Privacy

This policy describes how Landblink handles data.

Landblink is an Android application for airline passengers. It provides an offline moving map, flight instrumentation, and satellite reception details from the window seat. The application is distributed as a direct Android package (APK) download and is installed manually by sideloading. It is not distributed through Google Play.

Landblink is made and operated by one person, not a company. The operator's name and postal address are available on request through the contact route below, and will be published here before Landblink is offered on any app store.

1. The Core Principle: On-Device Storage

Landblink is built to run offline. The phone is the primary database.

All recordings, flight logs, sensor data, and saved flight schedules are stored locally on your device in private application storage. The application does not require an account. It does not ask for your name, email address, phone number, or social media profile.

You can use the application throughout an entire flight without an active internet connection. Nothing is uploaded during normal operation unless you choose to enable the optional flight contribution feature.

2. Information Handled On Your Device

The application reads several device sensors and files to generate flight telemetry. These remain on your phone:

• Location and GNSS telemetry. Landblink reads location data from your phone's Global Navigation Satellite System (GNSS) receiver. This includes latitude, longitude, altitude, groundspeed, bearing, and raw satellite measurements (such as pseudoranges, signal strength, and carrier frequency). This data powers the moving map and the Nav Lab solver.
• Barometric pressure. If your phone has a barometric sensor, the app reads atmospheric pressure to calculate cabin pressure altitude and detect cabin repressurization trends.
• Motion sensors. Accelerometer and gyroscope data are processed in memory by an internal filter to bridge brief satellite signal gaps.
• Boarding pass scans. If you use the camera to scan a boarding pass barcode, the image is processed entirely on your device using local libraries. No camera frames, photos, or scan results are sent to an external server. The camera is accessed only when you tap the Scan button.
• Imported passes. Apple Wallet passes (.pkpass files) imported into the app are parsed locally to extract flight numbers and airport codes.
• Flight test logs. If enabled for testing, detailed diagnostic records (black-box logs) are written to private device storage. They never leave the device unless you manually export them.

3. Device Permissions

The application requests only permissions needed for passenger flight tracking:

• Foreground location (ACCESS_FINE_LOCATION, ACCESS_COARSE_LOCATION). Required to compute position and display flight telemetry. Recording runs as a foreground service with an ongoing status notification (FOREGROUND_SERVICE_LOCATION). Landblink does not request or use background location permission (ACCESS_BACKGROUND_LOCATION). Location is read only while the app is active or while a flight recording is running.
• Camera (CAMERA). Optional. Used exclusively to scan boarding pass barcodes in the flight setup screen. If you decline camera access, you can still enter flight details manually or import a digital pass file.
• Notifications (POST_NOTIFICATIONS). Optional on Android 13 and newer. Used to display current flight status, speed, and phase in the Android notification drawer while recording.
• Network access (INTERNET, ACCESS_NETWORK_STATE). Used before flight on Wi-Fi or cellular networks to fetch optional public satellite orbit products, route weather forecasts, and to transmit contributed flights if enabled.

4. Optional Flight Contribution

Landblink includes an optional community feature called "Contribute my flights". When enabled, the app uploads completed flight tracks to the backend server to build crowdsourced typical route corridors.

Opt-in and Consent

Contribution is disabled by default. The application will never upload flight recordings without your affirmative choice. You can opt in through a setup prompt or via the toggle in the Setup screen under "Cloud backend".

Under European data protection law (General Data Protection Regulation / GDPR), the lawful basis for processing this contributed data is your consent under Article 6(1)(a).

Consent is verified immediately before each upload begins. If you turn contribution off, the app checks your preference before initiating any network transfer and will not start an upload. Network requests already transmitted across the network cannot be cancelled mid-flight.

What an Upload Contains

When contribution is enabled, a completed flight upload contains:

• A random installation identifier (deviceId).
• An internal local flight identifier (clientFlightId), used to prevent duplicate processing.
• Flight metadata: flight number, origin airport code, destination airport code, recording start time, and recording end time.
• The ground track: a downsampled series of measured points containing timestamp, latitude, longitude, altitude, groundspeed, heading, and an indicator marking whether a point was dead-reckoned.
• Unreliable points that fail physical motion thresholds are excluded before upload.

An upload does not include your name, device hardware identifiers (such as IMEI or MAC address), or user account details.

Terminal Area Withholding (15 km Trim)

To protect privacy at departure and arrival locations, Landblink withholds the airport ends of every contributed track.

Before data leaves your phone, the application calculates the first and last recorded points. It removes all coordinates located within 15 kilometers of the starting point, and all coordinates located within 15 kilometers of the ending point.

The gate, the taxi route, the runway rollout, and the initial climb stay on your device. The touchdown, rollout, and arrival stand stay on your device. Coordinates outside the 15-kilometer boundary are transmitted as recorded. Points are removed, never fuzzed or altered.

