1. Introduction

Fleet 22, a sole proprietorship based in Ontario, Canada ("we," "us," or "our"), operates Sky Index (the "Service"). This Privacy Policy explains how we collect, use, disclose, retain, and safeguard your personal information when you use our website, mobile applications, and related services.

We are committed to complying with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), the Anti-Spam Legislation (CASL), and all applicable provincial privacy laws, including the Ontario Personal Information Protection Act where applicable. We also aim to align our practices with the EU General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA) for users in those jurisdictions.

This Policy applies to all users of the Service, including visitors who browse without an account, registered users, contributors, and paid subscribers. By using the Service, you consent to the collection, use, and disclosure of your personal information as described in this Policy.

2. Information We Collect

We collect the following categories of personal information:

2.1 Account Information: When you register, we collect your email address, full name, display name, and account role (user or admin). You may optionally provide a profile biography, location, interests, and avatar image.

2.2 User-Generated Content: Content you create or submit, including flight logs, sighting logs, group posts and comments, build project updates and build logs, Q&A questions and answers, check-ins, marketplace listings, contest entries, uploaded photos and images, wishlist items, favorites, direct messages, and aviation database contributions, corrections, and suggestions.

2.3 Usage Data: Information about how you interact with the Service, including pages visited, search queries, features used, timestamps, device type, browser type, operating system, IP address, approximate geographic location (derived from IP), referring URL, and interaction data (clicks, scrolls, and form submissions).

2.4 Technical Data: Server logs, error logs, authentication attempts (including failed login attempts for security purposes), and cookies or similar tracking technologies as described below.

2.5 Payment Information: When you purchase a subscription, payment is processed by Stripe. We receive your subscription status and transaction identifier but do not collect or store your full credit card number, CVV, or other sensitive payment details. See Section 6 for details.

2.6 Communications Data: When you contact us, send direct messages to other users, or participate in community features, we collect the content of those communications.

2.7 Photo Metadata: When you upload photos, we may extract embedded EXIF metadata (such as date taken, GPS coordinates, and camera information) for the purpose of pre-filling form fields. This metadata is not stored separately unless you choose to include it in the published photo data.

2.8 Photo Visibility and Download Settings: For each photo you upload, we store your chosen visibility setting (public or private), your download permission setting, and whether a Sky Index watermark has been applied. If you mark a photo private, both the original and any watermarked version remain accessible only to you and are excluded from public pages and search engine indexing. When you enable downloads for a photo, a download control is shown to other users on that photo, allowing them to save a copy of the publicly displayed (possibly watermarked) image; we do not track or retain a log of who downloads a given photo.

3. How We Use Your Information

We use your personal information for the following purposes:

• To provide, operate, maintain, and improve the Service and its features;
• To authenticate your identity and provide access to your account;
• To create and display your user profile, contributions, community activity, and achievements;
• To review, moderate, and approve or reject user-submitted content, including database contributions, photos, and marketplace listings;
• To process subscription payments and manage your subscription;
• To send transactional communications (account verification, password resets, security alerts, submission status updates, and payment confirmations);
• To send optional commercial communications where you have provided consent, in compliance with CASL;
• To analyse usage patterns, track metrics, and improve Service performance and user experience;
• To detect, prevent, and respond to fraud, abuse, security incidents, and violations of our Terms of Service;
• To maintain security logs and audit trails;
• To comply with legal obligations and respond to lawful requests from authorities;
• To facilitate community features such as groups, direct messaging, and collaborative projects;
• To personalise content and display relevant information on entity pages you have contributed to or interacted with.

4. Legal Basis for Processing (GDPR)

For users in the European Economic Area, United Kingdom, or Switzerland, we process your personal information under the following legal bases:

• Performance of a contract: Processing necessary to provide the Service you have requested, including account creation and feature access.
• Consent: Processing based on your express consent, such as for optional commercial communications, AI photo analysis, and certain cookies. You may withdraw consent at any time.
• Legitimate interests: Processing for our legitimate business interests, such as security, fraud prevention, service improvement, and legal compliance, where these interests are not overridden by your rights.
• Legal obligation: Processing necessary to comply with applicable laws, such as retaining transaction records and responding to legal requests.

5. Community Features and Public Visibility

5.1 Flight Log & Sighting Log: Private by default. Each entry has an optional public toggle that you control. Public entries may be displayed on linked entity pages (such as aircraft type, registration, or facility pages) and attributed to your display name.

