TARMAC is operated by Legion Systems LLC. This policy describes how we collect, use, and protect your data when you use TARMAC's FAA written-test preparation tools — including Diagnostic, Test Runway, Practice, Learn, Transfer, Weakness Attack, Prove It, spaced review, full practice exams, and Tarmac Readiness — as well as certain legacy community features that remain accessible to some users.
1. Information We Collect
We collect the following information when you use TARMAC:
Account & Profile
- Name and email address (provided at signup)
- Password (hashed — never stored in plain text)
- Your selected exam type (Private Pilot or Instrument Rating) and, if provided, your target FAA test date and daily study-time preference
- The date and Terms of Service version you accepted at signup
- CFI status — a self-reported boolean relevant only if you use the legacy Ask a CFI feature. We do not verify this claim.
- Debrief anonymity preference — relevant only if you use the legacy Accident Debrief feature.
- Profile avatar (if uploaded)
Study & Practice Data
- Your Diagnostic results, and your answers, confidence selections, and results across Practice, Learn, Transfer, Weakness Attack, Quiz, and full practice exam sessions
- Concept mastery and spaced-review scheduling data, used to personalize what you study next
- Test Runway / Study Plan progress — your current study phase, daily plan, and completion status
- Your Tarmac Readiness score and its underlying components
- Questions you have saved to study later
- AI Tutor conversations — including the question text, your selected answer, and whether it was correct, which are sent along with your chat messages to generate a relevant response
- If you choose to report it, your actual FAA exam outcome (pass/fail, score, and how it compared to your practice) — this is entirely optional and self-reported
Community Content (legacy features)
- Comments you post in Accident Debrief
- Questions and answers you post in Ask a CFI
- Weather scenarios and vote choices you submit in Weather Room
- Route critiques you submit
- Votes, flags, and reactions on community content
- Feedback and suggestions submitted via the in-app suggestion box
Community content may be visible to other TARMAC members. Anonymous posting options in Accident Debrief display "Anonymous Pilot" rather than your real name.
Payment Information
Billing is handled entirely by Stripe. We do not store your credit card number or full payment details. We receive a Stripe customer ID, subscription status, and subscription metadata only.
Support Requests
If you contact us, report a bug, submit a suggestion, or apply to TARMAC's influencer/referral program, we collect the information you provide — such as your name, email, message, and the page you were on, and (for influencer applications) your social media handles and audience size.
Device & Technical Data
TARMAC's application code does not itself collect or log your IP address, device information, or browsing activity. Our hosting provider, Vercel, may log standard technical information (such as IP address and browser type) as part of operating and securing its infrastructure, consistent with Vercel's own privacy policy.
2. How We Use Your Information
- To provide, operate, and improve the Service — including your Diagnostic, Test Runway, personalized practice, concept mastery, spaced review, and Tarmac Readiness
- To generate and refine AI-assisted practice content
- To send transactional emails related to your account and study activity (such as billing receipts and quiz/exam results) — some of these emails include your specific answers and performance details
- To display your name and participation in legacy community features to other TARMAC members, if you choose to use them
- To moderate community content using automated AI systems (see Section 4)
- To manage your account, subscription, and billing
- To respond to support requests, bug reports, suggestions, and influencer program applications
- To monitor for abuse, spam, fraud, and Terms of Service violations
- To analyze aggregate usage patterns to improve the platform
We do not sell your personal information to third parties. We do not use your data to train our own AI models.
3. Third-Party Services
We use the following trusted third parties to operate the Service:
- Supabase — database hosting and authentication
- Stripe — payment processing and subscription management (Stripe receives your email and an internal account identifier; TARMAC never receives or stores your full card details)
- Anthropic — processes your AI Tutor conversations, including related question and performance context, to generate tutoring responses and explanations; also used for legacy community-content moderation and NTSB-data anonymization, where those features remain in use
- OpenAI and Google (Gemini) — used internally to help generate practice question content. These providers do not receive your personal account information, answers, or activity — only non-personal question and concept material
- Resend — transactional email delivery (some emails, such as quiz/exam results, include your performance details in the email content itself)
- Vercel — application hosting and infrastructure
- NTSB / Socrata — public aviation accident data used in the legacy Accident Debrief feature, where applicable
Each of these providers has their own privacy policy governing data they receive. We encourage you to review them.