If an entire flight is shorter than 30 kilometers, the entire track falls within the withholding circles. In that case, the track is withheld completely and the upload is cancelled.

Pseudonymous Data and Linkability

The installation identifier is a public one-way hash derived from a 256-bit cryptographic credential generated on your device. It is stored in local encrypted storage.

This identifier remains stable across uploads from the same installation. Because multiple flights share the same identifier, separate uploads from your phone can be linked together on the server. Combined with publicly available airline passenger manifests or flight schedules, linkable flight tracks could potentially identify an individual passenger.

For this reason, Landblink treats contributed flight data as pseudonymous personal data rather than anonymous data. We do not claim this data is anonymous.

Reinstalling the application or clearing application storage deletes the credential and generates a new, unrelated installation identifier.

5. Other Network Requests

When your device has network connectivity, the application may make the following requests:

• Satellite orbit products. The app downloads multi-GNSS orbit ephemerides from the backend server to assist offline positioning calculations in the Nav Lab.
• Satellite catalog. The app downloads updated satellite metadata to keep the offline satellite catalog current.
• Route weather. When you request weather for a planned flight, the app downloads wind and turbulence forecast grids for the flight corridor. Forecasts are cached locally for offline in-flight display.

These download requests transmit the installation identifier for authentication and rate-limiting. They do not transmit your location or personal recordings.

6. Data Retention

Data retention depends on where the data resides:

• On your phone. Recorded flights and black-box logs remain on your device until you delete them using the History screen or uninstall the application.
• On the server. Contributed flight tracks are stored in a PostgreSQL database on the backend server. These tracks are retained to compute and update aggregated route shapes. They remain stored until deleted through an in-app deletion request or server maintenance.

7. Your Rights and How to Exercise Them

Under applicable data protection laws, including the GDPR, you have rights regarding your personal data:

• Withdrawal of consent. You may withdraw consent for flight contribution at any time by toggling "Contribute my flights" to off in the Setup screen. Future uploads will stop immediately.
• Erasure (Right to be forgotten). You can delete your contributed flights directly from within the app. In the Setup screen, tap "Delete my shared flights". The app transmits an authenticated deletion request using your private installation credential. The server deletes all flight records associated with your installation identifier, resets derived route summaries, and records the revocation. Local recordings on your phone are not deleted.
• Access and Portability. Recorded flights on your device can be exported at any time as standard GPX files via the History screen share menu.
• Older or legacy contributions. If you have uninstalled the application or cleared storage, your private installation credential is permanently lost from your device. In this situation, the in-app deletion tool cannot authenticate against past uploads. To request manual deletion of older contributions, contact github.com/leonaffi-byte/flygps/issues. Because no names or email addresses are attached to uploads, you must provide the flight number, departure airport, destination airport, and approximate date of travel to identify the matching records.

8. International Data Transfers

The Landblink backend runs on a virtual private server (VPS) located in the European Union or the United States.

If you access the application or contribute flight data from outside the server's host jurisdiction, your pseudonymous data will be transferred across borders to the server location. Technical safeguards include encrypted transport (HTTPS/TLS) and token-based authentication.

9. Operator Contact

Landblink is an independent personal project, developed and operated by one person.

For privacy inquiries, questions about data handling, or data subject requests, please contact:

Contact: github.com/leonaffi-byte/flygps/issues

The following literal placeholders appear in this document and must be replaced with verified details:

Technical Notes and Reconciliation with Code

This document reflects the application codebase. Where earlier project briefs or informal summaries differed from the codebase, the code was treated as the authoritative source of truth:

1. Uploaded payload fields: The uploaded payload (UploadFlight and TrackPoint in FlightUploader.kt) includes bearing (bearingDeg), a dead-reckoning status flag (isDeadReckoned), and a client flight ID (clientFlightId) used as an idempotency key, in addition to coordinates, altitude, speed, flight number, airports, and timestamps.
2. Short flight withholding: In TerminalAreaTrim.kt, the 15 km trim rule withholds all points within 15 km of the initial point and 15 km of the final point. If a track's total span is shorter than 30 km (twice the radius), all points are withheld and the uploader discards the upload due to insufficient usable points.
3. Consent boundary: In FlightUploader.kt, contribution consent is re-read immediately prior to dispatching the network request. If a request is already transmitted across the network socket, it is not cancelled in flight.
4. Credential-scoped erasure: The in-app deletion mechanism (DELETE /v1/contributions in server/src/flights/routesHttp.ts and contributions.ts) authenticates using the private bearer token stored in Android Keystore. It purges all records tied to that specific installation credential. Legacy unauthenticated contributions cannot be purged via this credential and require manual operator verification.