Privacy

Last updated 11 September 2026

flytag holds licences, type ratings, medical certificates and other documents that identify you and say what you are qualified to do. This page says plainly what is kept, who else ever sees it, and how to get rid of it.

Who is responsible

flytag is not yet operated through a registered company. We would rather say so than print a company name that does not exist. Until one is in place, questions about your data are answered at support@flytag.app, and this page will be updated with the entity's name and address as soon as there is one.

What is stored

Your account: email address, password (hashed, never in readable form), name, and the professional details you choose to fill in — country, job title, licence categories, aircraft types, years of experience, a summary, a contact email and phone number, and an avatar.

Your credentials: for each one, its category and type, title, issuer, the name printed on it, issue and expiry dates, aircraft type, licence category, certificate and licence numbers, training provider, course name, and any notes you add.

Your documents: the files you upload, every earlier version kept when you replace one, and the individual pages a multi-page upload was split into. They are stored on S3-compatible object storage.

Your use of the app: sign-in sessions and the device and network they came from, push subscriptions if you turn reminders on, the reminder schedule you pick, a record of each read spent on having a document read, and — where you have created share links — a log of when each was opened. That log keeps a one-way hash of the visitor's IP address, not the address itself.

Who else sees it

Nobody buys this data and nobody is sold it. It reaches other companies only where they run part of the service:

• Vercel, which hosts the application and collects page views and loading speed. Addresses are stripped before they are sent: a share link's address, which is a secret, never leaves as anything but /share/[token].
• Supabase, which runs the database.
• The object storage provider holding your documents.
• Anthropic, which reads a document when you ask for it to be read. It is sent the document and nothing else about you. Your documents are not used to train anyone’s models.
• A push service — Apple’s, Google’s or Mozilla’s, depending on your browser — if you switch on reminders. It receives the reminder text, which names a credential and its expiry date and never anything from inside a document.

Sharing is something you do

A document leaves flytag when you create a share link, and only then. A link is a long random secret, expires on the date you set, and can be revoked at any time from your Shares screen. We store only a hash of it, so nobody here can reconstruct a link you created.

Your copy on your device

A readable copy of your wallet is kept on each device you sign in on, so it opens with no signal. It is on that device only. Remove it from Profile, or by signing out.

Uploads you never finished

An upload that is never confirmed into a credential and never discarded is cleared away after 30 days, along with the file behind it. Discarding one removes its file straight away. Nothing you have actually filed is touched by this.

Deleting everything

Profile → Delete account erases your account, your credentials, every version of every document, your packs, your share links and your reminders. It is immediate, there is no archive, and it cannot be reversed. Anyone holding a link you shared stops being able to open it.

Counts of anonymous events — that a credential was saved, that a document was uploaded — survive with no link to you. They carry no name, no email address and nothing from any document.

Getting in touch

Write to support@flytag.app for a copy of your data, a correction, or anything else about it.