CaptainVoice Privacy Policy

Effective date: [Effective date]

1. Who we are#

CaptainVoice is an iPhone and iPad app for flight training. It records the aircraft intercom and flight data, so pilots and instructors can review a flight or a ground lesson later.

CaptainVoice also has a website, https://captainvoice.com. Some of its features are not available yet. Where this policy describes them, it says what happens when you use them.

[Owner legal name] makes the app and runs the cloud service behind it. In this policy, "we" and "us" mean [Owner legal name]. "You" means a person who uses the app.

[Owner legal name] also runs the website. "You" also means a person who uses the website, for example a Watcher or a person who opens a Share Link (section 3.10).

• Email: [email protected]
• Website: https://captainvoice.com

The app is in beta test now. Apple's TestFlight delivers it to testers.

2. The short version#

• The app records only when you start it. It never starts a recording by itself.
• You can record without an account. Your recordings then stay on your iPhone.
• When you sign in, your recordings upload to our cloud storage in the United States.
• We send a recording to AssemblyAI for a transcript only when we release that recording by hand.
• When you use Live View and turn it on, the people you choose can see your flight and hear its audio on our website while you fly. Live View is off until you turn it on.
• When you use Word Watch and turn it on, the audio of your flight goes to AssemblyAI while you fly, only to find danger words such as "mayday". We keep the words it finds, not a transcript. Word Watch is off until you turn it on.
• We do not sell your data. We do not use it for advertising. We do not track you across other apps or websites.
• You must have the consent of every person you record. See our Terms of Use.

3. What we collect#

3.1 What the app records#

The app records only between the time you start a recording and the time you stop it. A recording of a flight is a "Flight Log". A recording of a ground lesson is a "Ground Log".

• Audio. In a Flight Log, the app records the aircraft intercom through a USB-C audio adapter. The intercom carries air traffic control (ATC) and the voices of everyone on the intercom. If the adapter gives no sound, the app records with the iPhone's own microphone, which picks up sound in the cockpit. In a Ground Log, the app records the room with the iPhone's microphone. Audio holds the voices of everyone who speaks.
• Precise location. In a Flight Log, the app records GPS about once a second: latitude, longitude, GPS altitude, ground speed, direction and accuracy.
• Altitude. The app records air pressure from the iPhone's barometer and works out altitude from it.
• Motion. If you say that the iPhone is mounted in the aircraft, the app records its attitude, g-load and turn rate.
• ADS-B data. If an ADS-B receiver (for example Stratux or Sentry) is on the cockpit Wi-Fi, the app records what it sends: your aircraft's position, altitude and attitude, and other aircraft nearby with their position, altitude and identifier (for example a tail number).
• Pilot Marks. When you tap MARK, the app records the time and where you tapped it.
• Recording details. Start and stop times. Gaps, with the reason (for example a phone call or an unplugged adapter). The name of the audio input (for example "USB Audio" or "iPhone Microphone"). The app does not record phone calls. During a call, iOS pauses the recording and the app notes a gap.

3.2 What you type in#

• The aircraft tail number and type, and whether the iPhone is mounted.
• Crew names and roles (pilot in command, student, instructor or passenger), and which Crew Member was pilot in command (PIC).
• For a Ground Log: in person or online.

Crew names are free text. You can leave them empty.

3.3 Your account#

In the app, you need an account only to upload. You sign in with your email address and a 6-digit code that we email to you.

• Your email address.
• An account ID that our system makes.
• When you made the account and when you signed in.
• If you link your account to the North Aero training harness (see section 5): when you linked and unlinked, and the ID of the account you linked to.

When you use the website's signed-in pages, you sign in there with the same account. See section 3.8.

3.4 Device and security data#

• Device signing key. The app makes a signing key in the iPhone's Secure Enclave. The private part never leaves the iPhone. We receive the public part and the device type (for example "iPhone").
• Apple App Attest data. When you sign in, the app asks Apple to confirm that the signing key belongs to a genuine copy of our app on a genuine Apple device. We store Apple's answer: a key ID, Apple's certificates, a receipt and a counter.
• Technical upload data. For each piece of a recording: its number, its hash (a digital fingerprint), when it arrived, and whether our checks passed.
• Server logs. Our hosting provider may keep standard logs, such as the IP address and time of each request.

