Privacy Policy

This Privacy Policy explains how Airworthy Academy (“Airworthy Academy,” “we,” “us”) collects, uses, and shares information when you use our websites and applications (the “Services”), and the choices you have.

Our approach is to collect as little as the product genuinely needs, for purposes we can describe concretely. We do not sell your personal information, and we do not use it for cross-context behavioural advertising.

Our Terms of Service govern your use of the Services and should be read alongside this policy.

The Services are intended for adults. To use them you must be at least 18 years old and at least the age of majority where you live. Where the age of majority where you live is higher than 18, that higher age applies.

Airworthy Academy is not directed to children, and we do not knowingly collect personal information from anyone under those ages. If you believe a child has provided us with personal information, contact us at support@airworthyacademy.com and we will take appropriate steps.

We use the information described above to:

• Create, maintain, and secure your account.
• Sign you in and keep you signed in.
• Confirm your email address, and resend that confirmation if you ask.
• Provide the Services and the features you use.
• Respond to your support requests.
• Send you service messages about your account, security, and material changes to our documents.
• Detect, investigate, and prevent fraud, abuse, and security incidents.
• Comply with legal obligations and enforce our Terms.

When the features described later in this policy launch — lessons and progress, AI assistance, paid subscriptions — we will use information for the additional purposes described in those sections.

These features are not yet available. When lessons and study tools launch, using them will produce learning data — information about your studying that makes the product work.

That may include:

• Which courses you are enrolled in.
• Lessons you have completed, and your progress through a course.
• Answers and scores from practice questions and practice tests.
• Your study history over time.
• Bookmarks, saved items, and achievements.

The purpose of this information is to run the product for you: to show your progress, to pick up where you left off, to tell you which areas need work, and to improve the curriculum. It is connected to your account so that it is there when you return.

Learning data is kept with your account. Cancelling a paid subscription does not delete it — see “Cancellation Is Not Account Deletion” below.

AI features are not yet available. This section sets out how we intend to handle them, so that the position is clear before anything launches.

We use cookies only for signing in and staying signed in. Today they cover:

• Keeping you signed in as you move between pages, and refreshing your session so it does not expire while you are using the Services.
• Completing a sign-in securely, including the short-lived state needed to finish signing in with Google.

Most are set by our authentication provider on our behalf. We also set one short-lived cookie of our own when you accept our documents — at signup, and if we ever ask you to accept an updated version. It holds a random identifier and nothing else: no personal information, and none of the detail of what you accepted, which is kept on our side. It expires on its own within a day at most.

All of these are necessary for an account to work. Blocking them will prevent you from signing in.

We do not use advertising cookies, analytics cookies, or tracking pixels, and we do not store information in your browser beyond what is described above. If that changes, we will update this policy and provide any consent controls the law requires.

We do not currently use any analytics or tracking technology. The Services contain no analytics software, no advertising trackers, no session-replay or heat-mapping tools, and no fingerprinting.

We may introduce limited product analytics in future, to understand reliability, how features are used, how onboarding performs, whether lessons are being completed, and how effective the teaching is. If we do, we will update this policy, say who the provider is, and provide any consent mechanism the law requires. We do not plan to use analytics for cross-site behavioural advertising.

There are no paid plans yet, and we do not currently collect any payment information.

When paid Premium subscriptions launch, payment card details will be handled by a specialised payment processor rather than by us. We do not intend to store complete payment card numbers.

We expect to keep limited billing information needed to operate a subscription — for example which plan you are on, its status and renewal date, and records of transactions, refunds, and disputes — so that we can run your subscription, handle refunds and chargebacks, and meet accounting and tax obligations. We have not yet selected a processor, and we will update this policy before any of this takes effect.

We share personal information only in the following circumstances:

• With the service providers that operate the Services on our behalf, as described in the next section, and only so that they can perform that work.
• When you direct us to, or use a feature that involves another service — for example choosing to sign in with Google.
• To comply with the law, a legal obligation, or a valid legal request.
• To protect the rights, property, or safety of our users, the public, or Airworthy Academy, including to detect and prevent fraud, abuse, and security incidents.
• In connection with a business transfer, as described below.
• With your consent, or at your direction.

We do not make your personal information available to third parties for their own unrelated commercial purposes.

We rely on a small number of providers to operate the Services. Each handles information only to perform its function.

Supabase

Authentication, identity, and session management. Handles your name, email address, authentication credentials, Google identity link, and session information.

Vercel

Hosting and server execution. Processes requests to the Services, which necessarily involves technical information such as IP addresses, request headers, and session cookies in transit.

Resend

Delivery of transactional email, used through our authentication provider's email configuration. Handles recipient addresses, message content, and its own delivery records.

Google

Optional sign-in provider, used only if you choose to sign in with Google. Used for authentication and account linking only.

