Privacy policy

Last updated: 2026-10-28

This page explains what this site stores about you and why. “We” and “the operator” mean the operator of this site; use the Contact page to reach them. This text describes how the site software behaves today.

The short version

Looking up airports needs no account. If you create an account we store your email address and either a password hash or your Google identity, plus the airports you save. Your location is used only in your browser to show distances; it is never sent to us. We do not sell data, send marketing email or take payments. Whether analytics cookies are set depends on how this site is configured; see “Analytics and statistics”.

What we collect

Without an account:

An anonymous session: a random identifier (kept in the afi_session cookie) and a security token that protects forms. The server stores only a hash of the identifier.
Search words and filters you type appear in the page address, like any web request. The site does not keep a search history.
An error report, if you send one: the airport it refers to, the category, your message (up to 1,000 characters) and the time. It is not linked to your account or session. Please do not include personal information.

With an email account:

Your email address (stored in lower case) and a salted scrypt hash of your password. We never store the password itself.
Your language preference, the account creation time and whether the email is verified.
Verification codes and password reset tokens, stored only as hashes (see “How long we keep data”).
The airports you save and when you saved them.

With Google sign-in:

Google’s stable identifier for your account and the email address Google reports as verified. We request the openid, email and profile permissions but store only those two values; Google tokens are discarded and your name and photo are not stored.
If an account with the same verified email already exists, the Google identity is attached to it. Otherwise the first Google sign-in creates a new account.

Your location

“Use my location” asks your browser for your position. If you allow it, the position stays in this browser tab (sessionStorage) and is used only to calculate straight-line distances on the page. It is not sent to our server, not stored in your account and not shared. Sorting by distance and “Airports near you” download the coordinates of listed airports and sort them in your browser. “Clear” or closing the tab removes it.

Data sources

Airport and runway facts (identifiers, names, location, elevation, use, ownership, control tower and runways) come from the National Airspace System Resources (NASR) data published by the Federal Aviation Administration (FAA), an agency of the U.S. government. Names are shown in English as the FAA publishes them, with common abbreviations written out, and ICAO codes are shown when the FAA record has one.

The FAA publishes NASR data every 28 days. We load each new cycle after it takes effect, and every airport page shows the date its record was last checked.

Maps are drawn in your browser from OpenFreeMap tiles, which are built from OpenStreetMap data. Map data © OpenStreetMap contributors, available under the Open Database License (ODbL).

Weather, NOTAMs, radio frequencies, charts, procedures, fuel and services, reviews and live operating status are not part of this site. For flight planning use official FAA sources, current NOTAMs and valid charts.

To report a correction, use “Report an error” on the airport page or the Contact page. Corrections to FAA data are made by the FAA; we check every report against the current data.

Why we use it

We do not use your data for marketing email. Saving an airport does not contact the airport or anyone else.

To create and secure your account, sign you in, and send the one-time code or reset link you ask for.
To keep your saved airports and your language setting.
To protect the site: rate limits use hashed identifiers, and forms require a security token.
To count aggregate usage (see “Analytics and statistics”) and to review error reports by hand.

Who processes data

Mail delivery: to send a verification code or password reset link, the site sends your email address and the code or link to the operator’s mail-delivery service (a self-operated mail workbench). It also receives short business events (for example “registration completed”) that carry an internal account number and no email address.
Google: if you choose Google sign-in, your browser goes to Google and Google returns your verified identity. If analytics is enabled and you have not opted out or declined, Google Analytics also receives page views. Google handles that data under its own policies.
Site statistics service: the site can send the operator’s own statistics service one daily aggregate (registration count, total and enabled accounts) with the site identifier and domain. It contains no email address, user identifier, IP address or page content.
Maps: when a page shows a map, your browser loads map tiles from OpenFreeMap, which receives the usual request data (such as your IP address). Your shared location is not sent with these requests.
Hosting: the site software can write a technical request log (time, method, path, status, duration, request id; no query string, cookie or IP address). The server or network that hosts it may keep its own standard logs.
Links to airport websites open third-party services with their own privacy policies.

Advertising

Some pages reserve clearly labeled advertising spaces. No advertising network is connected at the moment, so these spaces are not shown and set no cookies. If that changes, this policy will be updated before any advertising is shown.

Cookies and browser storage

These are all the cookies and storage keys the site sets.

Name	Purpose	Lifetime	Consent
`afi_session`	Keeps you signed in, or identifies your anonymous visit, and protects form submissions against forgery. Set only when you use a feature that needs it (signing in, saving an airport, sending a form), not when you only read pages. HttpOnly, SameSite=Lax, and Secure on https.	7 days	Not asked: needed to run the site
`afi_oauth_locale (/api/auth/google)`	Remembers the page language while you sign in with Google. Only sent to /api/auth/google and removed when the sign-in finishes.	10 minutes at most	Not asked: needed for Google sign-in
`afi_analytics_optout`	Remembers that you stopped analytics on this browser. Only exists when analytics is configured, and only after you use the opt-out control on this page.	12 months	Not asked: it stores your opt-out
`_ga, _ga_<measurement id>`	Google Analytics cookies that count visits. Set by Google, not by this site, by default unless you opt out; removed when you opt out.	Set by Google	Set by default unless you opt out
`afi.position`	Browser sessionStorage (not a cookie). Holds the position you shared with “Use my location”, so distances can be shown. It stays in this tab, is never sent to our server or your account, and disappears when the tab is closed or you press “Clear”.	Until the tab is closed or you clear it	Asked: your browser asks before sharing your location

Analytics and statistics

Analytics is enabled on this site and is on by default. By visiting and using this site you agree to Google Analytics cookies being set in your browser (see the cookie table for names, purpose and duration). Google Analytics receives page-view data (page path, language, browser and approximate location) to produce visit statistics. You can opt out at any time with the control below.

Analytics on this browser

Analytics is currently on for this browser.

Google Analytics opt-out browser add-on

How long we keep data

Sessions last 7 days and are deleted when you sign out, reset your password or delete your account. Expired rows are removed by a clean-up that runs every 10 minutes.
Registration codes are valid for 10 minutes with at most 5 attempts; password reset links are valid for 30 minutes and work once. They are stored only as hashes.
Mail waiting to be sent holds your address and the code or link until it is delivered, then is deleted. Mail that cannot be delivered, or that has expired, has the address and content erased, and its record is removed after 7 days.
Your account, saved airports and Google link are kept until you delete the account.
Error reports are kept for manual review. Daily aggregate counters contain no personal data and are kept.
If the operator keeps backup copies of the database, a deleted account can remain in those copies until they are replaced or deleted.

Your choices and rights

You can delete your account yourself: sign in, open Me, and use “Delete my account”. You confirm with your password (or, for an account without a password, by typing your email address within 10 minutes of signing in with Google). Deletion removes your account, sessions, saved airports, codes and reset tokens, your Google link and any waiting mail addressed to you. It cannot be undone.

For any other request about your data, such as a copy or a correction, use the Contact page. We will look at the request; we do not promise a particular legal outcome.

You can change your analytics choice at any time with the control in “Analytics and statistics”, and you can clear cookies and tab storage in your browser.

Children

This site is not directed to children and is not designed for them to create accounts. If you believe a child has an account, contact us through the Contact page and we will delete it.

Changes to this policy

We may update this policy when the site changes. The date at the top shows when it was last updated. See also the Terms of use.