landblinkDownload for Android

Privacy

What Landblink records, what stays on your phone, and what happens only if you opt in.

Updated 11 October 2026

This policy describes how Landblink handles data.

Landblink is an Android application for airline passengers. It provides an offline moving map, flight instrumentation, and satellite reception details. A Google Play release is being prepared.

Landblink is made and operated by one person, not a company. The operator's name and postal address are available on request through the contact route below, and will be published here before Landblink is offered on any app store.

1The Core Principle: On-Device Storage

Landblink is built to run offline. The phone is the primary database.

All recordings, flight logs, sensor data, and saved flight schedules are stored locally on your device in private application storage. The application does not require an account. It does not ask for your name, email address, phone number, or social media profile.

You can use the application throughout an entire flight without an active internet connection. Your recordings and flight logs are never uploaded unless you turn on the optional flight contribution feature. When you have a connection, some features fetch data from the Landblink server (weather, flight lookup, satellite data); section 5 lists each request and exactly what it sends.

2Information Handled On Your Device

The application reads several device sensors and files to generate flight telemetry. They are processed on your phone. Flight details you save from them (flight number, airports, times) are used by the requests in sections 4 and 5:

  • Location and GNSS telemetry. If you allow location, Landblink reads location data from your phone's Global Navigation Satellite System (GNSS) receiver. This includes latitude, longitude, altitude, groundspeed, bearing, and raw satellite measurements (such as pseudoranges, signal strength, and carrier frequency). This data powers the moving map and the Nav Lab solver.
  • Barometric pressure. If your phone has a barometric sensor, the app reads atmospheric pressure to calculate cabin pressure altitude and detect cabin repressurization trends.
  • Motion sensors. Accelerometer and gyroscope data are processed on your phone to bridge satellite signal gaps. Values derived from them are written to the flight log below.
  • Boarding pass scans. If you use the camera to scan a boarding pass barcode, the image is processed entirely on your device using local libraries. No camera frames, photos, or scan results are sent to an external server. The camera is accessed only when you tap the Scan button.
  • Imported passes and files. Apple Wallet passes (.pkpass), PDF boarding passes and boarding-pass images that you share into the app, or choose from the scanner, are read on your device: the barcode is decoded locally, the flight number and airport codes are copied into the form, and the file itself is not kept.
  • Shared text. If you share the text of a booking confirmation into Landblink, the text is scanned on your device for flight numbers, airport codes, dates and times. The text is not stored and is not sent anywhere.
  • Calendar events. If you tap "From calendar" in Setup, the app reads calendar events for the next 60 days on your device, keeps only those that look like flights, and shows them to you. Nothing is written to your calendar, and calendar data is not uploaded. The app never reads the calendar without that tap.
  • Flight logs. For every recording, Landblink writes a detailed log (a "black box": positions, sensor readings and what the app decided). It is stored in Landblink's own folders on your phone, including its folder under Android/data, which you can open from a computer over USB. Logs never leave the phone unless you share or export them yourself.

3Device Permissions

The application requests only permissions needed for passenger flight tracking. The optional ones are asked for when a feature needs them; the others Android grants when you install the app.