5.2 Groups, Q&A, Build Projects, Build Logs, Check-ins, Marketplace, Photo Contests, and Photos: Content posted in these features is publicly visible and linked to your display name. Do not include sensitive personal information (such as your physical address, phone number, government identification numbers, or financial information) in public posts. For photos specifically, you may mark individual uploads as private at any time from your photo management dashboard; private photos are visible only to you and are removed from public galleries, entity pages, and permanent photo pages. Public photos are each assigned their own permanent, search-engine-indexable page and may display your photographer credit, caption, and other metadata you provide.

5.3 Wishlist / Saved Items: Private and visible only to you when logged in. Wishlist content is not shared with other users.

5.4 Favorites & Following: Your favorite items are private and visible only to you. Users and build projects that you follow may be displayed on your profile. You may remove favorites at any time.

5.5 Direct Messages: Private between participants. Fleet 22 does not routinely monitor direct messages. However, we may access, review, or disclose message content if required by law, if we receive a credible report of abuse, harassment, or illegal activity, or if we have a good faith belief that access is necessary to protect the safety, rights, or property of any person.

5.6 User Profiles: Your public profile displays your display name, bio, location, interests, favourite aircraft type, home airport, equipment used, website and social links, contributions, achievements, and community activity across tabs (Photos, Sightings, Flights, Check-ins, Achievements, and About). You may edit or remove profile information at any time through your account dashboard.

5.7 Check-ins: Check-ins at airports and facilities are public by default and display your display name, the facility, and optional notes. Exercise caution when sharing real-time location information.

5.8 User Dashboard: Your dashboard is private and visible only to you, summarising your own sightings, flights, photos, favorites, achievements, messages, and upcoming events, and providing profile editing tools.

5.9 Activity Feed & Following: When you follow another user, your Activity Feed displays their public photos, sightings, flights, check-ins, achievements, and group posts in chronological order. Following relationships and the resulting feed activity are used solely to power this feature.

6. Aircraft Identifier — AI Processing

When you use the Aircraft Identifier feature, your uploaded photographs are transmitted to third-party AI services, which may include Google Gemini, OpenAI, or Anthropic, for analysis and identification. By using this feature, you expressly consent to this cross-border data transmission and processing.

Photos uploaded for identification are used for the sole purpose of generating identification results. They are not permanently stored on Sky Index servers after processing. However, third-party AI providers may retain transmitted data in accordance with their own retention and privacy policies. We encourage you to review the privacy policies of these providers.

Do not upload images containing: classified or restricted military subject matter; images taken in areas where photography is prohibited; images depicting sensitive or personally identifiable information of third parties; or any images you do not have the right to share.

AI-generated identification results are probabilistic and may be incorrect. Fleet 22 is not responsible for actions taken based on AI-generated results.

7. Payment Data and Stripe

Subscription payments are processed by Stripe, Inc., a PCI-DSS compliant payment processor. When you make a payment, your card information is transmitted directly to Stripe — Fleet 22 never receives, stores, or processes your full credit card number, CVV, or other sensitive payment details.

We receive from Stripe: your subscription status, transaction identifier, billing period, and the last four digits of your card (for display purposes). This information is governed by Stripe's Privacy Policy. Stripe may also collect additional data as described in their privacy policy.

8. Cookies and Tracking Technologies

We use cookies, local storage, and similar tracking technologies to operate the Service, maintain your authentication session, remember your preferences, and analyse usage. Types of technologies we use include:

• Essential cookies: Required for core Service functionality, including login sessions and security. These cannot be disabled if you wish to use the Service.
• Preference cookies: Remember your settings, such as display preferences and filter selections.
• Analytics technologies: Help us understand how the Service is used, so we can improve performance and features. These may be provided by third-party analytics services.
• Advertising cookies: We use Google AdSense to display advertisements. Google and its partners may use cookies to serve ads based on your prior visits to this and other websites. Google's use of advertising cookies enables it and its partners to serve ads based on your visit to our site and/or other internet sites.

You can control cookies through your browser settings. Disabling essential cookies will prevent you from using personalised features. Disabling non-essential cookies will not affect core functionality. For personalised advertising, you may also opt out via Google Ads Settings or AboutAds.

