Privacy Policy

This policy explains how the FL340 site operator (the data controller) processes personal data when you use FL340 (www.fl340.com). It serves as our information notice (aydınlatma metni) under the Turkish Personal Data Protection Law No. 6698 (“KVKK”) and our privacy notice under the EU General Data Protection Regulation (“GDPR”).

1. Data we process

• Account data: email address, nickname and password. Passwords are stored only as a secure hash by our authentication provider; we never see them.
• Sign in with Apple or Google, if you use it: we receive a user ID and your email address from Apple or Google (Apple may give a private relay address instead of your real one). We never receive your Apple or Google password.
• Profile, if you fill it in: bio, aircraft, home base and what you do (pilot, cabin crew, student pilot or aviation fan). These are public on your profile; what you do only changes which suggestions FL340 shows you first. An airport page also shows how many members have it as their base (“12 members based here”), only a number and only when at least 3 members are based there, never who.
• Phone notifications, if you turn them on: a notification token for your phone (from Apple on an iPhone or iPad, from Google Firebase Cloud Messaging on Android), so FL340 can tell you about new entries in your forum topics, replies to your pilot notes, members who mention you (@nickname), new posts of members whose bell you turned on (on their profile), new entries in forum topics whose bell you turned on, new followers and (on Mondays) a one-line summary of your week (your flights and how many people your notes helped, worked out on our server from your own data), and which of these you want. Notifications are sent directly through Apple (iPhone, iPad) or Google Firebase Cloud Messaging (Android), which only deliver them; the token is removed when you sign out of the app (as soon as the phone is back online, if you signed out without a connection), when you delete your account, or when Apple or Google tell us it no longer works. If you turn on "Quiet during annual leave", we keep that choice and send no phone notifications on the days your calendar has annual leave (they still wait in your notifications list).
• Feedback, if you send it: your message, its kind, the page you sent it from and the app or site version. Only you and the moderators can read it.
• Content and activity: forum topics and entries, pilot notes and replies to them, crew spots (places near an airport you add: name, kind, area and a short tip), noise abatement rules you add or suggest for an airport with their source (public once added or approved; moderators keep a history of each change with who made and approved it, and your name is removed from it when you delete your account; who confirmed “still correct” only you can see), votes, reputation, favorite airports, your lists (of airports and notes) and bookmarks (lists and bookmarks are private: only you can see them), and, only if you turn it on in your profile, the airports you have flown to (codes and how many times, shown on your public profile; never your flights, dates or times), and your notifications, who replied to your notes, found them helpful, wrote in your topics, mentioned you, followed you, posted while you had their bell on or wrote in a topic you follow, and a copy of each phone notification FL340 sends (weather and threats for your flight, with its airports and date, and your weekly summary), which only you can see and which are deleted after 90 days. The members whose bell you turned on (to hear about their new posts) and the forum topics whose bell you turned on (to hear about their new entries, with when a topic last notified your phone and the newest entry there when you last opened it, for “new since your last visit”) are private too: only you can see them, and they are deleted with your account. Your nickname, everything you post in the forum, and your public pilot notes, replies and crew spots are public (who marked a spot helpful is not). When you tap “Open in Maps” on a crew spot, the spot’s name and town go to Apple Maps or Google Maps, which you choose; FL340 sends nothing else.
• Logbook, if you use it: the flights you log (dates, airports, times, aircraft, your role, remarks and the name of the pilot in command if you enter it) and the hours you carry over from an earlier logbook. Your logbook is private: only you can see or change it. Not other members, not moderators. You can export it at any time. So that it works without internet (in flight), the app keeps a copy of your logbook, expiry dates, checklists, Debrief, favorite airports, notifications and profile on your phone, plus anything you change or write offline (flights, dates, favorites, drafts of notes and forum entries) until it is sent; signing out removes them from the phone.
• Calendar, if you use it: the days you add: flights (airports, departure and arrival times in UTC and, if you enter it, a flight number), OFF days and other days (standby, reserve, simulator, training, leave) with any note you write, and for a duty such as a simulator the start, end and report times, the place and the briefing room you enter, and how long before report you want to be reminded (the reminder itself is a notification your phone shows; nothing is sent to you by a server). Because it says where you will be and when, your calendar is private: only you can see or change it. Not other members, not moderators (they see only how many entries exist in total). It is never public and is not shared with any airline or other service. So that it works without internet, the app keeps a copy on your phone, plus any changes made offline until they are sent; signing out removes them from the phone. If you import a calendar (.ics) file, it is read on your phone or in your browser only: the file is never uploaded or kept, and only the entries you tick are saved, like days you add yourself.
