Privacy Policy

Squawkd operates the aircraft management platform at squawkd.com. We act as the data controller for personal data processed through the Service.

For any privacy-related queries, contact us at: hello@squawkd.com

2.1 Account data

When you register, we collect:

• Full name and email address
• Hashed password (we never store your password in plaintext)
• Account creation date and login history
• OAuth identifiers if you sign in with Google or Apple

2.2 Aircraft and operational data

Data you enter about your aircraft, including:

• Aircraft registration, make, model, serial number
• Hobbs readings, flight logs, maintenance records
• Compliance dates (annual/ARC, registration, insurance)
• Airworthiness Directives and maintenance schedules
• Squawks (maintenance discrepancies) and their status
• Costs and expenses

2.3 Documents you upload

Files you upload to the Document Vault (insurance certificates, ARC documents, logbook scans, etc.) are stored using Vercel Blob, a third-party cloud storage service. We store metadata about uploaded files (filename, upload date, expiry date) in our database.

2.4 Usage data

We collect basic usage analytics including pages visited, features used, and error logs. This data is used to improve the Service and is not sold to third parties.

2.5 Payment data

Payment processing is handled by third-party providers. We do not store your payment card details. We receive confirmation of payment status and subscription information only.

We process your data on the following legal bases (GDPR Art. 6):

We share your data with the following third parties:

• Neon (database hosting): Your data is stored in a Neon PostgreSQL database hosted in the EU (us-east-1 AWS region). Neon processes data as a data processor on our behalf.
• Vercel (hosting and file storage): Squawkd runs on Vercel's infrastructure. Vercel Blob is used for document storage. Vercel processes data as a data processor.
• Resend (transactional email): Used to send verification, invitation, and notification emails. Resend receives your email address.
• Anthropic (AI blog generation): The admin blog generator uses Claude. Blog generation prompts (topic, keywords) are sent to Anthropic's API. No personal account or aircraft data is sent to Anthropic.

We do not sell your personal data to third parties. We do not share your data with advertisers.

Co-owner data sharing

When you join a shared aircraft, other members of that aircraft can see data associated with the aircraft (flights you log, squawks you raise, costs you enter). Your name and email address are visible to aircraft admins. This is inherent to the multi-owner feature of the Service.

We retain your data for as long as your account is active. Specifically:

• Account data: retained until you delete your account
• Aircraft and operational data: retained until you delete the aircraft or your account
• Uploaded documents: retained until you delete them or your account
• Deleted records (soft-deleted): purged after 90 days
• Payment records: retained for 7 years for accounting purposes

If you are in the European Economic Area or UK, you have the following rights under the GDPR and UK GDPR:

• Access: Request a copy of your personal data
• Rectification: Correct inaccurate data
• Erasure: Request deletion of your data (“right to be forgotten”)
• Portability: Receive your data in a machine-readable format
• Restriction: Ask us to restrict processing in certain circumstances
• Objection: Object to processing based on legitimate interest
• Withdraw consent: Where processing is based on consent, withdraw it at any time

To exercise any of these rights, email hello@squawkd.com. We will respond within 30 days. You also have the right to lodge a complaint with your local data protection supervisory authority (e.g., CNIL in France, ICO in the UK, or the authority in your country of residence).

Squawkd uses a minimal set of cookies:

• Authentication session cookie: Required for login — cannot be disabled
• Analytics (Vercel Analytics): Privacy-preserving, no personal identifiers stored

We do not use advertising cookies or third-party tracking pixels.

We implement appropriate technical and organisational measures to protect your data, including:

• All data in transit encrypted via TLS 1.2+
• Passwords stored as argon2 hashes — never in plaintext
• Database access restricted to application servers via credential-based authentication
• Access logs retained for audit purposes

If you discover a security vulnerability, please report it responsibly to security@squawkd.com.

Your data is primarily stored on infrastructure in the United States (Neon, Vercel). These transfers are covered by standard contractual clauses (SCCs) and the service providers' participation in applicable data transfer frameworks.

Squawkd is not directed at individuals under the age of 16. We do not knowingly collect data from children. If you believe we have collected data from a child, please contact us immediately.

We may update this Privacy Policy from time to time. Material changes will be notified by email at least 14 days before they take effect. The current version is always available at squawkd.com/privacy.

For any privacy questions or requests: hello@squawkd.com