Loading
Loading
Legal
Last updated: 4 October 2026
Flown and Found finds photographs of the specific aircraft you flew, matched from your logbook. Your logbook is your career history, so this policy is written to be read, not skimmed. It says exactly what we do with your data and nothing we don’t.
Flown and Found is run by Christopher Trott, a sole trader based in the United Kingdom. For anything in this policy, contact privacy@flownandfound.com. Under UK data protection law, Christopher Trott is the “data controller” for your data.
Your account: your email address and a password (stored securely hashed, never in plain text). If you sign in with Google, we receive your email address and basic profile details (such as your name) from Google instead of a password.
Your logbook data: when you upload a logbook export, we keep the flight records extracted from it: date, aircraft registration, departure and arrival airports, and where your export provides them, departure and arrival times, aircraft type, flight number, and total time. Rows we can’t confidently read are kept in a review list, containing only those same fields, so you can fix them by hand.
What you agreed to: when you create an account we record which version of these Terms and this Privacy Policy you agreed to, and when. Both documents change over time, so without that there would be no way to say which version you actually saw. You can read your own record on the Account page and it is in your data export. Neither you nor we can edit it afterwards, which is the point of keeping it.
Invitations: every account has its own invite code, a few random letters that say nothing about you. If you create your account through somebody’s invite link, we record that they invited you, so they can be given a free month if you become a member. If people join through your link, we record that too, and tell you how many signed up and joined, never who. When one of them pays for the first time, we record which payment earned you a month and how your renewal date moved. The legal basis is performance of a contract: it is how the invitation scheme you both took part in works. If you delete your account, your code and the record of who invited you go with it; a month you already earned somebody stays on their membership.
Technical basics: like almost every website, our hosting providers automatically log things like IP addresses when you visit, for security and to keep the service running.
We designed the database to exclude sensitive fields even when your logbook export contains them:
Your uploaded file itself is never stored. It is read in memory, the flight records are extracted, and the file is discarded when the upload finishes. We keep the flights, not the file.
We use your data for one thing: providing the service you signed up for. Your account lets you sign in, your flight records are what we match photos against. The legal basis is “performance of a contract” (we can’t provide the service without them). We use technical logs to keep the service secure, on the basis of our “legitimate interests.”
We do not sell your data, share it with advertisers, or use it for anything beyond running Flown and Found.
We use only essential cookies, and no analytics or advertising cookies. Nothing follows you from one website to another. That’s why there’s no cookie banner. There are three, all set by us:
We do count visits, using Vercel Web Analytics. It records that a page was looked at, and roughly which country it was looked at from, so we can see whether the site is working and being used. It does this without cookies and without building any profile of you, and it cannot tell us who you are.
Your account, your flights and your review queue are stored in a database run by Supabase, and the website is hosted by Vercel. Both are established hosting providers acting as our “data processors”: they store and serve the data but only on our instructions.
The database is hosted in Ireland (Supabase’s eu-west-1 region) and the website is served from Ireland as well (Vercel’s dub1 region, Dublin). Your account details and the flight records you have typed or uploaded stay in those two places.
Finding photographs of the aircraft you flew means asking other websites to look them up, and that brings in more parties than just those two. Here is who is involved and what each one sees:
This is also why we can no longer promise, as a blanket rule, that your data never leaves the UK and EU. Your account and flight records themselves stay in Ireland. But Bright Data fetches pages from its own servers around the world, and which country it uses for a given request is mostly Bright Data’s own choice: for one part of our system we currently ask it to prefer a server in Britain, but that is a setting we could switch off at any time without changing any code, not a guarantee, and it does not apply to the rest of our system at all. What travels that way is only an aircraft registration and occasionally a date: never anything that identifies you.
Sentry (Functional Software, Inc., based in the United States) tells us when something breaks. When a page fails, either on our server or in your own browser, a report of the error is sent to Sentry so we can find out and fix it. We have deliberately switched OFF the setting that would attach your IP address, your cookies and your request headers to those reports. What a report does carry is the error itself, the web address the page was at, and which browser it was. On this site an address can contain an aircraft registration and a date, so a report can say that somebody was looking at a particular aeroplane when the page broke, but it does not carry your name, your email or your logbook. This is covered by Sentry’s standard data protection safeguards recognised under UK law.