  • Location (ACCESS_FINE_LOCATION, ACCESS_COARSE_LOCATION). Optional. Landblink asks once, after the first-run introduction, and works without it. With no location, it records height and motion from the phone's pressure and motion sensors. With approximate location, the map and speed are rough. With precise location, it records the full track. Location is used on your phone for the map, speed and the recorded track, and is sent only in the cases listed in sections 4 and 5. While Landblink records, or waits for a saved flight, it shows a permanent notification, so you can always see when it is active. When you allow location, Landblink also receives Android's own network-based location, which Android provides under its own terms.
  • Background location (ACCESS_BACKGROUND_LOCATION). Optional, and never required. When a saved flight is coming up, Landblink may ask "Record this flight with the screen off?". If you agree, you set location to "Allow all the time". It never asks daily. If you say no, a recording you start with the app open still uses location after the screen turns off, while its notification shows; a recording that starts by itself with the screen off uses the pressure and motion sensors only. Background location is used only while a recording is running or the app is waiting for a saved flight.
  • Camera (CAMERA). Optional. Used exclusively to scan boarding pass barcodes in the flight setup screen. If you decline camera access, you can still enter flight details manually or import a digital pass file.
  • Calendar (READ_CALENDAR). Optional. Requested only when you tap "From calendar", and used only to list flight-like events on your device. It is read-only; Landblink never writes to your calendar.
  • Exact alarms (SCHEDULE_EXACT_ALARM). Optional. Asked in the same way, when a saved flight is coming up ("Start recording on time"), so Landblink can start watching for that flight at the right moment. It never asks daily.
  • Start after restart (RECEIVE_BOOT_COMPLETED). After your phone restarts or the app updates, Landblink re-sets the reminders for your saved flights, because Android clears them, so recording still starts on time. If you turned on flight contribution, it may also send finished flights that were not uploaded yet; otherwise it sends nothing.
  • Recording in the background (FOREGROUND_SERVICE, FOREGROUND_SERVICE_LOCATION, FOREGROUND_SERVICE_SPECIAL_USE, WAKE_LOCK). Let a recording keep running, with its notification showing, when you leave the app or the screen turns off, including a recording that uses only the pressure and motion sensors.
  • Satellite assistance (ACCESS_LOCATION_EXTRA_COMMANDS). Lets Landblink ask Android to refresh its satellite assistance data before a flight, so the first position comes faster. Android downloads that data from its usual provider (Google or your phone's maker).
  • Notifications (POST_NOTIFICATIONS). Optional on Android 13 and newer. Used to display current flight status, speed, and phase in the Android notification drawer while recording.
  • Network access (INTERNET, ACCESS_NETWORK_STATE). Used when you have a connection for the requests in section 5, and to send contributed flights if you turned that on.

4Optional Flight Contribution

Landblink includes an optional community feature called "Contribute my flights". When enabled, the app uploads completed flight tracks to the backend server to build crowdsourced typical route corridors.

Opt-in and Consent

Contribution is disabled by default. The application will never upload flight recordings without your affirmative choice. You can opt in through a setup prompt or via the "Contribute my flights" toggle in Setup → Share flights.

Under European data protection law (General Data Protection Regulation / GDPR), the lawful basis for processing this contributed data is your consent under Article 6(1)(a).

Consent is verified immediately before each upload begins. If you turn contribution off, the app checks your preference before initiating any network transfer and will not start an upload. Network requests already transmitted across the network cannot be cancelled mid-flight.

What an Upload Contains

When contribution is enabled, a completed flight upload contains:

  • A random installation identifier (deviceId).
  • An internal local flight identifier (clientFlightId), used to prevent duplicate processing.
  • For the departure and arrival airport, whether you entered it yourself or it came from the flight lookup.
  • The takeoff and landing time, to the minute, and whether each came from cabin pressure or satellite positioning. They are used only to work out the typical airborne time for a flight number: the middle value across at least three installations that are at least 14 days old (flights no longer linked to an installation, see below, count once per flight number and upload day), rounded to 5 minutes. No single flight's times are ever shown, and they are deleted with the flight.
  • Flight metadata: flight number, origin airport code, destination airport code, recording start time, and recording end time.
  • The ground track: a downsampled series of measured points containing timestamp, latitude, longitude, altitude, groundspeed, heading, and an indicator marking whether a point was dead-reckoned.
  • Unreliable points that fail physical motion thresholds are excluded before upload.

Turning contribution on also shares your earlier finished flights that were never uploaded, not only future ones. An upload does not include your name, device hardware identifiers (such as IMEI or MAC address), or user account details.

Terminal Area Withholding (15 km Trim)

To protect privacy at departure and arrival locations, Landblink withholds the airport ends of every contributed track.

Before data leaves your phone, the application takes the first and last recorded points. From version 2.5.0, it removes every point within 15 kilometers of the starting point and every point within 15 kilometers of the ending point, wherever in the flight it occurs. In 2.4.2 and earlier it removed the stretch before the aircraft first got 15 kilometers away from the start and after it last came within 15 kilometers of the end; if the aircraft passed back inside a circle in between, for example on a departure turn back over the airport, those points were sent.

The gate, the taxi route, the runway rollout, and the initial climb stay on your device. The touchdown, rollout, and arrival stand stay on your device. Coordinates outside the 15-kilometer boundary are transmitted as recorded. Points are removed, never fuzzed or altered.

If an entire flight is shorter than 30 kilometers, the entire track falls within the withholding circles. In that case, the track is withheld completely and the upload is cancelled.

Pseudonymous Data and Linkability

The installation identifier is a public one-way hash derived from a 256-bit cryptographic credential generated on your device. It is stored in local encrypted storage.

This identifier remains stable across uploads from the same installation. Because multiple flights share the same identifier, separate uploads from your phone can be linked together on the server. Combined with publicly available airline passenger manifests or flight schedules, linkable flight tracks could potentially identify an individual passenger.