4. AI Processing of Your Content and Data
TARMAC uses AI in several ways that may involve your content:
- AI Tutor and study support: when you ask the AI Tutor about a question, TARMAC sends that question's text and answer choices, your selected answer, whether it was correct, and your chat messages to Anthropic's API to generate a response.
- Practice question generation: some practice questions, scenarios, and explanations are generated with the help of AI systems — including Anthropic, OpenAI, and Google's Gemini models — grounded in authoritative FAA source material and reviewed through TARMAC's validation process before publication. This generation process does not involve your personal data.
- Content moderation (legacy features): community posts (Accident Debrief comments, CFI answers, Weather Room scenarios) are reviewed by an AI system before being published to check for policy violations.
- NTSB anonymization (legacy): raw NTSB accident records are processed by AI to remove or alter identifying information (names, tail numbers, specific airport codes) before being presented as community scenarios.
- Community summaries (legacy): top community comments on Accident Debrief scenarios may be synthesized by AI into educational summaries.
Anthropic processes your content in accordance with their privacy policy and API usage terms. Anthropic does not use API inputs to train their models by default.
5. Community Content Visibility (Legacy Features)
If you choose to use TARMAC's legacy community features, content you post there may be visible to other TARMAC members. Specifically:
- Your name is displayed alongside your community contributions by default.
- In Accident Debrief, you may choose to post with your name or anonymously. Admins can always see the author regardless of anonymity setting.
- Ask a CFI questions and answers are attributed to your name.
- Weather Room vote choices (go/no-go) are aggregated; individual votes may be visible to other members.
- Your CFI status badge is visible if you have marked yourself as a CFI in your profile.
Community content you have posted remains stored in our database even if you later change your name or anonymity settings. To request removal of specific posts, contact us at support@tarmac.study.
6. Data Retention
We retain your account data, including your study and practice history, for as long as your account is active. Community content you have posted (comments, answers, scenarios) may remain visible after account deletion if it has received meaningful engagement, though it will be disassociated from your personal account. If you delete your account, we will delete your personal profile information within 30 days, except where retention is required by law or for legitimate business purposes (such as billing records and fraud prevention).
7. Cookies and Local Storage
We use a session cookie required for authentication (via Supabase) and a cookie that remembers your selected exam type (Private Pilot or Instrument Rating). We may also use browser localStorage for UI state, session progress, and free-tier usage tracking. We do not use third-party advertising cookies or tracking pixels.
8. Your Rights
You have the right to:
- Access the personal data we hold about you
- Request correction of inaccurate data
- Request deletion of your account and associated personal data
- Export your data in a portable format (upon request)
- Request removal of specific community posts you have authored
To exercise any of these rights, email us at support@tarmac.study.
9. Security
We use industry-standard security measures including HTTPS encryption, hashed passwords, and row-level security policies in our database. Access to your data is restricted by authentication and authorization controls. No method of transmission over the internet is 100% secure — we cannot guarantee absolute security, but we take reasonable precautions to protect your data.
10. Children's Privacy
TARMAC is not directed at children under 13, and use of TARMAC by anyone under 13 is prohibited. Users between 13 and 18 must have parental or guardian consent, as described in our Terms of Service. We do not knowingly collect personal information from children under 13. If you believe we have collected such information, contact us and we will delete it promptly.
11. Changes to This Policy
We may update this Privacy Policy from time to time to reflect new features or legal requirements. We will update the "Last updated" date at the top of this page. For material changes, we will make reasonable efforts to notify you. Continued use of the Service after changes are posted constitutes acceptance of the updated policy.