Privacy Policy

1. Controller

The controller responsible for processing personal data in the Airtenance application ("Airtenance", "the service") is:

StagWorks — Maximilian Rosnauer und Benjamin Seeger GbR Beinsteinerstraße 40, 71394 Kernen im Remstal, Germany Email: info@stagworks.de

The full details are in the legal notice. For data-protection enquiries, please use the email address given there.

2. What Airtenance is

Airtenance is a fuel and oil accounting tool for flying clubs. A club records refuels, oil top-ups, oil changes and inspections for its aircraft, imports its Vereinsflieger flight-log export, and photographs the pages of the aircraft logbook (Bordbuch). Airtenance computes consumption rates and maintenance due-dates from those records.

The app and the website work on the same data of the same club. What you enter in the app, the club's members see on the website, and the other way round.

Airtenance is used by named members of a club. It is not directed at the general public.

3. Categories of data processed

Account data. Email address, display name, hashed authentication credentials, account creation timestamp, and the timestamp and version of the Terms and this Privacy Policy you accepted at sign-up, and, where applicable, the time you chose not to see the post-sign-in notice again. Authentication is handled by Google Firebase Authentication. If you sign in with Google or Apple, we receive your email address, your name and an account identifier from that provider; we never receive your password with that provider.

Club and membership data. The clubs you belong to, your role description within a club, join requests, and invite codes you create or redeem.

Profile details you choose to add. A profile picture (a photograph you take or pick, reduced to a small square image, or one of the illustrated avatars the app ships with), a phone number, your home airfield and a short free-text note about yourself. All of these are optional; without a picture the app shows one of its illustrated avatars. They are stored on your profile and on your entry in each club's member list, so that the other members of your club can see them. You can change or remove them on the profile screen at any time.

Operational records you enter. Aircraft registrations and technical figures (tank and oil capacities, counter readings, next inspection), fuel and oil events, defect reports, and free-text comments. These may name a pilot or refer to a person. Every record carries the name of the member who entered it — that is part of the maintenance trail.

Flight-log import data. The contents of the Vereinsflieger CSV export uploaded through the website: dates, times, aircraft registration, counter readings, flight duration, and the free-text Kommentar field, which can identify the pilot in command.

Logbook photographs. Images of physical aircraft logbook pages taken with the app or uploaded through the website, and the text transcribed from them (including pilot names). A page is stored under the SHA-256 hash of its bytes. Photographs are held in Google Firebase Storage.

Invoices (website only). Invoices from airfields and suppliers that a member uploads through the website, and what is read from them: supplier, invoice number, date, amounts, and line items with registration and landing time. Matching against the flight log can tie a line item to a flight and so to the pilot in command. Reading them runs on our own infrastructure, as for logbook photographs (section 10).

Shared mailbox. If a member of your club connects the club's shared mail address (for example info@…) on the website, the club's mail service reads that mailbox — read-only; it cannot reply, forward, flag or delete — and stores, for each mail received there, the sender's name and address, the subject, the time of receipt, the first 600 characters of the text, and the category a local classifier assigned to it (training request, intro flight, membership, other). The full text is not stored unless the club has expressly enabled that. These mails are typically written by people who are not members of the club or users of Airtenance; the club, as the recipient of the mail, is the controller for this processing and Airtenance processes it on the club's behalf. The mailbox password or client secret is encrypted in the member's browser with a key held only by the club's mail service; neither other members nor we can read it. The app shows these mails and the waiting list derived from them; it never connects to a mail server itself.

Requests to start a club. If you ask for a new club, we store what you entered — the club's name, home airfield, number of aircraft, whether it uses Vereinsflieger, your message, your name and email address — together with our decision and, if we decline, the reason. We use it to decide on the request and to contact you about it.

Feedback. A note you send with "Send feedback" is stored with your account ID, the kind of screen you sent it from and whether you allow us to reply. It reaches us, the operator, not your club. Only if you allow a reply do we look up your email address to answer.

Anonymous usage statistics (website). Unless you switch it off, the website counts which screens are opened and which main actions are taken (for example "CSV import completed" or "page photographed"). Each count records only the action, the kind of screen — never its address, its contents or a bookmark code — and the day. It contains no account ID, no IP address, no cookie and no device identifier, and nothing is stored on your device for it; we keep only daily totals, so a count cannot be traced back to anyone. Your IP address is used for a moment to limit how often counts are accepted from one address and is not stored. You can switch the counting off under Profile (it applies to that browser), and a browser that sends the Global Privacy Control signal is never counted.

