Last updated November 14, 2026
This policy explains what personal data the myFlights.me iOS app ("myFlights", "the app") processes, why, who else receives it, and what your rights are. It applies to version 2.2.0 and later. Some points differ in older versions, see section 3.
In short: myFlights stores the flights you log so they sync across your devices. Signing in is optional. If you sign in, we keep your email address so we can help you and tell you about important changes, never for advertising. The app shows no ads, does not track you across other apps or websites, and we do not sell your data. Your location never leaves your device.
The controller for the processing described here is Christian Au, an individual developer who publishes myFlights ("we", "us").
For anything about privacy or your data, write to privacy@myflights.me. For general app support, write to support@myflights.me.
When you log a flight, the app stores the details you enter or import for each leg: for example date, departure and arrival airports, carrier, flight number, aircraft type, registration, seat, class and your notes. This data is stored on your device and synced to our backend, which runs on Amazon Web Services (AWS) in Ireland (region eu-west-1). Your data there is keyed by a random app user ID that the app creates. It is not your name or email address.
Purpose and legal basis: providing the app and keeping your flights in sync and backed up (performance of our agreement with you, Art. 6(1)(b) GDPR).
The app saves your guest identity (see below), app settings and, from older versions, your app user ID in Apple's iCloud key-value storage, so that all your devices signed in to the same Apple Account use the same myFlights data. This storage is provided by Apple under your iCloud agreement with Apple. We cannot read your iCloud account.
Legal basis: performance of our agreement with you (Art. 6(1)(b) GDPR).
You don't need to sign up. On first launch, the app creates a guest account: Amazon Cognito (AWS, Ireland) gives your device a random identity, and our backend links your flights to it. The app keeps this identity and, once you sign in, your sign-in session in the keychain on your device.
You can sign in at any time with Apple, Google, Facebook, or an email address and password, and keep your flights. You can connect several of these sign-in methods to one account. When you sign in, Amazon Cognito stores your account on our behalf:
Every account, including guest accounts, also has a random support code, shown in Settings → Help & support. It lets us find your account when you write to us, and gives no one access to it. It is deleted with your account.
Signing in happens on our sign-in page at auth.myflights.me, in Apple's secure sign-in window. The page sets cookies that are needed only to sign you in, not for tracking. For Apple, Google and Facebook, the sign-in window shares its cookies with Safari, so a provider may remember that you signed in.
Legal basis: performance of our agreement with you (Art. 6(1)(b) GDPR). The sign-in provider also processes data under its own privacy policy (links in section 5).
Our backend keeps the email address of each sign-in method with your account. We use it only to:
We don't use your email address for advertising, and we don't send you newsletters or product news unless you have separately agreed to receive them. We never use email addresses to link or merge accounts. Guests have no email address with us.
Legal basis: performance of our agreement with you (Art. 6(1)(b) GDPR), and our legitimate interest in supporting you and keeping your data safe (Art. 6(1)(f) GDPR). You can object at any time by writing to privacy@myflights.me.
If you connect TripIt, you sign in to TripIt in Apple's secure sign-in window and allow myFlights to read your trips. Our backend then receives an access token from TripIt and stores it with your account, encrypted with a key that only our TripIt service may use. Nothing from TripIt is stored on your device. When the app imports, our backend fetches your trips from TripIt (USA) with this token, and the app adds the flights it finds to your log. If TripIt no longer accepts the token, the app tells you and you can reconnect.
You can disconnect TripIt at any time in Settings. This deletes the token from our backend. You can also remove myFlights in your TripIt account settings.
Legal basis: performance of our agreement with you, at your request (Art. 6(1)(b) GDPR).
When you look up a flight while adding it, the app sends the flight number, or the departure and arrival airports, and the date to our backend. Our backend asks a flight data provider (AeroDataBox, Canada, or FlightStats by Cirium, USA) for matching flights and returns them to the app. The providers only see our backend, not your device or your account. If you save a flight you found this way, the details the lookup returned are stored with it, like the details you enter yourself.
The number of lookups per account and day is limited. For this, our backend counts the lookups of your app user ID for the current day. The count is deleted after two days.
For each lookup our backend logs the flight number or airports, the date and whether a flight was found, but not who searched. We use these logs to see which flights people look for, to keep the lookup working and to control its costs. They are deleted after 365 days, like all backend logs.
Legal basis: performance of our agreement with you, at your request (Art. 6(1)(b) GDPR). For the daily count: our legitimate interest in preventing misuse and keeping the lookup affordable (Art. 6(1)(f) GDPR).
From version 2.3.0, the app checks data.myflights.me for updates to its airport, airline and aircraft data, at most once a day, and downloads them if there are any. These requests contain no personal data: no account, no user ID and nothing about your flights. Like any download, they reveal your device's IP address and standard technical information, such as the app version, to the server. The files are delivered by Amazon CloudFront (AWS) from the location nearest to you, which may be outside the EU. We don't keep access logs for these downloads, only overall request counts.
Legal basis: our legitimate interest in keeping the app's airport and airline data correct without an app update (Art. 6(1)(f) GDPR).
Maps in the app are loaded from Mapbox. To deliver map tiles, Mapbox receives your device's IP address and the requested map area. The Mapbox SDK may also send anonymous usage and telemetry data to Mapbox. You can opt out of Mapbox telemetry at any time with the (i) button on the map.
Legal basis: our legitimate interest in showing your flights on a map (Art. 6(1)(f) GDPR). You can object by opting out of telemetry as described above.
