Privacy and GDPR

Controller and contact

AEROBOP is operated by David Gerone. For questions about your data or to exercise your rights, use our contact form.

Your flight searches

Cities, airports, dates and flight numbers you search are not linked to your identity by AEROBOP and are not stored in our visit statistics. We do not build a personal search history. Routes you choose to save remain only in your browser's local storage and can be removed from “My routes”.

Technical exception: to preserve the specific-flight data allowance, the flight number and corresponding response are cached on the server for five minutes without a user identifier. The hosting provider or data providers needed to fulfil a request may also keep temporary technical logs.

Aggregate counters without individual tracking

Server-side aggregate counters add up only application configuration requests and calls to our flight data services, by category and UTC day. They use requests already needed to provide the service, with no additional tracking request, analytics cookie or visitor identifier. No IP address, city, browser data, searched city or flight number is recorded in these counters. They operate without individual tracking. They cannot recognise a visitor or reveal their journey or clicks. Totals include reloads, multiple service calls and potentially bots; responses served from the browser cache and offline use are not counted. Aggregate daily totals are retained for the current and previous calendar years.

Estimated visits and daily visitors

We estimate application visits and unique visitors for each UTC day using requests already needed to operate the application, without analytics cookies or additional tracking requests. The server temporarily uses the connection IP address and standard browser header to calculate a cryptographic pseudonym with a random key specific to each day. Raw values are not recorded in these statistics. Only the daily pseudonym and its latest detected activity time are temporarily retained. Keys and pseudonyms from earlier days are deleted on the next counting or administrative reporting request. They are not used to link days, build advertising profiles or track search journeys.

A new visit is counted after 30 minutes without detected activity and at the start of each UTC day. Browsers sharing a network may be merged; changing network or device may be counted separately. Monthly and annual visitor totals are sums of daily visitors, not unique people over the period. Recognised bots, signed-in administrators and browsers sending DNT or GPC are excluded. Static guides viewed alone and offline use are not covered. Daily totals are retained for the current and previous calendar years.

You can object to this measurement below or enable a DNT/GPC signal in your browser. The button stores only your exclusion choice for one year in a preference cookie, without an identifier. This objection applies to audience estimates; aggregate technical counters without identifiers continue to operate.

Previous detailed tracking stopped

The previous detailed tracking of clicks, time spent and cities has stopped. No new persistent analytics identifier is created in the browser. On your next visit, old analytics identifiers are removed from your browser; if an old identifier is available, the site requests deletion of the associated server events. Deletion depends on that request reaching the server. Other historical data collected with consent expires no later than 180 days after collection. Aggregate counters cannot distinguish individual people.

Forms and messages

When you use a form, your name, email address if provided, and message content are sent to FormSubmit and then to the AEROBOP team solely to answer your request or consider a partnership. If you request a copy, your address is also used to send it. FormSubmit says it retains submissions for 30 days; messages in our mailbox are kept as needed to handle the exchange and then deleted. You can send a contact message without an email address, but we cannot reply in that case.

External services and security

The site uses providers for hosting and some flight, map, weather or image data. Their technical processing depends on the resources viewed or requested. We limit data requests to what is needed and keep API keys on the server. Site and form communications use HTTPS.

Legal basis and your rights

Under Regulation (EU) 2016/679 (GDPR), historical detailed analytics were collected based on your consent (Article 6(1)(a)); this tracking has now stopped. Handling messages to respond to your requests, technical operations needed to operate the site and limited audience measurement are based on our legitimate interests (Article 6(1)(f)), subject to your rights.

You may request access, rectification, erasure or restriction of processing, and object to certain processing (Articles 15–21). Use our contact form to exercise your rights; you may also contact your data protection authority.