3.5 TestFlight#

If you test the app through TestFlight, Apple may share some data with us under Apple's own privacy policy. This can include your name and email address if we invited you by email, install and usage counts, crash reports, and any feedback and screenshots you send.

3.6 What stays on your iPhone only#

The app keeps these on your iPhone and does not upload them: battery readings, the live sound level before you start, your settings, and the last position the app used to work out sunset times for night colors.

3.7 What we do not collect#

The app does not read your contacts, photos or messages. It does not use an advertising identifier. It contains no advertising or analytics code from other companies.

3.8 The website#

• Visits. When you open the website, Cloudflare and Railway (see section 5) receive what every website receives: your IP address, your browser type, the page you ask for and the time. They may keep it in their logs.
• Cookies. The website uses only the cookies it needs to work, for example to keep you signed in. It does not use cookies for advertising, and it does not track you across other websites.
• Signing in. When you use the website's signed-in pages, you sign in with the same account as in the app: your email address and a 6-digit code that we email to you. You also need an account to be a Watcher, to keep a Logbook or to sign as an Instructor. You do not need one to open a Share Link.
• Your flights on the website. When you use the website's signed-in pages, they show the recordings your account uploaded: the map, the audio, the transcript when there is one, Pilot Marks, Flight Alerts and the recording details. You can download copies of the audio, the GPS track and the transcript. What you do with a download is up to you.
• Start notice. When you use a version of the app that works with the website and you are signed in, the app sends the aircraft, its type, the Crew names and roles, who is PIC, the app version and the type of log (Flight Log or Ground Log) when you press Start, not only at Stop. These are details from section 3.2, plus the app version. They let the website show which flight is in the air.
• Proof page. When you use the proof page for a recording, anyone with its proof code can see that the recording is complete and unchanged, its number of pieces, its start and end times, and whether an attested iPhone signed it. The proof page shows no audio and no names.
• Email to us. When you write to [email protected], Cloudflare forwards your email to us. We use it to answer you.

3.9 Beta sign-up#

If you sign up for the beta for flight instructors on the website, we collect what you type in: your name, email address, school or airport, state, about how many students you fly with each month, and your note. We also store the time and your browser's user agent (its name and version). The website may use your IP address for a short time to stop repeated sign-ups. It does not store your IP address with your sign-up.

We use your sign-up to invite you to the beta and to write to you about it. If we invite you through TestFlight by email, we give your name and email address to Apple, which sends the invitation (section 3.5).

3.10 Live View, Watchers and Share Links#

Live View is a page on our website that shows a Flight Log while you record it. It is off until you turn it on in your account. While it is off, nobody sees a live page, you included, and we make no live audio.

When you use Live View and turn it on:

• What it shows. While you record a Flight Log, Live View shows the aircraft and its type, the Crew names and roles, the GPS track so far, altitude, speed and direction, Pilot Marks, ADS-B traffic, Gaps, Flight Alerts (section 3.11), and the audio of the flight, shortly after it is recorded. The audio holds ATC and the voices of everyone on the intercom.
• Who sees it. You, your Watchers, and anyone with a valid Share Link for that flight.
• How we make it. Our worker program (it runs on Railway, see section 5) reads each piece of the recording after it uploads, and makes live audio files and map data from it. We store them in Supabase. After the flight, the live audio becomes the replay audio of that flight.
• Watchers. You can add a Watcher by email address. We store that address and, after the Watcher signs in, their account. A Watcher sees your flights only while they are live, unless you share a replay with them. A Watcher can choose to get alert emails. You can remove a Watcher at any time.
• Share Links. A Share Link opens one flight, live and as a replay, for anyone who has the link. They do not need an account. A Share Link ends on its end date (7 days after the flight, unless you choose 1 day, 30 days or no end) or when you revoke it. Anyone you send a Share Link to can pass it on, so share it with care. We ask search engines not to list Share Link pages.
• Records. We keep a list of your Watchers and Share Links, with the dates when each was added, ended or removed.

Before you turn on Live View, add a Watcher or send a Share Link, make sure that the people you record agree that others can see the flight and hear it. See section 5 of our Terms of Use.

3.11 Flight Alerts and Word Watch#

When you use Live View, the website can show Flight Alerts: a red or yellow alert when something in the flight may need attention. CaptainVoice is not an emergency service. It can miss real events and raise false alarms.

