What we hold about you

Last updated: 12 October 2026

1. Who is responsible

The data controller is Vapor Trail Simulations LLC, 68 Harrison Ave Ste 605, PMB 999873, Boston, Massachusetts 02111-1929, United States. Contact: support@vaportrailops.com.

2. What we collect, and why

Account. Email address, display name, a hash of your password (never the password), when you joined, whether the address is confirmed, the invitation you used and who issued it, your role, and any suspension with its reason. Needed to run your account (contract). Optional settings you give us: SimBrief username, passenger weight and unit preferences, which cabin announcements are muted. When you register, and again when you subscribe, we record the date and the version of the Terms of Service and the Refund Policy you accepted. Purpose: proof of what you agreed to (contract; legitimate interest).

Sessions and security. For each browser sign-in: the browser and system (from the user-agent string), the IP address, when it was created and last used, and when the password was last entered. For the desktop client: a token name and when it was last seen. Failed sign-in counts (kept 15 minutes) and rate-limit counters (kept up to an hour). If you turn on two-factor sign-in: an encrypted shared secret and hashed recovery codes. Purpose: keeping the account secure and letting you see and end sessions (legitimate interest).

Your airline and flights. Everything the game produces: airline, aircraft, contracts, flight plans, the flight log and score, the settlement and ledger, badges, boss attempts, and the flight track — position, altitude and speed of your aircraft in the simulator about every ten seconds while tracking, plus the telemetry the score is computed from (weights, speeds, g-load, gear, flaps, engine state, ambient weather in the simulator). Purpose: providing the service (contract). This is data about a simulated aircraft, not about your movements.

Flight captures on your PC. The desktop client can keep a complete record of each flight — every second of position, attitude, speed, engine, gear, flap, fuel, weight and lighting data the simulator reports, with the aircraft's name and the simulator's clock — as a file on your own computer. This is off unless you turn it on in the client's Settings, and it is meant for testing an aircraft. These files never leave your PC: the client does not upload them and we cannot see them. They hold no account details and no sign-in token. The client deletes any capture older than two days when it starts and when a flight ends. A capture takes about 5 MB for each hour of flying.

Pictures. Aircraft pictures you upload (checked for type and size, stored privately, shown in your fleet), and pictures the service generates for airports and report cards. Purpose: providing the service (contract).

Payments. Subscriptions are sold by Paddle, our merchant of record. Paddle collects what a payment needs — name, email address, country and postal code for tax, and your card or other payment method — under Paddle's privacy policy; we never see or store card details. We hold what the entitlement needs: your Paddle customer and subscription ids, the plan, its status and period dates, when it was last paid, and a Founding Flight Crew number if you have one, plus a log of the payment events Paddle sends us. Purpose: providing the paid service and its records (contract; legal obligation for tax records, which Paddle keeps).

Launch notice and waiting list. If you asked on this site to be told when the service launches, or earlier for a place: email address, the optional note you wrote, the source, the time you consented and the time you confirmed your address (an address that is never confirmed is deleted after 7 days). Purpose: sending you that one email, the launch notice or an invitation (consent; withdraw with the link in the confirmation email).

Emails we send. Transactional and security messages only: address confirmation, password reset, security notices (new sign-in from an unknown browser, password or email changed, desktop client linked, two-factor turned on or off, account suspended, deletion scheduled), invitations, the launch notice's confirmation and the one launch email. Receipts, renewal reminders and failed-payment notices come from Paddle. No newsletters, no marketing, no tracking pixels. Delivery is through Amazon Simple Email Service; bounces and complaints are recorded by the mail provider so we stop writing to addresses that refuse mail.

Admin audit log. When an administrator acts on an account (resends a link, suspends, invites, deletes), the action, the administrator, the target and the administrator's IP address are recorded. Purpose: accountability (legitimate interest).

Server logs. The api and websocket services log requests with IP address, path and status for 30 days, for security and debugging (legitimate interest). The edge keeps access logs (the load balancer's and the content network's: IP address, path, status, time) and the web application firewall's request log for 90 days, so an incident reported weeks later can still be investigated.