Technical data. When you use the service, server and platform logs may record your IP address, timestamp, requested resource, referrer, user-agent and HTTP status, for delivery, security and error analysis.

Device attestation (App Check). To refuse requests that do not come from an unmodified Airtenance app, the app obtains an integrity attestation before it accesses Firebase: on Android through Google Play Integrity, on iOS through Apple App Attest / DeviceCheck, in the browser through reCAPTCHA Enterprise. The device sends technical characteristics to Google or Apple for this; the result is a short-lived token that contains nothing from inside the app.

Crash reports (iOS and Android app only). When the app crashes or hits an error it cannot recover from, it sends a crash report to Google Firebase Crashlytics: the error and the program location it occurred at, the app version, device model, operating-system version, free memory and disk space, the time, a random installation identifier generated by Crashlytics, and a short list of the technical events that preceded it (for example "saving a page failed", which may name an aircraft registration or a record's internal identifier). The report contains no name, email address, account identifier, photograph or record contents. Debug builds and the demo mode send nothing. The website sends no crash reports.

3a. What stays on your device

Camera and photo library. The app uses the camera to photograph logbook pages, only while you have the scan screen open, and — if you choose to — to take a profile picture. A photograph is uploaded only once you keep it; discarded shots are not stored. The photo library is opened only when you tap "Choose from photos" (for logbook pages, an aircraft photo or your profile picture), through the system picker, and the app receives only the picture you select.

Settings. Language, theme, the aircraft you last photographed and a pending join request are stored locally on the device and never leave it.

Sign-in session. Firebase keeps your sign-in on the device so you do not have to sign in on every launch. Signing out removes it.

Website. On the website, a cookie or equivalent local storage is used only to keep you signed in and to remember your language and theme. No non-essential cookies are set.

The app and the website contain no third-party analytics, tracking or advertising tools and set no tracking cookies. Our own anonymous usage statistics and the crash reporting are described in section 3.

4. Purposes and legal bases (GDPR Art. 6(1))

Purpose	Legal basis
Creating and operating your account, providing the service to your club	Art. 6(1)(b) — performance of a contract
Storing and reconciling the records, imports and photographs your club enters	Art. 6(1)(b), and Art. 6(1)(f) — legitimate interest in an accurate fleet record
Recording your acceptance of the Terms and this policy	Art. 6(1)(c) — legal obligation, and Art. 6(1)(f)
Security, abuse prevention, device attestation, server logs	Art. 6(1)(f) — legitimate interest in a secure service
Crash reports from the app	Art. 6(1)(f) — legitimate interest in a working, stable app
Deciding on a request to start a club and contacting you about it	Art. 6(1)(b) — steps taken at your request before a contract
Anonymous usage statistics and your feedback, to improve the service	Art. 6(1)(f) — legitimate interest in improving the service
Any processing you separately consent to	Art. 6(1)(a) — consent, withdrawable at any time

5. Who can see your data

Other members of your club. Membership is the permission model: every member of a club can read and write all of that club's data, including the records, imports, defect reports and logbook photographs described above. Role labels are descriptive, not access controls. This is enforced server-side, not merely hidden in the interface. The members of your club also see your name, role, and the profile details you chose to add (picture, phone number, home airfield, note).

Us, as the operator. To approve and support clubs, our operator console shows us, for each club, counts and statuses — how many aircraft, flights and logbook pages it holds, whether processing jobs failed, when a member last signed in — and the name and email address of its owner and Administrators. It does not show the club's records, photographs or mail. Every change we make to a club from the console is logged.

Processors. Google Ireland Limited / Google LLC provides Firebase Authentication, Firestore, Firebase Storage, App Check and Crashlytics as our processor under a data processing agreement. The hosting provider for the website runs it under a comparable agreement.

AI provider for logbook photographs. Anthropic Ireland, Limited (Dublin, Ireland) reads the handwriting on uploaded logbook pages as our processor (section 10), under Anthropic's data processing addendum, which forms part of its commercial terms. Anthropic may not use the content it receives to train models.

Sign-in providers and platforms. If you use "Continue with Google" or "Continue with Apple", that provider processes your sign-in under its own privacy terms. Apple (App Attest) and Google (Play Integrity) receive technical device characteristics for attestation. The App Store and Google Play process installation and updates under their own terms; we receive no personal data from them.

