Legal
Last updated: August 2026
McFly Aviation ("we", "us", or "our") operates the virtual airline website at mcfly.aero (the "Service"). This Privacy Policy explains what personal data we collect when you use the Service, why we collect it, how long we keep it, and the choices you have. By using the Service you also accept our Terms of Service.
When you register we ask for an email address, password (hashed by the platform, never stored in plaintext), a display name, and a short statement of your flying experience. Optionally you may add a VATSIM ID, IVAO ID, Discord ID, country flag, and an avatar. We log these so we can identify you across the site, on the leaderboard, and in tour and PIREP records.
When tracking a flight with Stratos, the Service receives position, altitude, speed, heading, phase transitions, fuel state, landing rate, and touchdown G-force, along with structured event messages such as pushback, take-off, touchdown, and shutdown. This data is stored as your flight's ACARS log and is used to render the PIREP report, profile charts, the phase timeline, and to calculate your flight score and earned XP.
Each registered pilot is issued a unique API key that authenticates the Stratos desktop client to the Service. That key is tied to your account and is shown only to you and to admin staff. Briefings integrate with SimBrief (simbrief.com); live-ATC data is fetched from VATSIM, IVAO, PilotEdge, and POSCON public feeds. We exchange only the minimum data (departure/arrival ICAO, route, planned times, flight callsign) required to produce each briefing or display. Those external services are governed by their own privacy policies, which we encourage you to read.
The Service uses session cookies and tokens required for authentication and account state — without them you cannot stay logged in. No advertising, tracking, or third-party analytics cookies are deployed on mcfly.aero. Charter preferences and other UI choices may be stored locally in your browser.
We use your data to run the virtual airline: to authenticate your account, display your pilot profile, populate leaderboards, score and rank your flights, validate tour progress, generate badges, contact you about your account when necessary, and surface live-ATC information during briefings. We do not sell your data.
Certain information is visible to other pilots by design: your display name, pilot ID, country flag, public profile, earned badges, rank, logbook flights, and tour progress. PIREP telemetry (route, distance, scoring breakdown) is shown on the PIREP report page and contributes to community leaderboards. Your password, email address, Stratos API key, and internal numeric User id are never displayed publicly. Admin staff can see all of your data for moderation, support, and integrity review of PIREP scoring.
Your account and profile data is retained for the lifetime of your account. PIREPs, ACARS logs, scores, tour progress, and Score Adjustment records form the airline's permanent history and are kept even if your account is terminated, though the associated display name may be anonymised. Charter route bookings created for immediate dispatch are purged after the relevant expiry window.
We use HTTPS for all traffic, role-based access controls so each pilot only edits their own data, and admin-only gates for sensitive operations. The pilot API key is stored encrypted on your profile and only used to validate Stratos requests. However, no internet transmission is fully secure, and we cannot guarantee absolute protection.
You may edit your profile (display name, country, avatar, VATSIM / IVAO / Discord IDs, experience) at any time from the Flight Deck. You can rotate your Stratos API key from the same screen. Account deletion is available by request; note that filed PIREPs remain part of the airline's historical record. To exercise any other data-rights request, contact us using the email below.
The Service is not directed at children under 13, and no one under 13 may register an account. Where local law requires a higher minimum age, that higher limit applies.
The Service is operated from Europe. If you access the Service from a country outside the EU/EEA you do so of your own initiative and are responsible for compliance with any local laws that apply to you.
We may update this Privacy Policy from time to time. The "Last updated" date above reflects the most recent revision. Material changes will be surfaced on the site; continued use of the Service after the effective date constitutes acceptance of the revised policy.
Questions about this Privacy Policy can be sent to barna@mcfly.aero.