Last updated: 2026-04-20
This document explains what data the app collects, why, and what I do (and don't do) with it. FlyFun Weather is a personal project — I'm a single developer, not a company. The entire codebase is open source so you can audit exactly what happens with your data.
When you sign in with Google, the server receives your email address and display name from Google's OAuth flow. These are stored in the database to identify your account.
When you sign in with Apple, Apple's Private Relay system is used. The server receives a private relay email address — I never see your real email unless you choose to share it. Your display name may also be provided depending on your Apple ID settings.
If you submit feedback on a briefing, the comment and associated flight reference are stored.
Briefings are shareable by direct link to any authenticated user of the app. If you share a briefing URL with another pilot, they can view it. This is intentional — the app is designed for a small trusted community of pilots. If you don't want a briefing to be viewable by others, you can mark flights as private.
If you enable auto-refresh on a flight, the app will:
Your email is used solely for delivering these briefing notifications and account-related messages (welcome email, etc.).
I will never use your email for marketing, newsletters, promotions, or share it with any third party.
If you use the Autorouter integration (for GRAMET cross-section data), the app uses OAuth2 authorization to connect to your Autorouter account. You are redirected to autorouter.aero to authorize access — your Autorouter password is never shared with or stored by this app.
After authorization, an access token (valid for approximately one year) is stored encrypted at rest using Fernet symmetric encryption (AES-128-CBC). This token allows the app to fetch GRAMET data on your behalf. No username or password is stored.
You can disconnect your Autorouter account at any time from your settings, which removes the stored token.
Every briefing refresh logs:
This usage data serves two purposes:
There are no third-party analytics, no tracking pixels, no cookies beyond the authentication session cookie. I don't use Google Analytics or any similar service.
The app interacts with these external services during normal operation:
| Service | Data Sent | Purpose |
|---|---|---|
| Open-Meteo | Coordinates, altitudes | Weather forecast data |
| Autorouter | OAuth token + route | GRAMET cross-section images |
| OpenAI / Anthropic | Weather data context (no personal info) | LLM-generated briefing digest |
| SMTP / Resend | Your email + briefing summary | Email delivery |
| Google / Apple OAuth | OAuth tokens | Authentication |
No personal information (name, email, routes) is sent to LLM providers — only anonymized weather data context.
You can delete your account and all associated data (flights, briefings, preferences, credentials) at any time:
This will permanently remove everything linked to your account and cannot be undone.
The complete source code is open source. You can verify every claim in this document by reading the code yourself. If you identify any issues, please raise a GitHub issue.
If you have questions about your data or want to report a concern, reach out via the GitHub issue tracker.