Privacy Policy & GDPR Notice

OnTime Turnaround (“we”, “us”, “our”) operates the website at ontimeturn.com, the OnTime Turnaround desktop application, and the API that connects them. We are the data controller for personal data collected through these services.

Our servers and database are hosted within the European Union. Personal data we collect is stored and processed on EU-based infrastructure.

For privacy enquiries or data requests, contact data@ontimeturn.com.

What we hold depends on how far you go with us. Joining the waitlist collects one field. Buying and flying the product collects considerably more.

If you join the waitlist

• Email address — so we can tell you when we launch and send your waitlist discount.
• Referral code— if you arrived through a creator's link, the code identifying that creator, so we can credit them.

If you create an account

• Email address, username and password. Your password is stored only as a salted hash — we never hold it, and cannot recover it for you.
• Profile details you choose to add — avatar image, country, SimBrief username, and Twitch or YouTube links.
• Session records — the sign-in tokens for each device, and the browser or app identifier that created them, so you can be signed out everywhere if you need to be.

If you buy the product

• Purchase record — that a purchase happened, when, and the reference Stripe gave it.
• Licence key — the key issued to your account.
• We never see or store your card details. Payment is taken by Stripe on their own checkout page. See section 6.

If you fly with the desktop app

• Roster and flight data — the legs you plan and fly, their airports, aircraft, callsigns, scheduled and actual times, fuel figures and landing rates.
• Simulator position data— latitude, longitude, altitude, heading and ground speed while a flight is in progress, plus the track of the flight afterwards. This comes from your simulator, not from your device's location services.
• Points, penalties and friend or group membership — the scoring and social records the product is built around.

If you use the website

• Product analytics — pages visited and a small number of named events such as joining the waitlist, collected through PostHog. See section 5.
• Poll and roadmap responses — your store-preference poll answer, and your roadmap votes if you are signed in.
• Creator agreement submissions — if you submit the creator agreement, your name and the social handles you provide.

Read this section carefully. It is the part most people do not expect.

The live map is public. While you are flying with the desktop app, your username, aircraft type, callsign, route, position, altitude, ground speed and your times against schedule appear on ontimeturn.com/live, which anyone can view without signing in. Tracks of flights completed in the last 24 hours are also shown. There is currently no way to fly with the app without appearing there, so if you do not want your flying to be public, do not fly with the app connected.

Your username and points may appear on leaderboards and on pilot profiles inside the product.

Some things are private unless you turn them on. Your Twitch and YouTube links are hidden from your public profile until you enable them in Settings, and your flight reports are not shared with friends unless you enable that too. Both are off by default.

Your email address is never shown to other users.

• Contract (Article 6(1)(b)) — running your account, issuing and validating your licence, taking payment, and storing the flights you record. We cannot provide the product without this.
• Consent (Article 6(1)(a)) — the waitlist, and any marketing email. You may withdraw consent at any time, using the unsubscribe link in any email or by emailing us.
• Legitimate interests (Article 6(1)(f)) — product analytics, rate limiting and abuse prevention, and keeping an administrative audit log of changes made to accounts.
• Legal obligation (Article 6(1)(c)) — keeping records of sales for tax and accounting purposes.

We use PostHogfor product analytics, on their EU infrastructure, served through our own domain. It records which pages are viewed and a small set of named events. Session recording is switched off, and PostHog respects your browser's Do Not Track setting — if you have it enabled, nothing is collected. PostHog sets a cookie and a browser storage entry to recognise a returning visitor.

We do not use Google Analytics, Meta Pixel, advertising cookies, or any retargeting technology.

Your browser also stores the following, none of which we can read remotely:

• Sign-in tokens, so you stay signed in between visits.
• A referral code, if you arrived through a creator's link.
• A poll marker, so the store poll is not shown to you twice in one session.
• A creator agreement cookie, if you have been given access to that page.

Clearing your browser data removes all of these and signs you out.

• Stripe — payment processing. Stripe collects and holds your card details directly; we receive only a confirmation and a reference. See Stripe's privacy policy.
• Mailgun — sends our email, including password reset links, licence keys and launch announcements, from EU infrastructure. See Mailgun's privacy policy.
• PostHog — product analytics, EU region. See PostHog's privacy policy.
• OVH — hosting for our servers and database, within the European Union.
• SimBrief — if you enter a SimBrief username, we request your flight plans from SimBrief on your behalf.
• CheckWX — supplies airport weather. Airport codes are sent; nothing about you is.
• YouTube and Twitch — our creators page requests public channel information from these platforms. This happens on our server, so your browser is not contacted by them.

We do not sell, rent or trade your personal data, and we do not share it with anyone for their own marketing.

• Waitlist entries — until you unsubscribe or ask us to remove you, or 12 months after general availability, whichever comes first.
• Account and flight data — for as long as your account exists. Delete your account and it goes with it.
• Live map positions — flight tracks stop being shown publicly after 24 hours; the underlying leg record is kept with your logbook.
• Purchase records — retained for as long as tax and accounting law requires, even after an account is deleted.
• Password reset codes — 10 minutes, then they expire and are consumed.

If you are in the UK or the European Union you have the right to access your data, to have it corrected, to have it erased, to restrict or object to our processing of it, to receive it in a portable format, and to withdraw consent at any time where consent is the basis we rely on.

To exercise any of these, email data@ontimeturn.com. We will respond within 30 days. Deleting your account removes your profile, settings, rosters, flights, positions and points; purchase records are retained as described in section 7.

You also have the right to complain to your data protection authority. In Ireland that is the Data Protection Commission; in the UK, the Information Commissioner's Office.

OnTime Turnaround is not intended for children under 16. We do not knowingly collect data from them. If you believe a child has created an account, contact us and we will remove it.

We may update this policy. When we do, we will change the effective date at the top of this page. If a change materially affects how we handle your data, we will tell account holders and waitlist subscribers by email before it takes effect.

Privacy and data requests: data@ontimeturn.com

Anything else: support@ontimeturn.com