9. Information Sharing and Disclosure

We do not sell, rent, or trade your personal information to third parties. We may share your information in the following circumstances:

• Service providers: We share information with third-party providers who process data on our behalf to operate the Service, including hosting, payment processing (Stripe), AI services, email delivery, and analytics. These providers are contractually obligated to protect your information and use it only for the purposes we specify.
• Legal compliance: We may disclose information when required by law, court order, subpoena, or government request, or when we believe in good faith that disclosure is necessary to protect the rights, property, or safety of Fleet 22, our users, or others, or to investigate fraud, illegal activity, or violations of our Terms.
• Safety and harm prevention: We may disclose information in response to credible reports of abuse, harassment, threats, self-harm, or illegal activity, including child exploitation, which may be reported to law enforcement.
• Business transfers: In the event of a merger, acquisition, sale of assets, or similar transaction, your information may be transferred to the acquiring entity. We will provide notice before your information is transferred and becomes subject to a different privacy policy.
• With your consent: We may share information with third parties when you have provided explicit consent.
• Aggregate or de-identified data: We may share aggregated or de-identified information that cannot reasonably be used to identify you, for analytics, research, or Service improvement purposes.

10. Data Security

We implement industry-standard technical, organisational, and physical security measures designed to protect your personal information from unauthorised access, alteration, disclosure, or destruction. These measures include:

• Encryption of data in transit using TLS/SSL;
• Secure authentication and session management;
• Access controls limiting personal information access to authorised personnel only;
• Security logging and monitoring of authentication attempts and system activity;
• Regular security review and updates.

No internet-based service or method of electronic storage is completely secure. While we strive to protect your information, we cannot guarantee absolute security. You are responsible for maintaining the confidentiality of your account credentials and for taking precautions against unauthorised access to your devices.

In the event of a data breach affecting your personal information, we will notify affected users and relevant authorities as required by applicable law, including PIPEDA's breach notification requirements.

11. Data Retention

We retain your personal information for as long as your account is active or as necessary to provide the Service. Specifically:

• Account data: Retained while your account is active. Upon account deletion, your profile data is removed, but your public contributions (such as database entries, photos, and community posts) may be retained as part of the Service's permanent record.
• Security and audit logs: Retained for up to 7 years to support security investigations, fraud detection, and legal compliance.
• Transaction records: Retained for up to 7 years as required by Canadian tax law.
• Direct messages: Retained while your account is active and for a reasonable period after deletion for safety and moderation purposes.
• Photos and uploaded content: Retained as long as the content remains published on the Service. You may request removal of your content at any time, subject to our legal retention obligations.
• AI-processed images: Not permanently stored on Sky Index servers after processing. Third-party AI providers may retain data per their own policies.

When information is no longer needed for the purposes described in this Policy or required by law, we will delete or anonymise it.

12. Your Privacy Rights

12.1 Under PIPEDA (Canada): You have the right to:

• Access and obtain a copy of the personal information we hold about you;
• Correct inaccurate or incomplete personal information;
• Request deletion of your personal information, subject to legal retention obligations;
• Request a data export of your personal information;
• Withdraw consent to the collection, use, or disclosure of your personal information (subject to legal and contractual restrictions);
• Complain to the Office of the Privacy Commissioner of Canada if you believe your privacy rights have been violated.

12.2 Under GDPR (EEA, UK, Switzerland): You have the right to:

• Access your personal data (Article 15);
• Rectify inaccurate personal data (Article 16);
• Erasure of your personal data, the "right to be forgotten" (Article 17), subject to exceptions;
• Restrict processing of your personal data (Article 18);
• Data portability (Article 20);
• Object to processing based on legitimate interests (Article 21);
• Withdraw consent at any time without affecting the lawfulness of processing prior to withdrawal;
• Lodge a complaint with your local data protection authority.

12.3 Under CCPA/CPRA (California): California residents have the right to:

• Know what personal information is collected, used, shared, or sold;
• Request deletion of their personal information;
• Opt out of the "sale" or "sharing" of personal information (we do not sell personal information);
• Non-discrimination: we will not discriminate against you for exercising your privacy rights.

To exercise any of these rights, contact us at fleet22co@gmail.com. We will verify your identity before processing requests and respond within 30 days, as required by PIPEDA. For GDPR requests, we will respond within one month, extendable by two months for complex requests.

