Privacy Policy

1. Data controller

The controller of the personal data collected through the justlogbook.com website and the JustLogbook app (web, iOS and Android) is:

We have not appointed a data protection officer because we are not required to. For any privacy matter, write to us at [email protected].

2. Data we process

We process the data you give us when you sign up and when you use JustLogbook:

• Account data: name, email address and password (stored hashed). If you sign up with Google, also the profile picture linked to that Google account.
• Flight data: dates, departure and arrival aerodromes, times, aircraft type and registration, role on board, remarks and any photos you attach.
• Location data: GPS tracks and flight files (SkyDemon GPX or others) that you upload, which contain the route you flew.
• Licences and ratings: licence number, type, ratings, expiry dates and the scanned copies of your licence and medical certificate that you upload to receive expiry reminders.
• Third-party data you enter: instructors, co-pilots or members of a shared aircraft logbook. It is up to you to tell them that their data is in JustLogbook and what it is used for.
• OCR import: the photos of your paper logbook that you upload so we can extract the flights automatically.
• Subscription data: plan, amounts and dates. Your card details are handled directly by the payment provider; we never see or store them.
• Technical and usage data: IP address, browser, device, push notification tokens and app usage events.

3. Why we use your data and on what legal basis

Each processing activity has a specific purpose and legal basis:

• Creating and maintaining your account. Basis: performance of the contract (Art. 6(1)(b) GDPR).
• Providing the logbook service: recording flights, calculating hours, storing tracks and documents, exporting to PDF and Excel. Basis: performance of the contract.
• Reminding you when licences, ratings and your medical certificate expire. Basis: performance of the contract.
• Reading photos of your paper logbook with OCR to extract the flights. Basis: performance of the contract, at your request.
• Charging your subscription and issuing invoices. Basis: performance of the contract and compliance with legal obligations (Art. 6(1)(b) and 6(1)(c) GDPR).
• Sending you service emails: confirmations, technical, security or terms-change notices. Basis: performance of the contract.
• Sending you push notifications. Basis: the consent you give when you enable them on your device (Art. 6(1)(a) GDPR). You can turn them off at any time.
• Keeping the service secure, preventing fraud and fixing bugs. Basis: legitimate interest (Art. 6(1)(f) GDPR).
• Measuring how the site is used with analytics tools. Basis: your consent (Art. 6(1)(a) GDPR). They only run if you accept them in the cookie notice.
• Answering your questions and data rights requests. Basis: performance of the contract and compliance with legal obligations.

4. Who else processes your data

To run the service we work with the following providers, which act as processors under Article 28 GDPR unless stated otherwise:

• Hosting and database: servers in data centres located in Germany (European Union), with daily backups. This is where your logbook lives.
• Stripe (United States): payments for subscriptions purchased on the web.
• Apple App Store and Google Play (United States): purchases made inside the iOS and Android apps. They take the payment and handle cancellations and refunds under their own policies, acting as independent controllers; we never receive your payment details.
• Google (United States): sign-in with Google (OAuth) and Google Analytics with IP anonymisation, the latter only if you accept analytics.
• Datadog (EU region, datadoghq.eu): performance monitoring and session replay with input fields masked. Only if you accept analytics.
• Resend (United States): delivery of service emails.
• Cloudflare R2 (United States, with configurable data location): storage of the photos and documents you upload.
• OpenAI (United States): automatic reading (OCR) of the photos of your paper logbook. Data sent through their API is not used to train models.
• Apple, Google and Firebase (United States): delivery of push notifications to your device.

We will also disclose data to courts, law enforcement and public authorities where the law requires it. We do not sell your data and we do not share it for advertising purposes.

5. International transfers

Some of the providers listed above are based in the United States, which means an international transfer of data outside the European Economic Area.

These transfers rely on the EU-US Data Privacy Framework where the provider is certified and, failing that, on the standard contractual clauses approved by the European Commission, together with additional measures such as encryption.

The servers and database holding your account and your flights are located in Germany, within the European Union.

6. How long we keep your data

These are our retention periods:

• While your account is active: we keep your data and your flights so we can provide the service.
• If you close your account: it is deactivated immediately and we keep the data for 6 months. After that we delete it or irreversibly anonymise it.
• Invoices and tax records: for as long as the law requires, 4 years under tax rules and 6 years under commercial law.
• Technical logs: 12 months at most.

During those 6 months the data is blocked: it is only used to handle claims or comply with legal obligations.

7. Your rights

You can exercise the following rights over your data at any time:

• Access: find out what data we hold about you and get a copy.
• Rectification: correct data that is inaccurate or incomplete.
• Erasure: ask us to delete your data.
• Restriction: ask us to stop using it temporarily while a claim is resolved.
• Objection: object to processing based on our legitimate interest.
• Portability: receive your data in a commonly used format. You can export your logbook to PDF or Excel from the app at any time.
• Withdraw your consent at any time, without affecting processing carried out before that.

To exercise them, write to [email protected] stating which right you want to exercise. You can also delete your account yourself from your profile at any time.

We will only ask you to prove your identity if we have reasonable doubts about who is making the request.

We will reply within one month at the latest. If the request is particularly complex, that period may be extended by two further months and we will let you know.

If you believe we have not handled your data properly, you can lodge a complaint with the Spanish Data Protection Agency (AEPD), C/ Jorge Juan 6, 28001 Madrid, www.aepd.es.

8. Security

We apply technical and organisational measures to protect your data: encrypted connections (HTTPS), hashed passwords, access controls, daily backups and activity logging.

No system is infallible. If a security breach occurs that poses a risk to your rights, we will notify the AEPD and, where the risk is high, we will notify you too, in line with Articles 33 and 34 GDPR.

9. Minors

JustLogbook is intended for people aged 18 or over. We do not create accounts for anyone younger and, if we find one, we delete it. If you are a parent or guardian and believe a minor in your care has signed up, write to [email protected] and we will sort it out.

10. Changes to this policy

We may update this policy when the service or the law changes. The current version is always published on this page with its update date. If a change affects you significantly, we will tell you by email at least 30 days in advance.