Privacy Policy

This Privacy Policy applies to AirwayLink websites, dashboards, applications, APIs, support channels, and related services (collectively, the “Service”). AirwayLink is operated by AirwayAlliance (“AirwayLink,” “we,” “us,” or “our”). It does not govern independent services operated by virtual airlines or other third parties, even when the Service links to or integrates with them.

For privacy questions or requests, contact us at support@airwaylink.org.

Depending on how you use the Service, we may process:

• Account and identity data: name, username, email address, profile image, authentication identifiers, verification status, account roles, and permissions supplied through Auth0 or another configured identity provider.
• Connected-service data: Discord user ID and profile information, virtual-airline memberships, vAMSYS pilot identifiers, ranks, bookings, PIREPs, flight activity, aircraft or fleet information, points, and related operational records.
• Profile and community data: pilot name, callsign, public passport information, airline history, event participation, announcements, and information you choose to make available through community features.
• Content and communications: support email, mailbox content, internal notes, PIREP comments, feedback, uploaded documents, rank-transfer evidence, and other material submitted to the Service.
• Administrative and safety data: staff actions, access permissions, review decisions, moderation records, bans, audit information, and records used to prevent abuse or resolve disputes.
• Technical data: session cookies, browser and device information, IP address and request metadata where recorded by our infrastructure, service-worker and installation state, timestamps, diagnostic logs, security events, and approximate location inferred from network information.
• Preferences: theme, sidebar, application-installation, and other dashboard settings.

Please do not submit highly sensitive personal information, real-world aviation credentials, government identifiers, financial information, medical information, or private material that is not needed for a Service feature.

We obtain information:

• directly from you when you sign in, link an account, upload material, contact support, or use a feature;
• from identity and connected-service providers such as Auth0, Discord, vAMSYS, and participating virtual airlines;
• from staff members, airline administrators, other users, and public virtual-aviation sources when they submit or manage records; and
• automatically from your browser, device, and our hosting, security, and database infrastructure.

When you connect a third-party account, you authorize the exchange of information needed to provide the requested integration, subject to that third party’s own terms and privacy policy.

We use information to:

• authenticate users, link accounts, maintain sessions, and enforce permissions;
• provide pilot dashboards, passports, flight records, live maps, bookings, fleets, events, documents, rank transfers, PIREP review, and support features;
• synchronize records with participating airlines and connected services;
• operate staff workflows, communicate with users, investigate reports, and enforce community or airline rules;
• secure, troubleshoot, test, analyze, and improve the Service;
• detect fraud, misuse, unauthorized access, and other harmful activity; and
• comply with law, protect legal rights, and respond to valid legal process.

Where applicable law requires a legal basis, we generally rely on performance of our agreement with you, our legitimate interests in operating and securing the Service and the virtual-aviation community, compliance with legal obligations, and consent where we specifically request it. You may withdraw consent for future processing when consent is the basis, without affecting processing already performed.

We do not currently sell personal information or use it for cross-context behavioral advertising. If this practice changes, we will update this policy and provide any choices required by law.

AirwayLink includes community and operational features. Pilot names, Discord identifiers, airline memberships, callsigns, PIREP summaries, flight statistics, points, public passport pages, and similar virtual-aviation information may be visible to other users, participating airlines, staff, or the public, depending on the feature and its access settings. Public pages may be indexed, copied, or retained by third parties outside our control.

Support communications, rank-transfer evidence, moderation records, permissions, and internal staff notes are intended for authorized users, but may be shared with relevant airline staff when reasonably necessary to administer a request, protect the community, or resolve a dispute. Do not place confidential information in a public or shared field.

We may disclose information to:

• Service providers that support authentication, hosting, databases, storage, email, security, logging, and application delivery, including configured providers such as Auth0, Supabase, and Resend.
• Connected platforms such as Discord, vAMSYS, participating virtual airlines, and AirwayBridge when needed to provide synchronization, account linking, notifications, or requested actions.
• AI providers if an AI-assisted feature is enabled. Inputs, outputs, and associated metadata may be sent to the configured model provider. Do not submit sensitive or confidential information to an AI feature.
• Authorized staff and airline personnel who need the information to operate the Service, review activity, support users, or enforce applicable rules.
• Authorities or affected parties when we reasonably believe disclosure is required by law or necessary to protect rights, safety, security, or the integrity of the Service.
• A successor organization in connection with a merger, reorganization, transfer, financing, or similar change involving the Service, subject to applicable law.

Providers may process information under their own terms when acting independently.

We use cookies and similar browser storage that are necessary to authenticate you, preserve security state, remember preferences, support account linking, and operate the installable web application. For example, the Service may remember whether you dismissed an installation prompt. Blocking necessary storage may prevent sign-in or cause features to fail. We do not currently use third-party advertising cookies.

We retain information for as long as reasonably necessary to operate the Service, maintain accurate aviation and administrative records, fulfill the purposes described here, resolve disputes, enforce agreements, preserve security and audit history, and meet legal obligations. Retention varies by record type. Account, flight, moderation, and transaction-like operational records may remain after account closure when needed for integrity, fraud prevention, community history, or legal claims. Backups and logs may persist for a limited period after deletion from active systems.

When information is no longer reasonably needed, we may delete it, de-identify it, or aggregate it. De-identified or aggregated information that cannot reasonably identify you may be retained.

We use administrative, technical, and organizational safeguards intended to protect information, including authenticated sessions and role-based access controls. No Internet transmission, integration, or storage system is completely secure. You are responsible for protecting your account credentials and promptly reporting suspected compromise. We cannot guarantee that loss, misuse, or unauthorized access will never occur.

AirwayLink and its providers may process information in countries other than the one where you live. Those countries may have different privacy laws. Where required, we rely on recognized transfer mechanisms or other lawful safeguards, but information remains subject to lawful access in the jurisdictions where it is processed.

Depending on your location and subject to legal exceptions, you may have rights to request access, correction, deletion, restriction, objection, or portability; withdraw consent; appeal a decision; or complain to a privacy regulator. You may also disconnect integrations through the relevant provider, though doing so may disable Service features.

Send requests to support@airwaylink.org from the email associated with your account. We may ask for information needed to verify your identity and authority. We may retain or decline to delete information where permitted or required for security, record integrity, legal compliance, fraud prevention, or the rights of others. Authorized agents may submit requests where local law permits and adequate authority is provided. We will not discriminate against you for exercising a privacy right.

The Service is a general-audience virtual-aviation platform and is not directed to children under 13. Users under the age of legal majority in their location should use the Service only with the involvement and permission of a parent or legal guardian. We do not knowingly collect personal information from a child under 13 without legally required consent. If you believe a child has provided information improperly, contact us so we can review and take appropriate action.

We may update this policy to reflect changes to the Service, providers, or law. The updated date above shows when the latest version took effect. If a change materially affects how we use personal information, we will provide additional notice when required by law.

Questions, concerns, and privacy requests may be sent to support@airwaylink.org. You may also complain to the privacy or data-protection authority in your jurisdiction where that right applies.