Last updated: 2026-06-20
This document explains what data the app collects, why, and what I do (and don't do) with it. FlyFun Weather is a personal project — I'm a single developer, not a company. The entire codebase is open source so you can audit exactly what happens with your data.
When you sign in with Google, the server receives your email address and display name during sign-in. These are stored to identify your account.
When you sign in with Apple, Apple's Private Relay system is used. The server receives a private relay email address — I never see your real email unless you choose to share it. Your display name may also be provided depending on your Apple ID settings.
If you submit feedback on a briefing, the comment and associated flight reference are stored.
Briefings are shareable by direct link to any authenticated user of the app. If you share a briefing URL with another pilot, they can view it. This is intentional — the app is designed for a small trusted community of pilots. If you don't want a briefing to be viewable by others, you can mark flights as private.
If you enable auto-refresh on a flight, the app will:
Your email is used solely for delivering these briefing notifications and account-related messages (welcome email, etc.).
I will never use your email for marketing, newsletters, promotions, or share it with any third party.
If you use the Autorouter integration (for GRAMET cross-section data), the app uses a secure authorization process to connect to your Autorouter account. You are redirected to autorouter.aero to authorize access — your Autorouter password is never shared with or stored by this app.
After authorization, an access token (valid for approximately one year) is stored encrypted on the server. This token allows the app to fetch GRAMET data on your behalf. No username or password is stored.
You can disconnect your Autorouter account at any time from your settings, which removes the stored token.
Every briefing refresh logs:
This usage data serves two purposes:
There are no third-party analytics, no tracking pixels, no cookies beyond the authentication session cookie. I don't use Google Analytics or any similar service.
The app tracks the real cost of each briefing (AI usage, infrastructure share, storage) and makes this available publicly, so anyone can see what the app costs to run. You can also see your own usage and cost breakdown in the app.
The app interacts with these external services during normal operation:
| Service | Data Sent | Purpose |
|---|---|---|
| Open-Meteo | Coordinates, altitudes | Weather forecast data |
| Autorouter | Access token + route | GRAMET cross-section images |
| OpenAI / Anthropic | Weather data context (no personal info) | AI-generated briefing summary |
| SMTP / Resend | Your email + briefing summary | Email delivery |
| Google / Apple | Sign-in tokens | Authentication (sign-in) |
No personal information (name, email, routes) is sent to AI providers — only anonymized weather data.
You can download a complete, machine-readable (JSON) copy of the personal data held about your account — account details, preferences, flights, briefings, feedback, and usage history — at any time:
Encrypted credentials (e.g. your Autorouter token) and server-internal values are intentionally excluded for security.
You can delete your account and all associated data (flights, briefings, preferences, credentials) at any time:
This will permanently remove everything linked to your account and cannot be undone.
The complete source code is open source, so you can verify every claim on this page by reading the code yourself — or ask your favorite AI coding agent to review it for you. A more detailed technical breakdown of exactly where each of these practices lives in the code is in the project's PRIVACY.md. If you spot any issue, please raise a GitHub issue and I will address it.
If you have questions about your data or want to report a concern, reach out via the GitHub issue tracker.
If you believe your data may have been exposed, please report it privately using the “Report a vulnerability” button on the project's GitHub Security page (see SECURITY.md). If a breach affects your personal data and is likely to put you at high risk, you will be notified, and the relevant data-protection authority — in the UK, the ICO — will be informed as required by law.