Aviation DB (aviationdb.uk) is operated as a sole trader in the United Kingdom. We provide a shared aviation database and, for Active paid subscribers, a personal local flight log of aircraft seen near a location you set.

For privacy requests, contact admin@aviationdb.uk or use the Contact form.

What we store depends on how you use the site. Guest browsing does not require an account. Verified (free) and Active (paid) accounts store the fields below.

Account and profile

Tracking location and personal flight log

Active paid subscribers may set a map pin so the site can build a personal local flight log. We store this as track_lat and track_lon. Background processes query public flight feeds for aircraft within a 5-mile radius of that point and append each pass to your private log.

Setting a location is optional and requires an Active plan. You can update or remove it at any time under Account → Tracking. Removing your location stops new sightings from being logged immediately.

Sighting history

Each logged pass may include registration, callsign, route, aircraft type, operator, altitude, speed, heading, and timestamp. This data is tied to your account, not published with your identity unless you opt into the community feed (see Section 7).

History is retained for the number of days on your Active plan (30, 90, 180, or 365 days). Older rows are purged automatically.

API keys and usage

Verified accounts receive 10 API requests per day. Active plans include higher limits. If you create an API key, we store a hashed key, an encrypted copy for display, a label, usage counters, and last-used timestamps to enforce limits and prevent abuse.

Notifications you configure

• Email digests: Scheduled summaries of your personal log sent to your account email when enabled.
• Instant email alerts: Optional messages for watchlist matches, first sightings, or rare visitors. Watchlist terms you enter (registrations or callsigns) are stored in your preferences.
• Discord webhooks: If enabled, you provide a Discord webhook URL (up to three). We store the URL and event types you select, then POST sighting payloads to Discord on your instruction. Discord's own privacy policy applies once data reaches their servers.

Sessions and security

When you sign in we record session rows including IP address, browser user agent, and activity timestamps so you can review or revoke active devices. Optional "remember me" uses a secure HTTP-only cookie linked to that session row (up to 30 days).

We also log security events (for example: login, password change, API key creation, session revocation) with IP address and event type for fraud prevention and account recovery.

Billing identifiers

If you subscribe, Stripe processes payment. We store Stripe customer and subscription identifiers to manage your plan. We do not store full card numbers.

• Provide and secure your account, including login, verification, and password reset.
• Build and display your personal local flight log, stats, exports, live tracker, and kiosk view when you have an Active plan and a location set.
• Send optional emails and webhook notifications you enable.
• Enforce API rate limits, prevent abuse, and diagnose technical problems.
• Process subscriptions and show billing status through Stripe.
• Publish anonymous community feed entries only when you opt in (Section 7).

We do not use your data for advertising, sell it to third parties, or build marketing profiles.

• Contract: Running your account, personal flight log, API access, and paid features you subscribe to.
• Legitimate interests: Security, fraud prevention, abuse monitoring, and keeping the service reliable.
• Consent: Optional community feed sharing, non-essential notification channels you turn on, and marketing emails if we ever offer them (none today).

• Personal flight log: kept for 30 to 365 days according to your Active plan. Older sightings are deleted automatically.
• Community feed: if opted in, eligible sightings may appear anonymously for up to 365 days. Opting out stops future sharing and removes your existing community rows.
• Account data: retained while your account is active. Deleted accounts are soft-deleted first, then purged on our schedule.
• Sessions and security logs: kept for a limited period for safety and diagnostics, then removed.
• API usage counters: rolled daily for rate limiting.
• Webhook delivery logs: kept briefly for troubleshooting failed deliveries.

The shared aircraft, route, and operator database is separate from your personal log and is retained as part of the public reference dataset.

Under UK GDPR you may access, correct, export, or delete personal data we hold about you.

• Update profile, timezone, notifications, and tracking location in Account settings.
• Download your personal sightings as CSV from Account → Export.
• Revoke API keys, sessions, and webhooks from your account at any time.
• Clear tracked flight data or request permanent account deletion via Account → Data or by emailing admin@aviationdb.uk.

We respond to formal requests within one month where the law requires it. You may also complain to the ICO if you believe your rights have been breached.

The community feed is optional. If enabled under Account → Profile, we may publish anonymous records including registration, callsign, route, aircraft type, operator, and a coarse region label. We never publish your name, email, or exact coordinates.

Opting in may backfill eligible sightings from the last 365 days. Opting out excludes future sightings and removes your existing community rows.

Paid Active plans are billed through Stripe. Payment details are processed by Stripe; we receive billing status, customer ID, and subscription ID only. Cancellation and refunds are described in our Terms of Service.

See the Stripe Privacy Policy for how Stripe handles payment data.

The site relies on external services to operate. Your personal account data is not sent to these providers except where noted.

• Flight tracking and indexing feeds: Our servers query public global flight APIs and community virtual radar sources to populate the shared database and detect overhead traffic. These backend requests do not include your email or name.
• Aircraft photos: Your browser may load images directly from third-party aviation photo APIs when you view a record.
• Map tiles: Interactive maps (FIR, routes, tracking) download tiles from external map providers via Leaflet.js.
• Stripe: Payment processing when you subscribe (Section 8).
• Discord: If you configure webhooks, sighting payloads are sent to the Discord URL you provide.
• Cloudflare Turnstile: Bot protection on forms (Section 11).

The shared database (registrations, callsigns, altitudes, speeds, operators, routes) comes from unencrypted ADS-B (Automatic Dependent Surveillance-Broadcast) radio signals broadcast publicly by aircraft in flight, aggregated through public and community feeds.

This telemetry describes aircraft, not private individuals. Indexing and displaying it is standard practice in aviation hobby communities and is separate from the personal account data described above.

We use strictly necessary cookies and similar storage. We do not use advertising or third-party marketing trackers.

• Session cookie: Keeps you signed in while you browse.
• Remember-me cookie: Optional persistent login when you choose it at sign-in (HTTP-only, up to 30 days).
• CSRF tokens: Protect forms and sensitive actions from cross-site request forgery.
• Cloudflare Turnstile cookies: Strictly necessary bot-detection cookies on protected forms. See below.

Because only essential cookies are used for core operation, we do not show a separate marketing consent banner. You can still block or delete cookies in your browser, though some features may stop working.

What Cloudflare collects

When Turnstile runs, Cloudflare may process technical signals such as IP address, TLS fingerprint, user-agent string, and the site key for this website. Cloudflare states these signals alone do not directly identify individuals.

How those signals are used

• Bot detection: Evaluated only to distinguish humans from automated traffic on our forms.
• Service improvement: Cloudflare may also use aggregated signal data to improve Turnstile as an independent data controller.

Cloudflare's role

For protecting our site, Cloudflare acts as a data processor on our behalf. For improving its own products, Cloudflare acts as a separate data controller under its own privacy policy.

For more detail see the Cloudflare Privacy Policy, the Turnstile product page, or contact Cloudflare's DPO at dpo@cloudflare.com.

We may update this policy when features or legal requirements change. The "Last updated" date at the top will change accordingly. Material changes to how we handle personal data will be reflected here and, where appropriate, noted on the site.

Related documents: Terms of Service, Pricing, About.