakt@yasers.de
Local storage in your browser (localStorage)
The site stores your language preference and the state of a running flight in your browser's localStorage. This data never leaves your device and can be deleted at any time via your browser settings. No cookies are set.
Public departures board
When you start a flight, it appears anonymously on the public departures board. The only data stored is: a randomly assigned callsign (e.g. SA 813), the route as airport codes, the flight duration and timestamps. No names, no study subjects and no IP addresses are stored in the database. It is not possible to identify you from this data. After landing the flight disappears from the board; the anonymous record stays in the database and counts towards the totals (flights, hours).
Abuse protection (rate limiting)
To prevent abuse of the departures board, your full IP address is used transiently in server memory for rate limiting. Rate limiting itself writes nothing to disk and keeps nothing permanently. What ends up in a file, and for how long, is described under “Server log files” below. The legal basis is our legitimate interest in a stable, abuse-free service (Art. 6(1)(f) GDPR).
Optional map view (Apple Maps)
In the cockpit you can optionally switch the flight map from the built-in offline globe to Apple Maps. Only if you activate this option, your browser connects to servers of Apple Inc. to load map tiles; your IP address is transmitted to Apple in the process. Details can be found in Apple's privacy policy. The legal basis is your consent by actively enabling the option (Art. 6(1)(a) GDPR); the default remains the built-in map without any external connection, and you can switch back at any time. Your choice is stored only in your browser's localStorage.
Independently of that, the page asks our own server once on load whether the map option is available at all, and fetches a short-lived access token for Apple Maps while doing so. That token contains nothing about you, and the request does not go to Apple.
The app for iPhone and iPad
The app is this same application wrapped in a native shell. Everything above applies there unchanged: no accounts, no cookies, no tracking, no analytics or advertising component, the same departures board and the same optional map view. Local storage lives in the app instead of the browser and disappears when you delete the app. Three things are specific to the app.
Landing notification
On boarding, the app schedules a local notification for the landing time. Local means it is scheduled and fired on your device. There is no push service, no device token and no registration with Apple's push servers. The notification names the flight number, the destination city and the study duration — not your subject. iOS asks for permission at boarding, not at launch; if you decline, the flight still runs in full, only without the notification.
Live Activity on the lock screen and Dynamic Island
While a flight is running, the app can show a Live Activity: flight number, route, phase of flight, time remaining — and, on the lock screen, the subject you entered at check-in. It runs through ActivityKit on your device and is updated by the app itself; there is no push channel for it, and nothing is transmitted to us. Keep in mind that this is visible while the device is locked: anyone glancing at your phone sees your subject. Enter something neutral if you would rather they did not.
Map in the app (Apple MapKit)
The map view works as described above. If you switch it on, the app loads MapKit JS and the map tiles directly from servers of Apple Inc., and your IP address is transmitted to Apple in the process. Apple acts as its own controller for that; we receive nothing from it. The default in the app, too, remains the built-in globe, and without a connection the flight including the announcements runs fully offline.
Hosting
The site runs on our own server operated by Hetzner Online GmbH in Germany. When you visit, the technically necessary connection data required to deliver any website is processed; what exactly is recorded is listed in the next section.
Server log files
Every time a page is requested, our web server writes one line to a log file. It records the address requested, the time of the request, the HTTP status code, the amount of data transferred, the browser identification (user agent) and the host requested, together with your IP address. We keep two separate log files for two separate purposes, with two different retention periods.
Security log (full IP address, 7 days)
The first file records your full IP address. We need it to detect and fend off attacks and abuse — scanners, brute-force attempts and floods of requests can only be told apart from ordinary visits by the exact address. An automated protection system reads this file and temporarily blocks addresses that produce a conspicuous number of errors. This file is deleted after 7 days.
Statistics log (shortened IP address, up to 90 days)
The second file records your IP address shortened to its first 16 bits, so that 203.0.113.42 is written as 203.0.0.0 (IPv6 addresses are shortened to their first 32 bits accordingly). The full address is not written to this file. We evaluate it to see how the site is used overall — number of requests, popular pages, browsers, referrers. It is kept for up to 90 days and is then deleted automatically by rotation. The evaluation runs on our own server; no external analytics service is involved.
The legal basis in both cases is our legitimate interest (Art. 6(1)(f) GDPR): for the security log, our interest in fending off abuse and attacks; for the statistics log, our interest in understanding how the site is used and improving it.
Your rights
Under the GDPR you have the right to access, rectification, erasure, restriction of processing, data portability and objection, as well as the right to lodge a complaint with a supervisory authority. Since the departures board data is anonymous, we cannot link it to any person. If you have questions, you can reach us at the email address above.