Privacy

Stored in your browser

These entries live in your browser's local storage on this device. The site reads them to remember your choices. Without an account they are never sent to us; if you sign in, your progress and settings are also copied to your account (see below). One entry, unposted leaderboard results, is kept in the browser's IndexedDB database instead.

“Clear progress” on the home page removes your lesson progress. To remove everything, clear this site's data in your browser settings. A private window removes all of it when you close it.

If you create an account

We store your email address, a hash of your password if you set one (never the password itself), an optional display name, the avatar you pick from our set of drawings (we never take photos), your language, whether you want news emails, when you confirmed your age and accepted this notice (and which version), when you joined and last signed in, your lesson progress, a record of each lesson you finish while signed in (lesson, result, stars, time and a few flight numbers such as maximum G), your synced settings, and your active sign-ins (a hash of each sign-in token with its dates). To slow down password and code guessing we also keep short-lived counters of attempts, keyed by a scrambled form of your email address or account; they are deleted within a day.

If you sign in with Google or Apple, we store the account ID they give us and your email address. We do not ask for your name or photo.

We use this only to run your account: signing you in, syncing your progress and settings, and showing your lesson history. We do not sell or share it, and never use it for advertising.

Every lesson and free flight is recorded in your browser's memory as you fly, so you can share it: your control inputs, the starting conditions, the airport, the simulator version and the time the recording started; nothing else (no location, device details or voice). The recording is dropped when you leave the page. Nothing is uploaded unless you are signed in with a confirmed email address and choose “Share replay”. Then we store the recording in Cloudflare R2 storage, in a location Cloudflare chooses, and a short record in our database: which lesson or free flight it is, the aircraft, the simulator version, its length, stars and pass or fail, its size and when you shared it. Anyone with the link can watch it; links are random and are not listed or searchable. We keep a shared replay until you delete it on your account page or delete your account, which deletes the recordings too. After a deletion the link stops working within an hour; people who already opened the replay may still have a copy saved by their browser. Exception: if you pass a lesson that has a leaderboard while it cannot be posted yet, that flight's recording is kept on this device (see the table above) and uploaded automatically once you are signed in with a confirmed email address, if you have turned leaderboards on.

AI coach: if you are signed in with a confirmed email address and press “Ask the AI coach” on a lesson's result screen, we send a summary of that attempt to Cloudflare Workers AI, which runs the language model on Cloudflare's own servers. The summary contains the lesson, pass or fail, stars, why the lesson ended, and numbers such as your speeds, bank angle and G in each step, plus your language. It contains no name, email address, account ID or recording of your flight. The answer is shown to you and we do not store it or the summary; Cloudflare says it does not use this content to train AI models. To keep the service free we count how many times each account asks per day (UTC). These counts are deleted after two days, or straight away if you delete your account. The tips shown without the AI are worked out in your browser and sent nowhere.

Leaderboards are off unless you turn them on, with “Show my results on leaderboards” on a lesson's result screen or on your account page; if you had already joined a leaderboard before October 2026, you stay on. Once they are on and your email address is confirmed, when you pass a lesson that has a leaderboard while signed in, the result is posted automatically, together with its replay, if it beats your earlier one; results passed on this device while you were signed out are posted after you sign in. The first time, we give you a generated public name such as Pilot-7K2QX. It is made from random characters, never from your email address or display name, and you can change it on your account page. We store your public name, when you turned leaderboards on and, for each posted result, the replay it came from, its stars, the number the lesson ranks by (for example touchdown sink rate), its time and when it was posted. Everyone can see your public name, your avatar, those results and a link to the replay; we never show your email address or display name there. On your account page you can remove any result, or turn leaderboards off: that removes your public name and all your results straight away, and nothing new is posted until you turn them back on. Deleting a result's replay or deleting your account also takes it off the leaderboard. A browser that already loaded the leaderboard may keep showing its copy for up to a minute. Your public name, results and when you turned leaderboards on are included in your data download. Unlike your other shared replays, a replay on a leaderboard is listed publicly. Removing a result or turning leaderboards off does not delete the replay: it stays shared, and anyone with its link can still watch it, until you delete it on your account page.