• The flight you brief, if you are signed in: its departure and destination airports and planned times (or, when you have not briefed one, the next flight in your calendar that leaves within 24 hours), so we can tell you when the destination forecast turns IFR before you land, when the forecast around your arrival or departure is past your own limits (My limits), or when volcanic ash, a cyclone or severe turbulence lies on your route before you depart (with which of those we already told you about, so we never tell you twice). One flight per member; it is deleted an hour after arrival, and the notification can be turned off in Settings → Notifications. With "NOTAMs for my flights" on (Settings → Notifications), the same flight is also checked for new important NOTAMs at its airports; we keep which NOTAMs we already told you about (their FAA number and when) for 7 days so none is sent twice. Only you can see your flight; nobody can see that list.
• Your answer to “Flying today?”, if you are signed in: the last day you said “Not today” (or closed Home's Flight day or “Log today's flights” card) and how many times in a row, to not ask again that day (or for a week after three no's) on any of your devices. Private: only you can see it. Signed out, it stays in your browser or on your phone.
• My limits, if you set them: the personal limits you choose to have highlighted (crosswind, tailwind, gust, visibility, RVR, cloud, and the on/off highlights), so the website, your phone and your watch match, and so the flight check above can compare your flight's forecast with them. Private: only you can see them; on our side only that automatic check reads them, for a flight we are watching for you. Signed out, they stay in your browser or on your phone.
• Recency rules, if you change them: the recency rules you follow (for example at least 3 landings in 90 days, or a warning after 30 days without a landing), so the website and your phone match. Recency itself is worked out on your device from your logbook. Private: only you can see them. Signed out, they stay in your browser or on your phone. Recency reminders are optional notifications scheduled on your phone only.
• “Translate posts automatically”, if you are signed in: whether you turned this setting on (it is off until you do), so the website and your phone match. Private: only you can see it. A copy stays in your browser or on your phone.
• Logbook layout, if you are signed in: which paper logbook your logbook pages, PDF and Excel export follow (EASA, the default, or SHGM Türkiye), so the website and your phone match. Private: only you can see it. A copy stays in your browser or on your phone.
• Expiry dates, if you use them: the names and dates of the documents you track (for example “Medical, Class 1”, issued and expiry dates) and an optional note. No document numbers or photos. Countdowns you add there (a name and a day, for example “OPC simulator”) and the reminders you pick (the days before, or your own day and time) are kept the same way. Private: only you can see them. Reminders are scheduled on your phone by the app; signing out removes them.
• Medical expiry dates, only with your consent: the expiry date of a medical certificate may count as health data, so FL340 stores one only after you agree to it separately (once, the first time you save one). We keep the time you agreed. You can withdraw it at any time in Settings; your medical expiry dates are then deleted.
• Your consents: we keep a record of when you accepted the terms and any consent you give or withdraw (which version, when, on the website or in the app), as proof for you and for us. You can see it in Settings. It cannot be changed, and it is deleted with your account.
• Home-screen widgets, if you add them: the app passes the widgets your next expiry dates and countdowns, last landing, the flight you briefed, your parking spot and checklist progress through storage on your phone that only FL340's own widgets can read. Nothing extra is sent anywhere; signing out removes it.
• Checklists, if you make them: the name and lines of each list. Private: only you can see them. Which lines you ticked stays on your device only; the app also keeps a copy of your lists so they open without internet, and signing out removes both.
• Debrief, if you use it: the notes you write for yourself after a flight (the text, its tag and day, and the logbook flight, airport or aircraft type you link it to) and the tags you make (name, icon, colour). Only you can see them: not other members, not moderators (they see only how many entries exist in total), and they are never sent to AI services, analytics or notifications. Please leave out other people's names, flight numbers and passenger details. You can delete an entry at any time, and everything is deleted with your account. The app keeps a copy on your phone so it opens without internet; signing out removes it.
• Quiz and game results, if you play signed in: your answers or moves, scores, times and when you played. Your best score for each quiz and game is shown with your nickname on its public leaderboard. Games played without signing in are not stored.
