Privacy Policy

FlyKo is a service for small flight schools and flying clubs that keeps track of aircraft hours, maintenance intervals and student training records. This Privacy Policy explains what personal data we collect, why we collect it, and what rights you have over it.

The data controller is FlyKo. You can reach us about privacy matters at flyko2026@gmail.com.

When a flight school uses FlyKo to manage its own students and staff, the school is the controller for that data and FlyKo acts as a processor on its behalf. In that case the school's own privacy notice also applies, and requests about that data are handled together with the school.

Account data

When you create an account we store your first name, last name, email address, the school you belong to and your role in it (administrator, instructor, student pilot, pilot or mechanic). You may later add a phone number, date of birth and a profile photo. Passwords are stored only as a salted hash, never in readable form.

School and operational data

To do its job, FlyKo holds the records your school enters: aircraft and their details, hour meter readings, flight log entries, maintenance intervals and events, squawks, certificates and documents, lessons and student progress notes. Some of this is personal data because it is linked to a named student or instructor.

Usage and technical data

Our servers record standard technical information such as your IP address, browser type, pages viewed, and the date and time of each request. If you consent to analytics cookies we also collect anonymised product usage events.

Support data

If you contact us, we keep your messages and our replies so we can follow up and improve the service.

• To provide the service (create and secure your account, show the right records to the right role, send service reminder emails). Legal basis: performance of a contract.
• To keep the service safe and working (prevent abuse, debug errors, maintain backups). Legal basis: our legitimate interest in a secure, reliable product.
• To communicate with you about outages, security issues, and important changes. Legal basis: legitimate interest and, where required, legal obligation.
• To understand and improve the product through analytics. Legal basis: your consent, which you can withdraw at any time.
• To meet legal and accounting obligations. Legal basis: compliance with a legal obligation.

We do not sell your personal data, and we do not use it for advertising or automated decisions that produce legal effects.

We use a small number of cookies and local browser storage. They fall into two groups:

• Strictly necessary: keeping you signed in, protecting forms against abuse, and remembering your cookie choice. These cannot be switched off.
• Analytics (optional): anonymous measurement of how the app is used, so we can find slow pages and confusing steps. These load only after you opt in.

When you first visit, only the necessary cookies are active. You can change your choice at any time through the "Cookie settings" link in the site footer.

We share personal data only with service providers that help us run FlyKo, and only as far as they need it, under each provider's data protection terms. Our main processors are:

• Supabase (managed Postgres database, authentication and file storage).
• Vercel (application hosting and content delivery).
• Google (Gmail, for the email we exchange with you, such as replies to your messages).

A current list of sub-processors is available on request at flyko2026@gmail.com. We may also disclose data if required by law, to enforce our agreements, or to protect the rights and safety of users, and we will pass on the records if our business is transferred to a new owner.

We aim to store and process data within the European Economic Area. Where a provider processes data outside the EEA, we rely on an adequacy decision or on Standard Contractual Clauses together with additional safeguards. You can ask us for details of the transfer mechanism that applies to a given provider.

• Account data: for as long as your account is active, then deleted or anonymised within 90 days of closure.
• School and operational records: kept while the school's subscription is active and returned or deleted within 90 days of the contract ending, unless the school asks us to keep them longer or the law requires it.
• Technical logs: retained for up to 12 months.
• Invoices and accounting records: retained for the period required by tax law.

Under the GDPR and the Serbian Law on Personal Data Protection you have the right to:

• ask what personal data we hold about you and get a copy of it;
• have inaccurate data corrected;
• have your data deleted where there is no lasting reason to keep it;
• restrict or object to certain processing;
• receive your data in a portable format;
• withdraw consent at any time, without affecting processing already carried out.

To exercise any of these, email flyko2026@gmail.com. We answer within one month. If your data is managed by your flight school, we may pass your request to them. You also have the right to complain to a supervisory authority, in Serbia the Commissioner for Information of Public Importance and Personal Data Protection.

We use encryption in transit and at rest, role-based access, per-school data isolation, and regular backups. Our Security page describes these measures in more detail. If a data breach is likely to put your rights at risk, we will notify you and the relevant authority as required by law.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. To the fullest extent permitted by law, we are not liable for loss, leakage or theft of data that occurs despite the safeguards described above. See the "Limitation of liability" section of our Terms of Service for how our liability is limited.

FlyKo is a tool for flight schools and is not aimed at children under 16. Where a student pilot is a minor, their account is created and overseen by the school, and the school is responsible for obtaining any parental consent that the law requires.

We may update this policy as the service changes. When we make a material change we will update the date at the top and, where appropriate, tell you by email or a notice in the app before the change takes effect.

Privacy questions and requests: flyko2026@gmail.com. If we appoint a Data Protection Officer, their contact details will be listed here.