For this reason, Landblink treats a contributed flight as pseudonymous personal data, not anonymous data, for its first 60 days on the server.

After 60 days the flight is cut loose from your installation. The server replaces the installation identifier and the local flight identifier with new random values and cuts the upload time down to the day, and it keeps no record of the old identifier. From then on the server cannot tell which installation sent the flight, and your flights no longer share an identifier (only copies of one flight number uploaded on the same day share one). The app can no longer find the flight to delete it. What stays is the flight number, the aircraft's path and times, and when your recording started and ended. Two limits: someone who holds the recording on your phone could still match it, and on a very small aircraft, such as a private plane with a handful of people on board, a path and date can narrow down who flew. Delete such a flight within 60 days if that matters to you.

Reinstalling the application or clearing application storage deletes the credential and generates a new, unrelated installation identifier.

Flight-Sharing Impact

The app can show you how often flights you shared helped other passengers. When the Landblink server answers a typical-route, community-schedule or time-in-the-air request with data built from shared flights, it can count that lookup toward the flight number. Answers from the schedule provider are not counted. Lookups by every installation can be counted, whether or not it shares flights.

What is stored: for each flight number and UTC day, one number (how many lookups were counted). Different spellings of the same flight number share one count. No installation identifier, account or time finer than the day is stored with it. Some lookups are not counted, so the number is a lower bound, not a count of distinct people.

So that one installation is counted at most once per flight number per day, the server keeps one-way hashes in memory: of the day, the installation identifier and the flight number, and of the day and the installation identifier with a small counter (at most 50 flight numbers per installation per day). These hashes are never written to disk. They are cleared when the server restarts, or at its first counting attempt on a new UTC day, so they can stay in memory a while past midnight. A lookup is not counted if a flight with that number is still linked to your installation; the server checks this when counting and does not store the result.

What you see: a total for your shared flights that are still linked to your installation (see above), counts per flight, and whether your flight was a "pioneer", the earliest stored upload on that flight number with enough usable track points. Counts include completed UTC days only, so today's lookups show from tomorrow. A flight's count starts on its upload day; if you shared the same flight number twice, the total counts it once. The answer contains no other person's flights or installation identifiers.

The daily counts are deleted once they are more than 400 days old. Deleting your shared flights from the server removes them from your total but leaves the daily counts, because those are kept per flight number, not per flight or installation.

The lawful basis for counting lookups, including lookups by installations that do not share flights, is our legitimate interest under GDPR Article 6(1)(f) in showing contributors that their flights are used, done with short-lived in-memory hashes only.

5Other Network Requests

When your device has network connectivity, the application may make the following requests:

  • Satellite orbit products. The app downloads satellite orbit data from the Landblink server to help it work out positions offline.
  • Route weather. Before a saved flight, and when you open a planned flight, the app downloads wind and turbulence forecasts for the route. It sends the planned departure and arrival airports' coordinates, the departure time and, if known, the cruise speed. The Landblink server asks Open-Meteo (open-meteo.com) for the forecast at points along the route for the hours around your flight; it passes on nothing else about you. Forecasts are kept on your phone for use in flight.
  • Typical route. For a flight number, the app may ask the Landblink server for the usual path of that flight. It sends the flight number only.
  • Time in the air. For the flight you pick before departure, and for the flight being recorded, the app asks the Landblink server how long that flight usually spends in the air, as measured by travellers who contribute flights. It sends the flight number only. The answer is a typical number of minutes and how many travellers it is based on, never another traveller's flight; the app keeps it for up to 30 days so it works offline, and if there is no answer yet it asks again at most every 6 hours.
  • Flight-number lookup. When you add a flight by typing its number, the app asks the Landblink server for that flight's schedule so the airports and times can be filled in for you. The request contains the flight number and, for a one-off trip, the date you entered — nothing else about you. The server answers first from Landblink's own contributed flights and otherwise asks a schedule provider, AeroDataBox (operated by AeroDataBox / RapidAPI), passing on only the flight number and date. Provider answers are cached on the Landblink server for seven days and deleted within the following hour (server backups can hold copies longer), as the provider's licence requires; they are not linked to your flights. The provider's own privacy terms apply to what it receives: https://aerodatabox.com/privacy. If you would rather not use this, leave the flight number empty and enter the airports and times yourself.
  • Your impact. If you share flights, the app asks the Landblink server how often they helped other passengers (see "Flight-Sharing Impact" in section 4). The request uses the usual app and installation keys and contains no flight number, date or recording.
  • Family link (from version 2.5.1). Before a flight you can create a link for family or friends. Anyone who has the link can open it on landblink.app and see what you chose to share: an optional first name or nickname (up to 30 characters), the flight (number, date, airports and scheduled times) and, while your phone has internet, the flight's stage (boarding, taxiing, in the air, landed), when that was observed and the estimated arrival. Your position is not shared unless you turn on "Show roughly where the plane is". Then the app sends a position only while it detects that the plane is climbing, cruising or descending, rounded to about 10 km (more near the poles), and the page shows only the latest such point, and only while it is a few minutes old. It never shows your track. The Landblink server keeps your installation's identifier with the link so that only your phone can update or stop it, and to limit how many links one phone can make, together with a random request number the app uses so that a retried request does not create a second link; neither is ever shown on the page. You choose when the link ends, at most 48 hours after you create it, and you can stop it at any time. A stopped link stops working at once and its content is erased; a link that runs out stops working at once and its content is erased within the hour. What remains (no name, flight or position) is deleted a day later. Family links are never included in the server's database backups. When someone opens a link, landblink.app passes their IP address to the Landblink server only to limit abuse; it is counted briefly in memory, not stored with the link and not logged. The page has no analytics and is hidden from search engines. Anyone you send the link to can pass it on, so share it only with people you trust.
  • Crash reports. They are off unless you turn on "Send crash reports" in Setup. A report contains a random report number, the time of the crash, the app version, Android version, phone make and model, a few short technical labels, and the error details (a technical record of what failed). Before a report is saved on your phone, Landblink removes long decimal numbers (such as precise coordinates), long codes and file paths from the error details. A report does not include your recorded flights or an identifier for your installation, though an error message can mention app details such as a flight number. Reports not yet sent are deleted when you switch crash reports off. The Landblink server removes coordinates, e-mail addresses, codes and file paths again, stores each report without your IP address or installation and with the date only, and deletes it after 90 days.

Requests to the Landblink server, except crash reports, carry your installation's private access key: a random secret that proves the request comes from the app, linked to no name or account. The server uses it to refuse abuse. To limit abuse, the server also briefly keeps short-lived counters, including one per network part of your IP address, for up to two days, for every installation, whether or not it contributes flights. It also keeps a record that your installation exists: a one-way digest of its key and the day it was first seen, with nothing else attached. For shared route, schedule and time-in-the-air answers, the server also uses your installation key to count lookups as described in "Flight-Sharing Impact" in section 4, whether or not you share flights. Its request logs contain no IP address and are size-limited, so old entries are overwritten. None of these requests send your location history or your recordings.

6Data Retention

Data retention depends on where the data resides:

  • On your phone. Recorded flights and their flight logs remain on your device until you delete them in the History screen or uninstall the application. From version 2.5.0, deleting a flight also removes its exported GPX files, its bumps data and its shared images and videos, and a log left by an interrupted recording is removed at the next app start or recording stop. In 2.4.2 and earlier, exported GPX files and logs from interrupted recordings stay until you uninstall. Copies you shared with other apps or saved elsewhere are outside Landblink's reach.
  • Journal backup file (from version 2.5.0). If you create one, the file holds your routes and is saved where you pick. Landblink never sends it anywhere.
  • Android backup. If Android backup is on, your settings and your upcoming saved flights (flight numbers, airports and times) are included in Android's Google cloud backup. From version 2.5.0, your recorded flight history, flight logs, your last known position and your exports are never sent to that cloud backup; in 2.4.2 and earlier they could be included. Your installation credentials and contribution settings are never backed up. A direct phone-to-phone transfer moves your flights and logs to the new phone.
  • Family links. A link runs for at most 48 hours. Its content is erased when it ends (within the hour when it runs out); the empty record (no name, flight or position) is deleted a day later. Family links are never in server backups.
  • Crash reports. Each report is kept on the Landblink server for 90 days and then deleted. Crash reports are not included in backups.
  • On the server. Contributed flight tracks are stored in a PostgreSQL database on the backend server, to compute and update aggregated route shapes and typical flight times. For 60 days after upload a flight is linked to your installation and you can delete it from the app. After that it is no longer linked to your installation (see "Pseudonymous Data and Linkability" in section 4) and is kept for as long as it helps the route predictions. The server's database is backed up every night, on the server, on the operator's own computer and, encrypted, in off-site storage. Backups are kept for about a month (14 daily copies and 4 weekly ones, and 30 days off-site), so a flight you delete, or the link of one that is 60 days old, is gone from every copy within about a month; no copy linking a flight to your installation is left more than about three months after its upload. Daily flight-sharing counts (flight number, UTC day, number of lookups; no installation identifier) are deleted once they are more than 400 days old; backup copies follow the backup schedule above.

