Privacy Policy

1. Introduction

This Privacy Policy describes how XCviewer ("we", "us", "our") collects, uses, and shares information about you when you use our web application.

2. Information We Collect

• Account Information: When you register using a third-party service like Google, we receive your name and email address.
• Flight Data: We collect the flight data you upload, such as IGC or KML files, including GPS coordinates, altitude, and timestamp data.
• Optional Usage Information: With your consent, we collect information about your device, browser, pages, feature interactions, and masked session activity to identify technical and usability problems.
• Subscription Information: For subscribers, we collect subscription status, billing period, and payment history.

3. Payment Information

When you subscribe to our paid plans, payment processing is handled by Stripe, our third-party payment processor. We do not store your complete payment card information on our servers. Stripe collects and processes your payment information according to their own privacy policy. We only receive confirmation of successful payments and basic billing information necessary to provide our service.

4. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve our services.
• Personalize your experience.
• Communicate with you about your account or service changes.
• Monitor consented usage trends, conversion journeys, and technical failures.

Legal Basis: We process optional product analytics and session replay based on your consent. We process service data and operational errors based on contractual necessity and our legitimate interest in operating a secure, reliable service.

5. How We Share Your Information

We do not share your personal information with third parties, except in the following cases:

• With your consent.
• For legal reasons, such as complying with applicable laws or regulations.
• With service providers who process data on our behalf, including Supabase for database/authentication, Stripe for payments, PostHog EU Cloud for consented product analytics and masked session replay, and Sentry for application error monitoring.

6. Data Security and Retention

We take reasonable measures to protect your information using industry-standard security practices (HTTPS, secure database connections). Account and flight data is retained while your account is active or as needed to provide the service. Analytics and diagnostic data is retained only for the period configured with our processors and is periodically deleted.

7. Your Rights

You have the right to access, correct, or delete your personal data. You can manage your flight data through your account dashboard and withdraw optional analytics consent at any time in Settings → Privacy & Analytics.

EU Users (GDPR): You also have the right to data portability, restriction of processing, and to object to processing.

8. Cookies

Essential browser storage maintains your session and preferences. PostHog analytics and masked session replay are disabled until you opt in. Your choice is stored on your device and can be changed at any time. Session replay masks page text, input values, and element attributes; we do not intentionally send flight files, GPS coordinates, flight names, email addresses, form contents, or payment details to analytics.

9. Contact Information

For privacy-related questions or to exercise your data rights, please contact us at [email protected].