We added Sentry in September 2026, after a day when the site showed a blank page to a signed-in user and nothing anywhere recorded it. It is switched off entirely unless an address for it is configured, so it never runs on a developer’s machine or in a test.
Brevo (an EU company) delivers our emails: the sign-up confirmation and password resets, and the emails about your logbook and your membership. It receives your email address and the email itself. A new-photos email names the flights the photos match (date, route and aircraft), so Brevo sees those too; nothing else from your logbook goes to it. Replies to any of them come to us. Every email except the ones about your account or your membership can be switched off on your Account page.
Only you. Every flight record is tied to your account, and the restriction is enforced at the database level (row-level security), not just in the website code. Other users cannot see your flights, and there is no public profile.
As the person running the service, Christopher Trott can technically access the database for maintenance and support, and does not browse user logbooks.
While your account is active, we keep your logbook. That is the whole product. A logbook you uploaded three years ago is exactly the thing you came back for, and we are not going to delete it because you had a quiet year.
A free account that has not been signed into for a year is treated as abandoned. Before anything is deleted we email the address on the account and give you at least 30 days. Signing in at any point resets the clock and keeps everything, and so does clicking the link in that email. Only if a year of silence is followed by 30 more days of silence do the account, the flights and the review queue go, in exactly the way the delete button below would have done it.
A paid account has no inactivity limit at all, for as long as it is paid. Searching for photographs of your aircraft carries on in the background whether you are looking at the site or not, so there is nothing about an idle paid account that needs stopping. If the payments stop, the account becomes a free one and the year above starts from that point. There is no paid tier today: this is written down now so that the rule exists before the first payment does, rather than being invented afterwards to suit us.
Nothing is deleted automatically yet, and we would rather say so than imply otherwise. At the time of writing there are single figures of accounts here and not one of them has been inactive for anything like a year, so the rule above has never had anything to act on. When it is running by itself we will update this page to say so.
Technical logs are held by our hosting providers, Supabase and Vercel, under their own retention periods rather than ours, and we do not keep a separate copy of them. Error reports are kept by Sentry under Sentry’s own retention period and then deleted by them.
You can delete all your data, or your whole account, yourself from the Account page. Deletion is real: your account, your flight records and your review queue are removed from the live database immediately, not hidden or archived.
One thing does not get deleted, and we would rather say so plainly than let a promise of “no residual copies” do more work than it should. We keep a ledger recording money actually spent searching for photos of the aircraft in your flights: that is a real accounting record, not something about you personally. When you delete your account, we remove your account’s identity from that ledger’s rows rather than deleting the rows themselves. The amount spent, and what it was spent on, stay on record, but nothing in it says whose account it was any more.
There is one more, and it is small but we would rather name it than round it down. If you tell us a photograph on one of your flights is wrong, we email ourselves to say a report has come in. That email carries a reference number and your email address, so we can write back, and nothing else: what you actually wrote stays in the database and goes when your account goes. But the email itself sits in a mailbox and in our email provider’s delivery log, and deleting your account does not reach either of those. We delete those messages once the report is dealt with.
The same goes for the emails we send you. Brevo keeps a log of what it delivered and to which address, and deleting your account does not reach it. That includes the receipt we send the moment your account is deleted, confirming it has happened, which is the last email you will get from us.
Everything else genuinely goes. Our database currently has no automated backups, so once deletion runs, your account and flight records are gone: apart from the things named above, there are no residual copies of them anywhere. If we add backups in the future (a normal step as the service matures), we will update this policy to say how long deleted data can persist in them.
Under UK GDPR you have the right to access a copy of your data, correct it, delete it, take it elsewhere (portability), and to object to or restrict processing. You do not have to wait on us for access or portability: the Account page has two download buttons that answer both yourself, immediately. What each one gives you is set out in clause 3 of the Terms of Service, rather than repeated here.
The delete button covers erasure. For correction, or to object to or restrict how we process your data, email privacy@flownandfound.com and we will respond within one month.
If you’re unhappy with how we handle your data, you can complain to the UK Information Commissioner’s Office (ico.org.uk).
Flown and Found is for pilots and aviation enthusiasts and is not intended for anyone under 18.
This is a beta product and this policy will evolve with it. If we make meaningful changes, we’ll update the date at the top and flag it on the site. We will never quietly change what we do with your data.