Data is not sold, and is not shared for any third party's own purposes.

6. International transfers

Firebase services may process data on infrastructure operated by Google outside the European Economic Area, including in the United States. Such transfers are covered by the EU-US Data Privacy Framework where applicable, and otherwise by the European Commission's standard contractual clauses.

Anthropic may process excerpts of logbook photographs in the United States as well, through Anthropic, PBC and its sub-processors. These transfers are covered by the European Commission's standard contractual clauses, which form part of Anthropic's data processing addendum.

7. Retention

Account data is kept for as long as the account exists. Club records, imports and logbook photographs are kept for as long as the club retains them or until a member deletes them, since they form the fleet's maintenance history.

When you delete your account, your profile document is removed and you are removed from every club roster. Records you entered into a club remain with the club — they are the club's operational history, not personal correspondence. They keep the name they were entered under, but are no longer linked to your account. A join request that is still open is withdrawn on deletion, and a request to start a club and your feedback notes are deleted with the account.

Usage counts are daily totals that contain no personal data; they are kept as long as they are useful for the statistics.

Server and platform logs are kept for a short period (typically no more than a few weeks) and then deleted, except where a specific security incident requires longer retention until it is resolved.

Crash reports are deleted by Firebase Crashlytics 90 days after they were received.

Mail read from a connected shared mailbox is deleted 180 days after it was received, whether or not anyone has looked at it. A waitlist entry a member created from a mail keeps the name and address copied into it until a member removes it. Disconnecting the mailbox deletes every mail it brought in.

8. Your rights

Under the GDPR you have the right to access, rectification, erasure, restriction, data portability, and objection to processing based on legitimate interest, and the right to withdraw any consent with future effect.

The app's profile screen offers "Download my data" (everything tied to your account, as a JSON file) and "Delete account" directly. Deletion is available without a club membership too, and is also described at stagworks.de/delete-account.

To exercise a right, or if a request cannot be completed in the app, contact us via the legal notice. You also have the right to lodge a complaint with a supervisory authority, in Germany the data-protection authority of your federal state.

9. Security

Traffic is encrypted with TLS. Access to club data requires a signed-in account with a confirmed email address that is a member of the club. Accounts can enrol two-factor authentication with an authenticator app, in the app or on the website; the second factor is then asked for at every sign-in. No method of transmission or storage is perfectly secure, and no absolute guarantee can be given.

10. Automated processing of logbook photographs

What is automated. When you upload a photograph of a Bordbuch spread, an automated system — including a machine-learning model ("AI") for handwriting and layout recognition — reads the figures and free text off the image: dates, pilot names, counter readings, flight times, landings, carried-over totals, and the fuel, oil and defect notes on the right-hand page. Before upload the app itself only runs a quality check of the shot (sharpness, exposure, alignment) on the device; it does not read handwriting. The CSV flight-log import and the parsing of its Kommentar field are rule-based and use no model.

Provenance is recorded. Each page stores which model and prompt version produced its figures, and the time it was read, so a later model change can be re-run cleanly.

Where the model runs. Handwriting on logbook photographs is currently read by a language model from Anthropic (Claude) through its programming interface. Excerpts of the photograph are sent to Anthropic for this: the flight page as a whole and the entries of the technical page one by one. The column holding the names and signatures of the pilots in command is blanked out on our systems first and is not sent; free text on the technical page is sent as written and may contain names. Anthropic processes the excerpts as our processor (section 5) and does not use them to train models. The reading of invoices and the sorting of mailbox mail still run on infrastructure operated by us or by the club itself.

No decision is made about you. The output is a transcription, not an assessment. It feeds the club's fuel and oil arithmetic; it does not produce any decision that has legal or similarly significant effect on a person within the meaning of GDPR Art. 22.

Human review. Every machine-read figure is shown to club members beside the photograph it came from, marked as machine-read, and is provisional until a member confirms it. A correction a member makes overrides the model and is stored as the authoritative value. The consumption-rate calculations continue to run on the CSV-sourced figures until a member has ruled on any disagreement between the two.

Legal basis. Art. 6(1)(b) and Art. 6(1)(f) — the legitimate interest in turning a paper logbook into a usable, checkable fleet record. You may object to this processing under section 8; a club can instead maintain its records from the CSV import and manual entry alone.

11. Changes

We may update this policy as the service changes. Material changes raise the policy version; when that happens you may be asked to accept the new version before continuing to use the service. The date above always reflects the current version.