3. What we do not do

No advertising, no analytics beyond the server logs above, no selling or sharing of personal data for others' purposes, no profiling with legal effect, no tracking across sites. The web app sets one cookie: an httpOnly refresh token that keeps you signed in. It also keeps your sign-in state and a few preferences in your browser's local storage on your own device. This site sets no cookies. It remembers your choice in the cookie banner in your browser's local storage, on your own device, until you change it. Nothing optional, such as analytics or advertising tags, loads unless you press Accept, and today we load none. In the signed-in app your browser loads map tiles from MapTiler or OpenStreetMap (section 4). When you subscribe, your browser loads Paddle's payment script from Paddle's servers; it is necessary to take payment and is not switched off by Decline. You can change your choice at any time with Cookie settings in the footer.

4. Processors

Data is processed on Amazon Web Services in the us-east-1 (N. Virginia) region, with daily backup copies also kept in a vault in the us-west-2 (Oregon) region: database (Aurora), cache (ElastiCache), object storage (S3, for pictures), compute (ECS Fargate), delivery (CloudFront), email (SES), cabin-announcement speech (Amazon Polly, given announcement text only), gate hints and generated pictures (Amazon Bedrock, given airport and airline names only). The first officer's WX Ops briefs are written by Anthropic's API from the weather observation, the airport and the challenge — no personal data is sent. Password checks against known breaches use the Pwned Passwords range service: five characters of a hash of the password leave the server, never the password or your identity. SimBrief flight plans are fetched from SimBrief only when you press Import, using the username you gave. The maps in the web app are drawn by your browser, which loads map tiles directly from MapTiler (or, if that is unavailable, from OpenStreetMap); they receive your IP address and the map area you are looking at. Payments are processed by Paddle.com (Paddle.com Market Ltd, UK, and Paddle.com Inc., US), an independent controller for the payment data it collects, which sends us the subscription events described above. The source code is hosted on GitHub; no personal data lives there.

5. Where and how long

Data stays on the servers above, in the us-east-1 region and in the backup vault in us-west-2. Retention: account and airline data for as long as the account exists; the flight track (the position record of a flight) 24 months, after which it is deleted — the flight's log, score, settlement and landing record stay with the account; sessions 30 days after last use (revoked or expired ones kept 90 days for security review, then deleted); account links (confirmation, reset, email change, deletion) 30 days after they are used or expire; rate-limit and sign-in counters minutes to an hour; launch-notice and waiting-list entries until the email is sent and you register, you leave the list, or 12 months (an address that never confirms is deleted after 7 days); the body of each payment event from Paddle 13 months (the record that it happened stays); server logs 30 days; edge access logs (load balancer and content network) and firewall request logs 90 days; the admin audit log 24 months; the record of which version of the Terms of Service and the Refund Policy you accepted, and when, and subscription records, for as long as the account exists. Deletion: Settings → Account → Delete my account removes the account, the airline and everything it owns after a seven-day grace period, and cancels any subscription when the account is removed; nothing is anonymized or kept, apart from the audit log entry that an account was deleted and database backups, which roll off within 35 days (copies in the second region the same). Until a backup rolls off, a restore would bring back the data it held. Paddle keeps its own payment records for as long as tax law requires.

6. Your rights

You can see and change your account under Settings, download everything we hold about you as one file (Settings → Account → Download my data), and delete the account. Depending on where you live you may also have the right to object, to restrict processing, to data portability, to withdraw consent, and to complain to a supervisory authority (in the EU, your national data protection authority; in the UK, the Information Commissioner's Office). Write to support@vaportrailops.com; we answer within one month.

7. Children

The service is not for anyone under 16. If you believe a child has an account, tell us and we will delete it.

8. Security

Passwords are hashed with scrypt; account links are single-use and stored hashed; sessions use short-lived tokens with rotating refresh tokens; two-factor sign-in is available; transport is HTTPS only; the database and storage are private and encrypted at rest; administrators need a fresh password and (from 15 October 2026) two-factor, and every action is logged. No system is perfect: if we learn of a breach affecting you we will tell you as the law requires.

9. Changes

We may update this policy; material changes are announced by email and in the app before they take effect. The current version is always at wayfix.io/privacy. See also the Terms of Service.