7Your Rights and How to Exercise Them

Under applicable data protection laws, including the GDPR, you have rights regarding your personal data:

  • Withdrawal of consent. You may withdraw consent for flight contribution at any time by turning "Contribute my flights" off in Setup → Share flights. Uploads stop; one that is starting at that very moment may still complete. From version 2.5.2, if you have shared flights, the app then asks whether to delete the ones still linked to your installation (those uploaded in the last 60 days) or keep them; in earlier versions, use "Delete my shared flights".
  • Erasure (Right to be forgotten). You can delete your contributed flights directly from within the app. In the Setup screen, tap "Delete my shared flights". The app transmits an authenticated deletion request using your private installation credential. The server deletes all flight records still associated with your installation identifier (those uploaded in the last 60 days; older ones are no longer linked to it, see the next items), resets derived route summaries, and records the revocation, so this installation cannot contribute again; reinstalling gives a new one. Local recordings on your phone are not deleted.
  • Access and Portability. Recorded flights on your device can be exported at any time as standard GPX files via the History screen share menu.
  • Older or legacy contributions. If you have uninstalled the application or cleared storage, your private installation credential is permanently lost from your device. In this situation, the in-app deletion tool cannot authenticate against past uploads. To request manual deletion, e-mail contact@landblink.app. Because no names or email addresses are attached to uploads, you must provide the flight number, departure airport, destination airport, and approximate date of travel to identify the matching records. For a contribution older than 60 days, also give the recording's start and end times as the app shows them, since the installation link is gone; the operator deletes the flight if exactly one matches.
  • Other requests. You can also ask for a copy of your server data, correction, restriction or objection at contact@landblink.app; we answer within one month.
  • Complaints. You can complain to the data-protection authority where you live (in the EU, your national authority; in the UK, the ICO) and to Israel's Privacy Protection Authority. UK users: we acknowledge complaints within 30 days.

8International Data Transfers

The Landblink server runs in the United States (Oracle Cloud, Phoenix, Arizona). This website and the app download are served by Cloudflare. Section 9 covers the website itself. The flight lookup and weather providers named in section 5 receive only the flight and route details described there.

If you access the application or contribute flight data from outside the server's host jurisdiction, your pseudonymous data will be transferred across borders to the server location. Oracle America, Inc. (server host), Cloudflare, Inc. (website, mailing-list storage) and Plus Five Five, Inc., trading as Resend (mail), are certified under the EU-U.S. Data Privacy Framework and its UK extension; each also binds Standard Contractual Clauses through its data-processing agreement, a copy of which you can request. Transfers from Israel rely on those written undertakings. All traffic is encrypted in transit (HTTPS/TLS).

9The Website and the Email List

  • Visit counts. The website counts visits with Cloudflare Web Analytics: for each page view it records the page address, the address of the page that linked to it, the browser type and the country. It sets no cookie, stores nothing on your device and does not build a profile of you. Family link pages, email-list pages and the "not found" page are not counted.
  • Email list. If you enter your email address on the front page, Landblink stores it with the date and sends one mail with a confirmation link. Nothing else is sent until you confirm, and an address that is not confirmed is deleted after 7 days. Once confirmed, you get one mail when Landblink is on Google Play and after that at most one a month about major releases. The address is used for nothing else and is never sold or shared for anyone else's marketing. The legal basis is your consent, which you give by confirming; a confirmed address is kept until you leave the list or the list is closed.
  • Where it is kept. Addresses are stored with Cloudflare, and mail is sent through Resend (Plus Five Five, Inc., trading as Resend, USA), from its EU region, under its data processing agreement, which covers transfers out of the EU. Resend keeps a delivery record of each mail for a limited time under its own policy. Its open and click tracking is switched off, so Landblink does not know whether you opened a mail or clicked a link.
  • Leaving. You can withdraw your consent at any time. Every mail after the confirmation has a link that deletes your address at once; the address is erased, not just marked. You can also write to contact@landblink.app.

10Operator Contact

Landblink is an independent personal project, developed and operated by one person.

For privacy inquiries, questions about data handling, or data subject requests, please contact:

contact@landblink.app