• Climb out: signed in, each run's score (the altitude it reached, in feet), how long it lasted and when it started and ended, so your highest run can be ranked on the public leaderboard (with your nickname and the date of that run); a run the game's checks refuse is kept with the reason (only counts are ever looked at, to find bugs), and a finished run waits on your device until it has been sent; and what each run counted for the game's coins and daily missions (diamonds, feet climbed, storms and restricted areas passed, close passes). Your coin balance, the looks you bought with coins, and the daily reward and missions you collected are kept with your account (private: only you can see them). Coins are earned only by playing and have no money value; nothing is sold. Without an account, the coins and looks stay on your device. Your best score, today's best and the look you picked stay on your device (in the app, or in your browser on the website); the Home card's × is remembered there too.
• World map game progress, if you play signed in: how many times you answered each country right and wrong, so the game can show what you have learned and ask the rest more often. Private: only you can see it. Without an account it stays on your device (your browser or the app), and joins your account when you sign in.
• Airport page views, as totals only: when you open an airport's page, we add one to that airport's count for the day and to its running total, to show the airports pilots open most ("Popular airports"). Only the airport, the day and the numbers are stored with it: never who opened it, your account or a device id, so a count cannot be linked to you. To count each airport once a day, your device keeps today's list of airports it has counted (in your browser or the app), and replaces it the next day.
• Location, only if you ask for nearby airports: your device position, rounded to about 1 km before it is sent, is used once to find the airports near you. It is not stored or linked to your account. If your browser cannot find your position, the rough area of your internet connection (city level, as our host Vercel derives it from your IP address) is used instead, in the same way.
• Car Finder (where you parked), only in the app and only if you use it: the exact position of your phone when you tap “I parked here”, your note, the zone colour and the photo if you take one. It stays on your phone and is never sent to us or anyone else. “Found it” deletes the photo and keeps the spot in your past spots on the phone (the last 20); you delete any of them, or all, there. Signing out of the app deletes the spot, the past spots and the photos.
• Drink water reminders, only in the app and only if you turn them on: the switch, how often and your own times stay on your phone. The reminders are built and scheduled on the phone from the flight you briefed; nothing is sent to us or anyone else. Tapping Done on a reminder (on the phone or your watch) adds to a count of the day's glasses that also stays on your phone and watch.
• Stretching routines: which routine you last finished and the day, to show "Last done". It stays on your device (in the app, or in your browser on the website) and is never sent to us.
• Layover page: the last airport whose layover page you opened, when, and whether you answered or closed the next morning's "Anything worth sharing?", so it is asked only once. It stays on your device (in the app, or in your browser on the website) and is never sent to us. In the app the page itself is kept on your phone so it opens without internet, and a crew spot you add without a connection waits on your phone with your other offline changes until it can be sent. The stay times shown on the page come only from the page's address.
• Airports saved for offline, only in the app: so they open in flight, the app keeps on your phone up to 50 airports (your favorites, the airports of the flight you briefed and the ones you opened) with their public data: weather, ground map, pilot notes and crew spots. This is public information, it stays on your phone and is never sent to us; Settings → Offline data shows its size and clears it.
• Question of the day on Home: your answer to today's question, and the day you closed the card if you did. It stays on your device (in the app, or in your browser on the website) and is never sent to us; the question itself is worked out on your device from the date.
• Apple Watch or Wear OS watch, only if you have FL340 on it: the app sends your own paired watch your car spot (without the photo), what is coming up (up to five countdowns and expiry dates, title and date; a medical expiry only if you gave the medical consent), the route and times of the flight you briefed for today, when your water reminders are on, today's reminder times and Done count, and today's Question of the day with your answer, directly from phone to watch. A Done or an answer tapped on the watch goes back to your phone the same way. The watch uses its location only while “Your car” is open, to show the distance and direction; nothing of this is sent to us or anyone else. On a Wear OS watch the phone and watch talk through Google Play services on both devices (Google's Wearable Data Layer), which may carry it encrypted through Google's servers when the watch is not connected to the phone by Bluetooth. The airports you add on the watch stay on the watch; it asks our website only for their public weather.
• Technical data: IP address, browser and device information, time stamps and security logs created when you visit the Site or sign in, and signals used by Cloudflare Turnstile to tell humans from bots.