We post your results to leaderboards only with your consent (Article 6(1)(a) GDPR), which you give by turning leaderboards on. You can withdraw it at any time by turning them off on your account page: this takes effect immediately and removes your public name and results. What is public is a generated or chosen pseudonym, not your name or email address.

We send emails to confirm your address, to reset your password and to deliver one-time sign-in codes, through Cloudflare's email service. A sign-in code is stored only as a hash, keyed by a scrambled form of your email address, together with your language; it stops working after 10 minutes or 5 wrong tries, is deleted once used or replaced, and expired codes are cleared out automatically. If the address has no account yet, the account is created only when the right code is entered. If an account exists for the address but its email was never confirmed, signing in with a code deletes that account and everything stored with it, and you start a new one. News about lessons and features only goes to people who tick that box, and you can turn it off on your account page.

When you sign in, our server sets a cookie, af_session, on api.aerofox.app. It only keeps you signed in, cannot be read by page scripts, and expires after 30 days without use or when you sign out. While a Google or Apple sign-in is in progress, a second cookie, af_oauth, links the round trip to your browser for up to 10 minutes. Pages on this site ask our server whether you are signed in; without the cookie, that request carries nothing about you.

Account data is stored in a Cloudflare database located in North America. We keep it until you delete your account. Deleting it removes everything at once; it also drops out of Cloudflare's automatic database backups within 30 days.

The iOS and macOS apps

The apps work without an account and keep your lesson progress on the device. If you sign in, the app talks only to our server (api.aerofox.app) and the same account rules as on this site apply. Instead of a cookie it keeps a sign-in token in the system keychain on that device only (not synced through iCloud); our server stores only a hash of it, marked as an app sign-in. It works until you sign out in the app, 30 days pass without use, or your password changes or your account is deleted. Signing out deletes it on the device and on our server, and removes the account's progress from the device. A passing result on a lesson with a leaderboard that cannot be posted yet is kept with its replay in the app's own storage on the device, and posted automatically once you are signed in with a confirmed email address, if you have turned leaderboards on; it is deleted after posting or when you sign out. The apps contain no third-party code for analytics, advertising or crash reports.

Feedback

If you write to us through the feedback form, we store your message, the topic you pick, the email address if you give one (used only to reply to you), any files you attach, the language of the page and the address of the page on this site you came from (without anything after a “?”). If you are signed in, the message is also linked to your account. Messages are kept in our Cloudflare database in North America and attachments in Cloudflare R2 storage; only the site's administrators can open them. The administrators may get a short email notice of a new message, sent through Cloudflare's email service (at most 20 a day); it gives the topic, language, page, number of attachments, the reference and a link to our back office, but not your message or your email address. We do not store your IP address with the message; to limit abuse, Cloudflare briefly counts the requests from each address in memory. To limit abuse, when the form's anti-spam checks stop a submission (a hidden field that only software fills in, a missing, reused or expired automatic check, or a send that is too fast), we keep a short record of the attempt: the time, which check stopped it, the page language, the address of the page on this site it came from (without anything after a “?”) and, for the hidden field, the first 60 characters of what was put in it. It holds no IP address, browser details, message text or email address, is not linked to any account, and is deleted after the number of days the administrators set (30 by default, at most 90); daily totals without any details are kept for 90 days. The form's human check is one of two, depending on how the site is set up: a small calculation your browser does by itself (no cookies, nothing stored, no third-party service), or Cloudflare Turnstile, which is loaded from challenges.cloudflare.com only after you start filling in the form. Turnstile is run by Cloudflare, our host; it looks at signals such as your IP address, TLS fingerprint and browser type to tell people from software, and Cloudflare says it cannot directly identify you from them. We do not turn on Turnstile's pre-clearance option (the one that adds a cookie), and our server does not send your IP address to Cloudflare when it checks the result. Cloudflare's Turnstile Privacy Addendum describes what it does. We keep a message and its attachments for 12 months after we close it, unless we delete it sooner, and we delete it whenever you ask: send another message saying roughly when you wrote, or the reference shown after sending. We never share them or use them for advertising, and we add no cookies and store nothing in your browser. If you delete your account, the message is no longer linked to it but stays until it is deleted at your request or at the end of the 12 months; messages are not part of your account's data download. Our administrators can also add a private note and a status to a message so they can follow it up.