Cloudflare

Domain and DNS infrastructure for airworthyacademy.com.

Each provider handles information under its own privacy practices and retains its own operational records. We do not restate their retention periods here as commitments of ours.

As the product grows we expect to add a payment processor, and possibly an AI provider and an analytics provider. None has been selected, and we will update this section before any of them begins handling your information.

We do not sell your personal information, and selling personal information is not part of our business model.

We also do not use your personal information for cross-context behavioural advertising, and we do not disclose it to third parties for that purpose. The Services contain no advertising technology.

Sharing information with the service providers listed above, so that they can operate the Services for us, is not selling it.

We keep personal information for as long as it is reasonably necessary for the purposes described in this policy — principally for as long as you have an account with us.

We may keep information for longer where we reasonably need to in order to:

• Meet legal obligations that apply to us.
• Meet tax and accounting requirements.
• Detect, prevent, and investigate fraud, abuse, and security incidents.
• Handle payment disputes and chargebacks.
• Establish, exercise, or defend legal claims, and enforce our Terms.
• Maintain compliance records.

Information may also persist for a period in routine backups after it has been removed from the live Services, and is deleted as those backups age out in the ordinary course.

We do not currently delete accounts automatically for inactivity.

These are two different things, and we keep them separate deliberately.

Where lawful, we may use aggregated or de-identified information — information that does not identify you — to understand how effective our teaching is, to improve the curriculum and the product, to understand reliability, and to assess feature quality.

Where it is practical to answer a question from aggregated or de-identified information, we prefer to do that rather than examine an identifiable individual's learning history.

De-identification reduces the risk that information can be linked back to a person, but no technique is perfect, and we do not claim that de-identified information is irreversibly anonymous. We do not attempt to re-identify information we have de-identified.

We take reasonable measures to protect personal information. Sign-in is handled by a dedicated authentication provider, passwords are never stored by our own application code, sessions are carried in cookies marked secure in production, and access to systems is limited to what is needed to operate the Services.

No service can guarantee perfect security, and we do not claim to. Please use a strong, unique password, and tell us promptly at support@airworthyacademy.com if you believe your account has been accessed without your permission.

Depending on where you live, you may have rights in relation to your personal information, which may include:

• Access — to know what personal information we hold about you and how we process it.
• Correction — to have inaccurate information corrected.
• Deletion — to ask us to delete your personal information.
• Portability — to receive a copy of information you provided to us.
• Opt-out rights that apply to you under your local law.
• Withdrawal of consent, where our processing is based on consent.
• Appeal, where a right of appeal against our decision is required by law.

To make a request, email support@airworthyacademy.com. We may need to verify your identity before acting, and we will respond as required by applicable law. Exercising these rights will not cause us to treat you differently.

We do not currently offer self-service tools to edit your profile, download your data, or delete your account. Email is the route for all of these for now. Self-service deletion is planned, and a data export may follow.

This section is for California residents. Whether, and to what extent, the California Consumer Privacy Act applies to Airworthy Academy depends on thresholds that we will confirm; we describe our position here regardless.

The categories of personal information we handle, the purposes for which we use them, and the providers that receive them are described in “Information We Collect,” “How We Use Information,” and “Service Providers” above.

We do not sell personal information, and we do not share it for cross-context behavioural advertising as those terms are used in California law. We therefore do not offer a “Do Not Sell or Share My Personal Information” control, because there is nothing for it to switch off.

California residents may exercise applicable rights — including access, deletion, correction, and the right not to be discriminated against for exercising them — by emailing support@airworthyacademy.com. An authorised agent may submit a request on your behalf where the law permits, and we may take reasonable steps to verify the agent's authority.

Airworthy Academy operates from the United States, and information is processed in the United States and in other locations where our service providers operate. Laws in those locations may differ from the laws where you live.

By using the Services you understand that your information may be processed outside the country where you live.

If Airworthy Academy is involved in a merger, acquisition, financing, reorganisation, or sale of assets, personal information may be transferred as part of that transaction. We will require the recipient to continue to handle it in a manner consistent with this policy, and we will notify you if it becomes subject to a materially different privacy policy.

The Services may link to websites and resources we do not operate, including official aviation sources. We do not control those sites, we are not responsible for their content or privacy practices, and this policy does not apply to them. Please read the privacy policy of any site you visit.

We will update this policy as Airworthy Academy develops — in particular as the features described above as unavailable are built.

For minor or clarifying changes, we will post the updated policy with a new “last updated” date. For material changes, particularly those that involve using your information in a way this policy does not already describe, we will give you reasonable notice by email, by a prominent notice in the product, or both, and we will obtain your consent where the law requires it. We will not rely on quietly editing this page to make a materially new use of your information.

For questions about this policy, or to make a privacy request, email us at support@airworthyacademy.com.

Please tell us what you are asking for, so that we can handle your request properly.