If you allow it, the app uses your location only while you are using the app, and only on your device to center the map. Your location is not sent to us or to anyone else. You can change this permission at any time in the iOS Settings app.
When the app talks to our backend, we log technical information: the app version and build, the outcome and timing of the request, and in some cases your pseudonymous app user ID. We use these logs to run the service, detect and fix errors, and keep older app versions compatible. We do not use IP addresses to track you. Logs are deleted automatically after 365 days.
Legal basis: our legitimate interest in a reliable and secure service (Art. 6(1)(f) GDPR).
In Settings → Debug you can create a diagnostic log file, for example to help us with a support request. The file is created only when you ask for it, and personal data in it is redacted. It stays on your device unless you choose to share it, for example by email to us.
When you write to support@myflights.me, we use your email address, your name if you give it, your message, and anything else you include, such as your support code or app version, to answer you. If your message is a feature request or bug report, we may keep it until the feature or fix is available, so we can let you know. We track such requests in our internal issue tracker only as a short summary, without your name, email address or support code.
To read and sort emails to support@myflights.me and prepare replies, we use Claude, an AI service by Anthropic (USA). Anthropic receives the content of these emails and processes it under its own privacy policy. We have turned off the use of this content for training Anthropic's models. A person reviews every reply before it is sent, and nothing about you or your account is decided automatically.
Emails to privacy@myflights.me are never processed with AI. If you don't want your message processed with AI, write to that address instead.
Purpose and legal basis: answering your request and following up on it (performance of our agreement with you, Art. 6(1)(b) GDPR). Using an AI service to do this efficiently as a single developer is based on our legitimate interest (Art. 6(1)(f) GDPR).
Version 2.1.0 has no Amazon Cognito account. It works as described in section 2, with these differences:
public_profile and email permissions from Facebook, but this version does not store your Facebook email address, and your Google name is used only on your device.When you update to 2.2.0, a guest account moves over automatically. If you signed in with Apple, Google or Facebook, you sign in once more to restore your data, and from then on section 2 applies.
The same as version 2.1.0, plus ads: versions 2.0.1 and earlier show ads provided by Google AdMob. In those versions, AdMob may collect device identifiers (including the advertising identifier, if you allowed tracking in Apple's App Tracking Transparency prompt), your IP address, and usage data, in order to show and measure ads. These ads may be personalized. Google processes this data under its own privacy policy. See Google's privacy policy and how Google uses data from sites or apps that use its services.
You can avoid this by updating to version 2.1.0 or later, which contains no ads. If you stay on an older version, you can deny tracking in the iOS Settings app under Privacy & Security → Tracking.
We may add the following in future versions. None of them is part of the current version.
Before introducing any of these, we will update this policy. Where consent is required, we will ask for it first, for example through Apple's App Tracking Transparency prompt, the iOS notification permission, or an opt-in for emails.
We use the following providers. Some act on our behalf as processors (AWS, Google Workspace). Others process data as independent controllers when you use their service through the app.
We may also disclose data if we are legally required to do so.
Our backend is in the EU (Ireland). Emails you send us are stored with Google Workspace, which may also process them in the USA. Emails to support@myflights.me are also processed by Anthropic in the USA to help us prepare replies. Using TripIt, Google or Facebook sign-in, or maps means data goes to providers in the USA. Flight lookups go from our backend to providers in Canada and the USA, without your account or device details. Airport and airline data downloads may be served from CloudFront locations outside the EU. Where data is transferred out of the EU/EEA or the UK, the transfer relies on an adequacy decision (such as the EU-U.S. Data Privacy Framework and its UK extension, where the provider is certified) or on standard contractual clauses that the provider offers. Please see each provider's privacy policy for details.
In the app, go to Settings → Delete account and data. This deletes your flights and your account from our backend and from Amazon Cognito: your sign-in methods, email addresses, name, guest identities and TripIt connection. Copies in our backups are gone within 35 days. You can also ask us to delete your data by writing to privacy@myflights.me. Data held by a sign-in provider or TripIt is subject to their own policies. You can remove myFlights from your account there.
Under the GDPR and UK GDPR you have the right to:
To use these rights, write to privacy@myflights.me. So we can find your data, include your support code (in the app under Settings → Help & support), or tell us the email address you signed in with. Guests have no email address with us, so for them the support code is the way to find their data. You also have the right to complain to a data protection authority, for example the one where you live (EU/EEA authorities) or, in the UK, the Information Commissioner's Office.
We do not use automated decision-making or profiling that has legal or similarly significant effects on you.
If you live in a US state with a consumer privacy law (for example California), you may have the right to know what personal data we process, to have it corrected or deleted, and to opt out of its sale or its sharing for targeted advertising. We do not sell personal data or share it for targeted advertising in the current version. We will not discriminate against you for using your rights. Residents of other countries may have similar rights under local law. In all cases, write to privacy@myflights.me and we will help.
myFlights is not directed at children under 16, and we do not knowingly collect personal data from them. If you believe a child has given us personal data, please contact us and we will delete it.
Data between the app and our backend is encrypted in transit, and access to the backend is restricted. No system is perfectly secure, but we take reasonable measures to protect your data.
We will update this policy when the app or our practices change, and adjust the date at the top. For significant changes, such as the planned features above, we will update the policy before the change takes effect.
Privacy questions and requests: privacy@myflights.me
App support: support@myflights.me