Visit statistics

To see how many people visit and how fast pages load, we use Cloudflare Web Analytics. For each page view it records the page address, the site that sent you here, your country, your browser, operating system and device type, and page-load timings. Cloudflare says it uses no cookies or local storage for this and does not fingerprint visitors. We only see totals, never individual visitors.

To see which lessons are used, the simulator also tells our own server when a lesson or a free flight starts and when it ends: which lesson, whether it was passed, how long it lasted, whether it ran on the website or in an app, and the interface language. This count carries no cookie, account or device identifier and we do not store your IP address with it, so it cannot be linked to you or to your other visits. It is kept for three months.

To see where visitors come from, the site also tells our own server whenever a page is opened in your browser. The server notes which continent, country, region and city Cloudflare works out from your connection, plus the language of the page, and adds them to a count. The browser sends nothing else: no cookie, account or device identifier and no page address, and we do not store your IP address, so a count cannot be linked to you or to your other visits. Nothing is sent if your browser asks not to be tracked (Do Not Track or Global Privacy Control). It is kept for three months.

Hosting and server logs

AeroFox runs on Cloudflare. Like any website, our servers receive your IP address and basic request details when you load a page. Cloudflare keeps these request logs for a few days; we look at them only to fix errors. Cloudflare may also ask your browser to report failed connections to it (network error logging).

Videos

Some explainer pages may include a video from YouTube (Google). Nothing is loaded from YouTube when a page opens: you see a card of our own with a Play button. Only when you press Play does your browser connect to YouTube's privacy-enhanced domain (youtube-nocookie.com), and YouTube then handles your visit under its own privacy policy: it can receive your IP address and set or read cookies or similar identifiers on your device. If you would rather not, do not press Play: nothing on the site depends on the videos. Apart from these videos, the visit statistics above and the human check on the feedback form (described under Feedback), our pages load nothing from other sites.

Sharing

The share buttons pass an image, a short text and a link to your device's share menu; nothing is sent to us. The QR code on share images is a short link from QR Maker (qrmaker.ai), a service run by AeroFox's maker. When someone scans it, their phone first opens qrmk.cc, which counts the scan (country and region, device type, operating system, browser, language and time) and then forwards them to the AeroFox page. QR Maker's own privacy policy covers that step. Our pages and apps never contact QR Maker: the QR images are stored on our own site. If you'd rather skip that step, open the link in the text instead of scanning the code.

What we do not do

• We sell nothing and take no payments on this site.
• No advertising networks, cross-site tracking or social media pixels.
• No cookies of our own, except the sign-in cookies if you sign in.
• Fonts, 3D scenes and terrain come from our own site, and cockpit sounds are generated in your browser.

Your rights

Without an account, we hold nothing that identifies you (unless you choose to give us your email address or other details in a feedback message): the request logs and visit statistics above are not linked to you. With an account, your account page lets you download all your data, change your display name and email choices, or delete the account at any time. Laws such as the GDPR and Canada's PIPEDA give many people these rights; we honour them for everyone.

Children

The lessons need no account. Accounts are for people who are 16 or older, or younger people whose parent or guardian agrees.

Changes

If we change what we collect, we will update this page before the change goes live and change the date at the top.