• Data Alerts come from the flight data only (the GPS track, altitude and ADS-B traffic), with no speech. For example: a fast descent close to the ground, or no new data for 5 minutes while airborne.
• Word Watch is a separate switch. It is off until you turn it on, and it works only with Live View on. When you use Word Watch and turn it on, our worker sends the audio of your Flight Log to AssemblyAI's streaming speech service while you fly, with a list of alert words (for example "mayday", "pan-pan" and "go around"). We keep only the alert words that AssemblyAI finds: the words, their time, how sure AssemblyAI was, and the level of the alert. We do not store or show any other text, and Word Watch makes no transcript. Turning on Word Watch does not release your recording for a full transcript (section 5).
• What we store. Each Flight Alert, with its level, its time and place in the flight, the words or the data that raised it, and who acknowledged it.
• Alert emails. You and each of your Watchers can choose to get an email for each red alert. We send it through Resend (section 5).

3.12 Logbook, Instructor Signatures and Endorsements#

• Flight Facts. When this feature is available, our worker works out facts from the GPS track of each uploaded Flight Log: for example takeoffs and landings, the airports, flight time, night time and cross-country distance. Each value starts as Detected. If you correct one, we keep the detected value too.
• Your Logbook. When you use the Logbook, we keep what it holds: the entries that CaptainVoice drafts from your Flight Logs and Ground Logs, the entries and starting totals that you type in, your corrections, and the ACS Tasks that you tag in a recording. Your name and email address go with your Logbook. You can export your Logbook as a file. What you do with an export is up to you.
• Entries for other Crew Members. When you use the Logbook, one Flight Log can give an entry to each Crew Member who has a Logbook, or who claims one later. For example, when an Instructor records a dual flight, CaptainVoice can draft the student's entry from the same facts.
• Instructor profile. When an Instructor uses Instructor Signatures, we keep their profile: name, certificate number, ratings, and the certificate expiration date or the recent experience end date. We compare the name with the FAA's public airmen database, to show a badge when we find it there with a flight instructor certificate.
• Passkeys. An Instructor signs with a passkey and Face ID or Touch ID. Face ID and Touch ID work only on the Instructor's own device. We never receive a face or a fingerprint. We store the public part of the passkey and its ID.
• Signatures. For each Instructor Signature, we store an exact copy of what was signed (the entry or the Endorsement, the Instructor's certificate details and the statement signed), its fingerprint (hash), the signature, the time, the method (passkey or emailed code) and the browser's user agent. For an entry from a flight, the copy includes a reference to that flight and to its proof of integrity.
• Endorsements. When an Instructor gives an Endorsement, we keep it with its filled-in blanks, its end date if it has one, and the Endorsement it replaces, if any.
• Requests and emails. When a student asks for a signature, we email the Instructor at the address the student typed. When an Instructor sends a signed entry to a student, we email it to the student, with a PDF copy, at the address the Instructor typed. If that student has no account, we store the name and email address that the Instructor typed. We also send reminders 14 days before a time-limited Endorsement ends. These emails go through Resend.
• Who can see a signed record. The Pilot whose Logbook holds it, and the Instructor who signed it. Anyone with its verify code (printed with a QR code on the signature) can see that the record is unchanged since it was signed, and who signed it.
• The Instructor's records. For each entry and Endorsement that an Instructor signs, we keep a copy in the Instructor's account: the student's name and a summary. This helps the Instructor keep the records that 14 CFR 61.189 asks for.

4. Why we use it#

• To record your flight or ground lesson and keep it safe on your iPhone.
• To upload it to your account, when you sign in.
• To prove that a recording was not changed after it was made (see section 9).
• To make a transcript with speaker labels, when we release a recording for transcription.
• To give your recordings to the North Aero training harness, only if you linked your account to it.
• To show your recordings to you on the website, and to show a flight live to the people you choose, when you use Live View, Watchers and Share Links.
• To raise Flight Alerts, and to send the alert emails that you and your Watchers chose, when you use Live View and Word Watch.
• To work out Flight Facts, and to keep your Logbook with its totals, currency and exports, when you use the Logbook.
• To let Instructors sign entries and give Endorsements, to keep signed records unchanged and let others check them, and to keep an Instructor's records of the training they gave, when you use Instructor Signatures and Endorsements.
• To invite the people who sign up for the beta, and to write to them about it.
• To check how well the app works during the beta, for example how accurate the transcripts are. We may listen to recordings and read transcripts for this.
• To keep the service secure and to find and fix problems.
• To answer you, and to follow the law.

