Privacy policy

Controller identity and contact

The controller responsible for processing personal data through Vatlytics is:

Data protection officer: Not applicable. Vatlytics is run by one person and does not meet the conditions that would require one to be appointed. Please direct any data protection question to the address above.

What data is processed and why

Server logs and operational security

Each request is recorded with your IP address, the request method, route and path, the response status, how long it took, and a request ID. These records are used to operate and secure the service, diagnose faults, and prevent or investigate abuse. The legal basis is the controller's legitimate interests in reliable and secure service operation under Article 6(1)(f) GDPR.

Aggregate visitor counting

Vatlytics estimates visitors currently online and unique visitors during the last 24 hours using an ephemeral, salted hash of the resolved IP address and browser user-agent. The random salt and hashes exist only in application memory, are never stored on disk or in the database, expire automatically, and reset when the process restarts. The user-agent header is also classified into one of seven fixed browser, bot or unknown families for aggregate page-view counters; the raw header is never used as a metric label or stored by this counting. These values are used only for aggregate counts and are not linkable by Vatlytics to a person. This counting sets no cookie and uses no browser storage. Health checks, metrics, API and JSON requests, authentication endpoints, and static assets are excluded.

Optional VATSIM Connect account

If you choose to sign in, Vatlytics receives your VATSIM CID and name from VATSIM Connect. Vatlytics requests only the full_name scope, so your VATSIM rating, region and division are not requested and are not stored. A strictly necessary session cookie keeps you signed in; the server stores only a hash of the session token. The legal basis is performance of a contract under Article 6(1)(b) GDPR, namely providing the account features you ask for. Signing in is optional and public statistics remain available without an account. You may also exercise any right by writing to the email address above.

API keys

If you create an API key, the server stores a hash rather than the full key. The key supports optional authenticated API access and is processed under the same legal basis as the account.

Browser preferences

Public pages set no cookies. Vatlytics uses localStorage only to remember a selected System, Light or Dark theme, keep a dismissed storage notice hidden, and remember whether the operator-only Account navigation link is shown. Vatlytics uses no sessionStorage.

Public VATSIM network data

Flight and controller activity is sourced from VATSIM's public data feed. It concerns members' network activity under their VATSIM IDs and is used to produce flight records, movement statistics and activity summaries. The legal basis is the controller's legitimate interest under Article 6(1)(f) GDPR in documenting and explaining activity published on the network. Because this data is obtained from the public feed rather than from you directly, Article 14 GDPR applies, and this policy is the information required under it.

A signed-in member can exclude their member page from search-engine indexing through the account page. This affects search indexing, not the underlying public network data or statistics.

Third parties and recipients

The production server is operated by Hetzner Online GmbH in Nuremberg, Germany. Personal data processed by Vatlytics itself is therefore held in Germany.

Map pages ask the visitor's browser to load tiles directly from the configured map provider. The software default is the OpenStreetMap Foundation tile service. Each tile request necessarily sends the visitor's IP address and the requested tile coordinates to the OpenStreetMap Foundation; its handling of those requests is described in the OpenStreetMap Foundation privacy policy. The Foundation states that data associated with tile requests is held in the United Kingdom and the Netherlands.

Both countries are covered by EU adequacy: the Netherlands as an EEA member, and the United Kingdom by a European Commission adequacy decision. Loading map tiles therefore does not send your data to a country without an adequate level of protection.

Vatlytics uses no analytics or advertising provider, tracking pixel, third-party script or content-delivery network.

Retention

Raw per-aircraft position rows have a 7-day retention period, after which they are deleted. When a flight session closes, its track is compressed and stored on the flight row for long-term retention. Daily and hourly statistical aggregates are retained indefinitely.

Sign-in sessions expire after 30 days, and a scheduled job purges expired session rows. Account profiles and API-key records have no automatic expiry in the current application; revoking an API key makes it unusable but leaves its record.

Request logs are a small rolling buffer that is continuously overwritten as new requests arrive. They are not archived, and no separate web-server access log is kept.

Your rights

Subject to the conditions in applicable law, you may request access to and rectification or erasure of your personal data, restriction of processing and data portability, and you may object to processing based on legitimate interests. Where processing relies on consent, you may withdraw it for the future. To exercise a right, contact vatlytics@mattis-kraemer.de and provide enough information to identify the relevant data and to show that the request concerns your own VATSIM CID. Requests are answered within one month. A signed-in member can also download a machine-readable access copy or start permanent erasure directly from the account page.

Erasure and future collection

When an erasure request is accepted, Vatlytics removes the member's flights and stored tracks, raw flight positions, ATC sessions and bookings, member daily activity totals, and any Vatlytics account with its sessions and API keys. Airport-level daily and hourly movement counts are retained because they contain only anonymous totals by airport and time period, without a CID, flight identifier or callsign.

After erasure, Vatlytics keeps only the VATSIM CID on a suppression list, together with the time it was added and a short source label. This minimum record is used solely to prevent the public feeds from collecting that member's activity again. It contains no name, email address, reason for the request, or copy of the erased data, and is retained indefinitely unless the member asks for suppression to be lifted.

You may lodge a complaint with a data protection supervisory authority. The controller is established in Bayern, so the competent authority is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany.