Privacy Policy
Last updated: 13 July 2026
Flown and Found finds photographs of the specific aircraft you flew, matched from your logbook. Your logbook is your career history, so this policy is written to be read, not skimmed. It says exactly what we do with your data and nothing we don’t.
Who we are
Flown and Found is run by Christopher Trott, a sole trader based in the United Kingdom. For anything in this policy, contact privacy@flownandfound.com. Under UK data protection law, Christopher Trott is the “data controller” for your data.
What we collect
Your account: your email address and a password (stored securely hashed, never in plain text). If you sign in with Google, we receive your email address and basic profile details (such as your name) from Google instead of a password.
Your logbook data:when you upload a logbook export, we keep the flight records extracted from it: date, aircraft registration, departure and arrival airports, and where your export provides them, departure and arrival times, aircraft type, flight number, and total time. Rows we can’t confidently read are kept in a review list, containing only those same fields, so you can fix them by hand.
Technical basics: like almost every website, our hosting providers automatically log things like IP addresses when you visit, for security and to keep the service running.
What we deliberately don’t collect
We designed the database to exclude sensitive fields even when your logbook export contains them:
- Crew and captain names.Other people’s names in your logbook are their data, not ours to hold. They are dropped during import and never stored.
- Remarks. Free-text remarks columns are dropped during import.
Your uploaded file itself is never stored. It is read in memory, the flight records are extracted, and the file is discarded when the upload finishes. We keep the flights, not the file.
Why we collect it, and the legal basis
We use your data for one thing: providing the service you signed up for. Your account lets you sign in, your flight records are what we match photos against. The legal basis is “performance of a contract” (we can’t provide the service without them). We use technical logs to keep the service secure, on the basis of our “legitimate interests.”
We do not sell your data, share it with advertisers, or use it for anything beyond running Flown and Found.
Cookies
We use only essential cookies: the ones that keep you signed in. No analytics cookies, no advertising cookies, no trackers. That’s why there’s no cookie banner.
Where your data lives
Your data is stored in a database run by Supabase, and the website is hosted by Vercel. Both are established hosting providers acting as our “data processors”: they store and serve the data but only on our instructions.
The database is hosted in Ireland(Supabase’s eu-west-1 region) and the website is served from London(Vercel’s lhr1 region). Your logbook data does not leave the UK and EU, where data protection standards are equivalent to UK law.
Two other parties receive limited data:
- Google(based in the United States), only if you choose to sign in with Google, in which case Google knows you use this service. This is the one transfer outside the UK/EU, it happens only for Google sign-in users, and it is covered by Google’s standard data protection safeguards recognised under UK law.
- Planespotters.net (based in Germany), our photo source. Our systems send them aircraft registrations to look up photos. Registrations are public aircraft identifiers, not personal information, and we never send them your name, email, or logbook. When your browser displays a photo thumbnail, it loads it directly from Planespotters, so Planespotters sees your IP address the same way any website you visit does.
Who can see your data
Only you. Every flight record is tied to your account, and the restriction is enforced at the database level (row-level security), not just in the website code. Other users cannot see your flights, and there is no public profile.
As the person running the service, Christopher Trott can technically access the database for maintenance and support, and does not browse user logbooks.
How long we keep it
For as long as you have an account. There is no time limit after which we delete active accounts, because your logbook is the product.
Deleting your data
You can delete all your data, or your whole account, yourself from the Account page. Deletion is real: your flight records are removed from the live database immediately, not hidden or archived.
Our database currently has no automated backups, so when you delete, the data is gone: there are no residual copies anywhere. If we add backups in the future (a normal step as the service matures), we will update this policy to say how long deleted data can persist in them.
Your rights
Under UK GDPR you have the right to access a copy of your data, correct it, delete it, take it elsewhere (portability), and to object to or restrict processing. The delete button covers erasure; for anything else, email privacy@flownandfound.com and we will respond within one month.
If you’re unhappy with how we handle your data, you can complain to the UK Information Commissioner’s Office (ico.org.uk).
Age
Flown and Found is for pilots and aviation enthusiasts and is not intended for anyone under 18.
Changes
This is a beta product and this policy will evolve with it. If we make meaningful changes, we’ll update the date at the top and flag it on the site. We will never quietly change what we do with your data.