5. Who receives it#

We share data only as described here.

• Supabase. Supabase hosts our database, file storage and sign-in. It stores everything you upload. Our project is in Supabase's us-west-1 region in the United States. When you use the website, Supabase also stores the website's data: your settings, Watchers, Share Links, live audio files and map data, Flight Alerts, your Logbook, signatures and beta sign-ups.
• Resend. It sends your sign-in code. It receives your email address and the code. When you use the website, Resend also sends the other emails in this policy: alert emails, signature requests, signed entries and Endorsement reminders. It receives the address and the content of each email.
• Railway. Railway runs our website and our worker program in the United States. It processes the data that the website shows and that the worker reads and writes, for example audio, GPS tracks, Flight Alerts and Logbook entries, and it receives the website's visit logs (section 3.8). We keep the data itself in Supabase.
• Cloudflare. Cloudflare holds our domain name (captainvoice.com) and its DNS, and runs the network in front of our website. Every request to the website passes through Cloudflare, so Cloudflare receives your IP address and the pages and data that the website sends you. Cloudflare also forwards email sent to [email protected] to us.
• Apple. The app uses Apple's App Attest service, as in section 3.4. Apple also runs TestFlight and the App Store.
• AssemblyAI (transcripts). AssemblyAI turns a recording into text, with speaker labels and word times. A new recording is held and is not sent. We send a recording only after we release it by hand. When we do, AssemblyAI receives the audio of that recording and a list of aviation words (for example tail numbers and airport names). After we store the transcript, we ask AssemblyAI to delete its copy. AssemblyAI processes data in the United States. AssemblyAI separates speakers by the sound of their voices. AssemblyAI treats this as biometric data. We do not keep a voice profile of any person. A speaker label (for example "Speaker A") applies to one recording only.
• AssemblyAI (Word Watch). When you use Word Watch and turn it on (section 3.11), AssemblyAI's streaming speech service receives the audio of your Flight Log while you fly, and a list of alert words. This happens even while the recording is held for a transcript. AssemblyAI returns text, and we keep only the alert words it finds.
• The North Aero training harness (flynorth). This is the training-records system of North Aero. It reads recordings only from accounts that linked to it, and only while the link is active. It can read: the type of each recording, its times, aircraft, Crew names and roles, who was PIC, gaps, verification status, the transcript and the GPS track. It cannot change anything in our system. If you unlink, it can no longer read your recordings. If you never link, it never sees them. When Flight Facts are available (section 3.12), it can also read them.
• People you choose. The Share button makes ordinary files (audio, GPS track and an info sheet). They leave your iPhone only when you share them, for example by AirDrop, Messages, Files or Google Drive. What happens to them then is up to you and the people you send them to.
• Watchers, Share Links, Instructors and students. When you use Live View, Watchers and Share Links, the people you choose see your flight as section 3.10 describes. When you use the Logbook and Instructor Signatures, the Instructor and the student see the entries and Endorsements they share, and anyone with a verify code can check a signed record (section 3.12).
• The law. We may share data if the law requires it, or to protect the rights and safety of people.
• A change of owner. If the app or the service is sold or moved to another company, the data may move with it. This policy will still apply to it.

We do not sell your data. We do not share it for advertising.

6. Where your data is#

On your iPhone, and, after you sign in, in Supabase's us-west-1 region in the United States. AssemblyAI processes released recordings in the United States.

When you use the website, Railway runs it in the United States. Cloudflare handles each visit in one of its data centers, usually the one nearest to you. When you use Word Watch, AssemblyAI processes the audio in the United States.

The app is for people in the United States only. It is on the U.S. App Store only.

7. How long we keep it, and how to delete it#

7.1 On your iPhone#

• The app never deletes a recording from your iPhone before the cloud has it.
• In Settings, "Keep flights on this iPhone" has three choices: Always, 90 days or 30 days. Always is the default and removes nothing. With 90 or 30 days, when the iPhone runs low on storage, the app removes its copy of older flights. It removes only flights that the cloud has stored and checked. They stay in your account.
• The app also saves each finished recording as files in its folder in the Files app (On My iPhone, Recorder). You can delete those files at any time.
• If you delete the app, iOS removes everything the app keeps on your iPhone.