13. CASL — Canada's Anti-Spam Legislation

Fleet 22 complies with Canada's Anti-Spam Legislation (CASL). We send commercial electronic messages (CEMs) only where we have your express or implied consent. CEMs include promotional emails, newsletters, and notifications about new features or paid offerings.

Transactional messages — such as password resets, security alerts, account verification, submission status updates, and payment confirmations — are not considered CEMs and are sent as necessary to operate the Service.

You may withdraw consent and unsubscribe from optional commercial communications at any time by: (a) using the unsubscribe link in any commercial email; (b) adjusting your notification settings in your account; or (c) contacting fleet22co@gmail.com. We will process unsubscribe requests within 10 business days.

14. International Data Transfers

Sky Index is hosted on servers that may be located in Canada, the United States, or other countries. Your personal information may be transferred to and processed in countries other than your country of residence, including the United States (for AI processing, payment processing via Stripe, and hosting).

When we transfer your data internationally, we require that appropriate safeguards are in place to protect your information in accordance with this Privacy Policy and applicable law. For transfers from the EEA, UK, or Switzerland, we rely on appropriate legal mechanisms such as Standard Contractual Clauses (SCCs) where required.

By using the Service, you acknowledge and consent to the transfer and processing of your personal information in these jurisdictions.

15. Children's Privacy

Sky Index is not directed to or intended for children under 13 years of age. We do not knowingly collect, solicit, or process personal information from children under 13. If we learn that we have collected personal information from a child under 13, we will delete that information as soon as practicable.

If you are a parent or guardian and believe your child has provided us with personal information, please contact us at fleet22co@gmail.com so we can investigate and take appropriate action.

Users between 13 and 18 may use the Service with parental or guardian consent. Parents or guardians are responsible for monitoring their children's online activities.

16. Third-Party Services

The Service integrates with several third-party services, each with their own privacy policies. We encourage you to review these policies:

• Stripe — Payment processing. stripe.com/privacy
• Google (Gemini AI, Maps, Analytics, AdSense) — AI processing, mapping, analytics, and advertising services. policies.google.com/privacy
• OpenAI / Anthropic — AI processing services. openai.com/privacy | anthropic.com/legal/privacy

Fleet 22 is not responsible for the privacy practices of these third-party services. Your interactions with them are governed by their respective policies.

17. Data Breach Notification

In the event of a personal information breach that poses a real risk of significant harm to individuals, Fleet 22 will: (a) take reasonable steps to contain and remediate the breach; (b) notify affected individuals as soon as feasible; and (c) report the breach to the Office of the Privacy Commissioner of Canada as required by PIPEDA. For users in jurisdictions with mandatory breach notification laws, we will comply with those requirements.

18. Automated Decision-Making and Profiling

We do not use your personal information for automated decision-making that produces legal or similarly significant effects on you. The AI features (such as the Aircraft Identifier) produce informational suggestions only and do not make decisions about you.

We may create limited usage profiles for analytics and Service improvement, but these are not used for decisions that significantly affect you.

19. Social Media and External Sharing

The Service does not automatically post to social media. If you choose to share content from Sky Index to external platforms (via links or manual sharing), that content is subject to the privacy policies of those platforms and is no longer governed by this Policy.

20. Policy Updates

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or Service features. Material changes will be posted on the Service with an updated "Last updated" date. For significant changes affecting your privacy rights, we will endeavour to provide notice through the Service or via email to registered users.

Your continued use of the Service after any changes constitutes acceptance of the revised Policy. If you do not agree to the updated Policy, you should discontinue use of the Service and may request deletion of your account and personal information.

21. Do Not Track Signals

Some browsers offer a "Do Not Track" signal. Fleet 22 does not currently respond to Do Not Track signals, as there is no industry consensus on how to interpret them. We continue to respect your cookie preferences as set through your browser settings and our consent mechanisms.

22. Contact Information and Complaints

If you have any questions, concerns, or requests regarding this Privacy Policy or your personal information, please contact us:

Fleet 22 — Privacy Inquiries
Ontario, Canada
Email: fleet22co@gmail.com

We will acknowledge your request within 30 days. If you are not satisfied with our response, you have the right to lodge a complaint with:

• Office of the Privacy Commissioner of Canada: www.priv.gc.ca | 1-800-282-1376
• Your provincial privacy commissioner (if applicable)
• Your local data protection authority (for EEA, UK, or Swiss residents)