Privacy Policy

1. Information We Collect

We collect the following information when you use TARMAC:

Account & Profile

• Name and email address (provided at signup)
• Password (hashed — never stored in plain text)
• Callsign — a community display name you choose (3–12 alphanumeric characters). Visible to other TARMAC members.
• CFI status — a self-reported boolean indicating whether you are a Certificated Flight Instructor. We do not verify this claim.
• Debrief anonymity preference — whether you prefer to post in Accident Debrief using your callsign or anonymously.
• Profile avatar (if uploaded)

Ground School Usage Data

• Practice sessions, questions answered, scores, quiz results, and exam performance — used to power your personalized study experience and spaced repetition system.
• AI Tutor chat conversations — stored to provide session continuity and personalized tutoring.

Community Content

• Comments you post in Accident Debrief
• Questions and answers you post in Ask a CFI
• Weather scenarios and vote choices you submit in Weather Room
• Route critiques you submit
• Votes, flags, and reactions on community content
• Feedback and suggestions submitted via the in-app suggestion box

Community content may be visible to other TARMAC members. Anonymous posting options in Accident Debrief display your chosen callsign rather than your real name.

Payment Information

Billing is handled entirely by Stripe. We do not store your credit card number or full payment details. We receive a Stripe customer ID, subscription status, and subscription metadata only.

Device & Technical Data

Standard server logs including IP address, browser type, and pages visited — used for security, error monitoring, and performance analysis.

2. How We Use Your Information

• To provide, operate, and improve the Service — including personalized Ground School practice, weak-area detection, AI tutoring, and community features
• To display your callsign and participation in community features to other TARMAC members
• To moderate community content using automated AI systems (see Section 4)
• To manage your account, subscription, and billing
• To send transactional emails (billing receipts, account alerts)
• To monitor for abuse, spam, fraud, and Terms of Service violations
• To analyze aggregate usage patterns to improve the platform

We do not sell your personal information to third parties. We do not use your data to train AI models.

3. Third-Party Services

We use the following trusted third parties to operate the Service:

• Supabase — database hosting and authentication
• Stripe — payment processing and subscription management
• Anthropic — AI-powered explanations, tutoring, accident anonymization, and community content moderation (your messages and community posts may be processed by Anthropic's API)
• Resend — transactional email delivery
• Vercel — application hosting and edge infrastructure
• NTSB / Socrata — public aviation accident data used to populate Accident Debrief scenarios

Each of these providers has their own privacy policy governing data they receive. We encourage you to review them.

4. AI Processing of Community Content

TARMAC uses AI (powered by Anthropic) in several ways that may involve your content:

• Content moderation: Community posts (Accident Debrief comments, CFI answers, Weather Room scenarios) are reviewed by an AI system before being published to check for policy violations.
• NTSB anonymization: Raw NTSB accident records are processed by AI to remove or alter identifying information (names, tail numbers, specific airport codes) before being presented as community scenarios.
• AI Tutor: Your chat messages in the AI Tutor are sent to Anthropic's API for processing. We do not use these to train AI models.
• Community summaries: Top community comments on Accident Debrief scenarios may be synthesized by AI into educational summaries.

Anthropic processes your content in accordance with their privacy policy and API usage terms. Anthropic does not use API inputs to train their models by default.

5. Community Content Visibility

Content you post in TARMAC community features may be visible to other TARMAC members. Specifically:

• Your callsign is displayed alongside your community contributions by default.
• In Accident Debrief, you may choose to post with your callsign or anonymously. Admins can always see the author regardless of anonymity setting.
• Ask a CFI questions and answers are attributed to your callsign.
• Weather Room vote choices (go/no-go) are aggregated; individual votes may be visible to other members.
• Your CFI status badge is visible if you have marked yourself as a CFI in your profile.

Community content you have posted remains stored in our database even if you later change your callsign or anonymity settings. To request removal of specific posts, contact us at support@tarmac.study.

6. Data Retention

We retain your account data for as long as your account is active. Community content you have posted (comments, answers, scenarios) may remain visible after account deletion if it has received meaningful engagement, though it will be disassociated from your personal account. If you delete your account, we will delete your personal profile information within 30 days, except where retention is required by law or for legitimate business purposes (such as billing records and fraud prevention).

7. Cookies and Local Storage

We use session cookies required for authentication (via Supabase). We may also use browser localStorage for UI state and free-tier usage tracking. We do not use third-party advertising cookies or tracking pixels.

8. Your Rights

You have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your account and associated personal data
• Export your data in a portable format (upon request)
• Request removal of specific community posts you have authored

To exercise any of these rights, email us at support@tarmac.study.

9. Security

We use industry-standard security measures including HTTPS encryption, hashed passwords, and row-level security policies in our database. Access to community content and user data is restricted by authentication and authorization controls. No method of transmission over the internet is 100% secure — we cannot guarantee absolute security, but we take reasonable precautions to protect your data.

10. Children's Privacy

TARMAC is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe we have collected such information, contact us and we will delete it promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect new features or legal requirements. We will update the "Last updated" date at the top of this page. For material changes, we will make reasonable efforts to notify you. Continued use of the Service after changes are posted constitutes acceptance of the updated policy.

12. Contact

Questions or concerns about your privacy? Contact us at support@tarmac.study.