We do not use advertising, tracking or analytics cookies, and we do not sell personal data.

2. Why we process it and on what legal basis

• To provide your account and the Site’s features: necessary for the contract with you (KVKK art. 5/2-c; GDPR art. 6(1)(b)).
• To keep the Site secure (preventing spam, abuse and attacks, enforcing limits) our legitimate interest (KVKK art. 5/2-f; GDPR art. 6(1)(f)).
• To meet legal obligations: for example keeping traffic records and answering requests from competent authorities under Law No. 5651 (KVKK art. 5/2-ç; GDPR art. 6(1)(c)).
• To remind you of medical expiry dates: your explicit consent (KVKK art. 6; GDPR art. 9(2)(a)), which you can withdraw in Settings at any time.
• To keep a record of your consents: our legal obligation to be able to show them (KVKK art. 5/2-ç; GDPR art. 6(1)(c) and 7(1)).
• To send account emails such as confirmation and password reset. We do not send marketing emails.

3. Who we share it with

We use the following service providers (data processors) who process data only on our instructions:

We also read public aviation data from aviationweather.gov (weather), the FAA NOTAM Management Service (NOTAMs) and atis.info (US digital ATIS). Our server asks them by airport only: no personal data, and nothing about who looked, is sent to them.

Some of these providers process data outside Türkiye and the European Economic Area. Such transfers rely on the safeguards available under KVKK art. 9 and GDPR chapter V, such as standard contractual clauses. We also disclose data to courts and authorities where the law requires it.

4. How long we keep it

• Account data and your content: while your account exists. You can delete your account yourself at any time (Settings. The gear on your profile, on the website and in the apps). Your account data, profile, pilot notes, replies to notes, crew spots, noise abatement suggestions and confirmations, votes, favorites, lists, follows, blocks, logbook, calendar, documents, checklists, Debrief and quiz and game results are then deleted. Your forum entries stay, shown as “[deleted]” without your name, so discussions keep making sense; if you want them removed as well, email legal@fl340.com.
• Content removed by moderators for breaking the rules or the law: a copy is kept in a log that only moderators can read, for up to two years, to answer requests from courts and authorities.
• Security and traffic logs: for the periods required by law (Law No. 5651 requires up to two years for some records) or as long as needed for security.
• Backups are overwritten on a rolling basis.

5. Your rights

Under KVKK art. 11 and the GDPR you can ask whether we process your data; get access to it and a copy; have it corrected or deleted; restrict or object to processing; receive it in a portable format; learn who it has been shared with; and object to decisions made solely by automated means. You can also complain to the Turkish Personal Data Protection Authority (KVKK) or, in the EU, to your local data protection authority.

To exercise a right, email legal@fl340.com from the email address on your account. We answer within 30 days, free of charge.

6. Cookies and local storage

We only use storage that is strictly necessary: your browser keeps your sign-in session in local storage, and Cloudflare Turnstile may set a cookie to protect forms against bots. Because nothing is used for tracking or advertising, no consent banner is shown.

7. Security and children

We protect data with encryption in transit (HTTPS), access controls at database level and hashed passwords. No system is perfectly secure, so please use a unique password. The Site is not intended for children under 16 and we do not knowingly collect their data.

8. Changes

We may update this policy. The date at the top shows the current version; material changes will be announced on the Site.