EFAS← efas.app

Privacy Policy

Effective 18 September 2026 · EFAS (Enhanced Flight Augmentation System), published by ADDIE OÜ.

EFAS is a reference and situational-awareness app for pilots across all sectors of aviation — from balloons, gliders and general aviation to commercial air transport. It is built to minimise personal data and collects no directly identifying information. This policy explains exactly what the app does and does not process.

1. Data minimisation, no tracking

• EFAS does not ask for your name, phone number, or postal address.
• EFAS does not include any advertising, analytics, or crash-reporting SDKs, and does not track you across apps or websites.
• Your device is identified only by an opaque device identifier generated on-device and stored in your device's secure keystore. It is a random value that is not linked to your app-store account or to you personally.

2. Optional EFAS Account (email)

Some features (roster/OFP email delivery, your flight archive, and a second device) work through an optional EFAS Account, which you connect by verifying an email address (for airline pilots, typically your company email) with a 6-digit code.

Legal bases. We process data to perform our agreement with you (Art. 6(1)(b) GDPR) and, for optional account binding, on your consent (Art. 6(1)(a)), which you may withdraw at any time via Settings → EFAS Account without affecting processing already carried out.

• Your email address is processed transiently to send the verification code and to deliver the roster/OFP mail you request, then deleted; on our server we retain only a one-way SHA-256 hash of it, never the plaintext address.
• Connecting an account is optional. The free features (airport search, weather, NOTAMs) work without any account.

3. What the app sends to our server

• Feedback and airport/runway notes you submit: the type, your text, a timestamp, an anti-replay value, and an opaque device hash — nothing that identifies you. Notes you choose to share are visible to other EFAS users and may be hidden or removed by moderation.
• Completed-flight records (only when you finish a flight): the route, block times, and the day's weather/NOTAM snapshot your app recorded — i.e. only what your own app captured for that flight. Route, roster and duty plans you build stay on your device and are not uploaded.
• Push token: if you enable notifications, an opaque push-notification token issued by your platform's push service is stored so the server can notify your device (e.g. when a roster/OFP you mailed in is ready). It is not linked to your identity.
• Subscription records: EFAS Pro requires a connected EFAS Account. We verify the App Store's signed purchase information and record the product, transaction identifiers, subscription dates, subscription status, and signed purchase and renewal/refund notifications. Apple notifications may arrive before EFAS can identify the owning account. Once purchase ownership is verified, the records are associated with that account's email hash to maintain its purchase history and share the verified membership with a second bound device. Purchases awaiting confirmation are also saved on your device for retry. Apple processes the payment; we do not receive your card details or App Store password.

All traffic is over HTTPS and cryptographically signed per device. Our server never exposes one user's data to another.

Processors. We use an email-delivery provider and a hosting provider as processors under Article 28 GDPR agreements, acting only on our instructions. Where a processor is established outside the EEA, transfers are safeguarded by appropriate measures such as EU Standard Contractual Clauses. We do not sell your data or share it for advertising.

4. Location

EFAS does not request access to your device's location and does not use GPS. Airports and routes are found by their identifiers and coordinates you enter or import — never from your position.

5. Payments

EFAS Pro is an auto-renewable subscription purchased through the in-app purchase system of the app store or platform you use. That platform processes the payment; we never see your card or store-account credentials. See our Terms of Use.

6. Third-party data sources

EFAS retrieves aviation reference data from public sources — weather (aviationweather.gov), NOTAMs (FAA NOTAM API), aerodrome data (OurAirports), and community surface-traffic (adsb.lol). These requests carry no personal data about you.

7. Beta testers

If you sign up as a beta tester on efas.app, the email address you submit is stored solely to send you a beta-testing invitation. It is visible only to the developer, is never shared or used for marketing, and can be deleted on request.

8. Data retention & your right to erasure

We keep only what is described above, and only for as long as it is needed for the purpose it was collected: account-scoped data (bindings, inbox items, flight records, membership and subscription history) for as long as your account exists; a push token until it is unregistered or rejected by the platform's push service; feedback and shared notes until you delete them or your device or account data is erased; and undeliverable mail records for at most 30 days. You can erase your data at any time from Settings → EFAS Account → Delete my data: a per-device purge removes that device's server data, and account-scope deletion removes everything under your email hash.

As the data subject you have the rights of access, rectification, erasure, restriction of processing, objection to processing, and data portability. Exercise them in the app as above or by writing to support@efas.app. You may also lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon).

9. Children

EFAS is a professional aviation tool for pilots and is not directed to, or marketed to, children.

10. Changes

We may update this policy; the effective date above will change and the current version is always available at this address.

11. Contact

Questions about privacy or your data: support@efas.app.