7.2 In the cloud#

• We keep your uploaded recordings until they are deleted as described here.
• For an account linked to the North Aero training harness, North Aero decides about deletion in a "Deletion Review". After a Delete answer, we delete the cloud audio of that recording, and the app deletes the audio on your iPhone too. We keep the transcript, the GPS track, the recording details and the proof of integrity, because they are part of the student's training record.
• AssemblyAI deletes its copy when we ask, right after we store the transcript.
• The live audio files and map data that we make for Live View come from your recording. We keep them as long as the recording. When we delete a recording's cloud audio, we also delete its live and replay audio files.
• We keep Flight Alerts (with the words that Word Watch found) and the records of your Watchers and Share Links with your account until they are deleted as described here.
• We keep your Logbook until you delete your account, except for the signed records and the Instructor's records in the next two items.
• Instructor Signatures cannot be changed or deleted. A change to a signed record is a new signed record (an Amendment, or a new Endorsement), and the original stays visible. If an Instructor deletes their account, the signatures on their students' entries and Endorsements stay valid, with the Instructor's name, certificate details and the public part of their passkey. We keep each signature, with its copy of what was signed, also after either person deletes their account.
• We keep an Instructor's copy of each entry and Endorsement they signed (section 3.12) for at least 3 years, also when the student deletes their account.
• We keep beta sign-ups until you ask us to delete them.

7.3 How to ask for deletion#

Email [email protected] from the email address of your account. Tell us what you want deleted: your account, one recording or all of them. During the beta, we do this by hand. We will tell you when it is done, or what we must keep and why.

When you can delete your account on the website, you can also do it there. Signed records and an Instructor's records stay as section 7.2 says.

If someone recorded you and you do not have an account, you can also write to us. Tell us the date, the aircraft and who recorded you.

8. Children#

The app is not for children under 13. We do not knowingly collect personal information from children under 13. If you think we have, email [email protected] and we will delete it.

9. Security#

• Proof of integrity. The app cuts each recording into 15-second pieces. Each piece carries a digital fingerprint (a hash) of its own content and of the piece before it, so a removed, added or changed piece shows. At Stop, the app signs a summary with the key in the iPhone's Secure Enclave. Apple App Attest shows that the key belongs to our genuine app.
• In transit. The app sends data to our cloud over encrypted connections (HTTPS).
• In the cloud. Each account can read only its own recordings. Only our server code can write them. Secret keys stay on the server. Our cloud provider encrypts stored data.
• On your iPhone. iOS encrypts the app's recordings while the iPhone is off and until you unlock it the first time after a restart. Your sign-in session is in the iPhone's Keychain, for this device only.
• On the website. The website uses encrypted connections (HTTPS). Your browser never receives our secret keys. Before the website shows a recording, our server checks that you may see it: your own sign-in, your Watcher access or a valid Share Link.
• Share Links. Each Share Link carries a long random secret. We store only a fingerprint (hash) of it.
• Signatures. Face ID or Touch ID stays on the Instructor's device. We store only the public part of the passkey, so anyone can check a signature later. Signed records cannot be changed. A change is a new signed record, and the original stays visible.

No system is perfectly secure. If a breach affects your data, we will tell you as the law requires.

10. Your choices#

• Record without signing in. Your recordings then stay on your iPhone.
• Upload on Wi-Fi only (Settings, Uploads).
• Choose how long flights stay on your iPhone (Settings).
• Share files only when you want to.
• Do not link to the North Aero training harness, or unlink.
• Ask us to see or delete your data (section 7.3).
• iOS lets you turn off microphone, location, motion and notification access at any time. The app cannot record audio without the microphone, or a GPS track without location.
• When you use the website: leave Live View and Word Watch off (they are off until you turn them on, and you can turn them off again), remove a Watcher or revoke a Share Link at any time, choose whether you get alert emails, download your recordings, and export your Logbook.

11. Changes to this policy#

We may change this policy. We will change the effective date at the top. If a change is important, we will tell you in the app, by email, or in the TestFlight notes before it applies.

12. Contact#

[Owner legal name]
[email protected]
https://captainvoice.com