TAFCast — Privacy Notice

Version 1.2 · Effective 2026-10-12

1. Controller and contact

TAFCast handles the personal data described in this notice. Location: Lisbon, Portugal. For privacy enquiries and requests, contact tafcast@outlook.com.

2. Overview

TAFCast does not require an account and does not include advertising or third-party analytics/tracking SDKs in the app. Network requests still involve personal data such as IP addresses and request metadata. This notice covers the website, web apps, Android app, widgets, alerts, and the backend we operate.

3. On-device information

Saved airports, display preferences, alert settings, an optional backend address, cached data, and the accepted legal version and acceptance time are stored on your device. Airport identifiers and search queries are sent when requesting data; preferences and the acceptance record are not routinely uploaded to us.

Clear Android app storage or browser/site data to remove local information. Uninstalling an installed web app does not necessarily clear browser storage. Device or browser backup settings may affect copies outside the app. Deleting local data does not delete records held by hosting or other providers.

4. Requests and support

The website host and backend receive IP addresses, requested URLs, airport codes, search terms, timestamps and technical request metadata such as user-agent information. These may be recorded in infrastructure logs. IP-based counters are used to limit abusive traffic.

If you email us, we receive your email address, the message and attachments, and information needed to respond. Please do not send unnecessary sensitive information. No GPS permission is required to search airports.

5. Purposes and legal bases

We process technical request data to deliver the information you request and maintain a functioning service. Where necessary to perform our agreement with you, the basis is Article 6(1)(b) GDPR. Security, proportionate rate limiting, troubleshooting, and general correspondence rely on legitimate interests under Article 6(1)(f): operating and protecting a reliable service and responding to enquiries. Those interests must be balanced against your rights, particularly for children.

Where a specific legal duty requires processing, Article 6(1)(c) applies. We do not rely on acceptance of the Terms as consent for advertising or unrelated processing. If an optional feature requires consent, it must be separately requested and withdrawable. Necessary network information is required to deliver online requests; no account or marketing profile is required.

6. Recipients and direct connections

The website uses GitHub Pages. The backend and synthetic-outlook model service use Google Cloud Run in europe-southwest1. Hosting, infrastructure, and email service providers process information needed for their functions; support correspondence uses the Outlook contact address.

Backend requests to NOAA Aviation Weather Center, FAA, Open-Meteo, autorouter, IPMA-related model services, and airport datasets generally concern airports rather than the user's GPS location. Providers contacted by the backend normally see the server's network address. The Android app can also request FAA NOTAM information directly; the FAA then receives the device's IP address and request metadata.

The browser version loads React and Babel resources from unpkg.com, which receives network request information such as your IP address. The packaged Android version bundles those resources locally. App-store and operating-system providers process information under their own notices. If you choose another backend, its operator receives your requests and its own notice applies.

7. International processing

The backend services run in Google Cloud europe-southwest1, but logging, support, email, content delivery and provider operations can involve processing outside Portugal and the European Economic Area, including in the United States. An EU service region does not mean that all processing stays in the EU.

Google Cloud publishes transfer provisions in its Cloud Data Processing Addendum, including standard contractual clauses or an applicable alternative transfer solution: https://cloud.google.com/terms/data-processing-addendum/. GitHub describes its international processing and safeguards in https://docs.github.com/en/site-policy/privacy-policies/github-general-privacy-statement. Microsoft describes its international processing and safeguards for services including Outlook at https://www.microsoft.com/en-us/privacy/privacystatement. These describe the providers’ arrangements; they are not a claim that every service uses an identical mechanism.

For transfers we arrange, applicable data-protection law requires an appropriate basis, such as an applicable adequacy decision or contractual safeguards. Contact tafcast@outlook.com for information about the safeguards relevant to your data or to request a copy, subject to protection of confidential information. Direct connections to independent data and content providers are described in Section 6 and are also subject to their own privacy notices.

8. Retention

Local settings and caches remain until cleared, replaced, or removed by the device/browser. Backend rate-limit counters expire after a one-minute window and are periodically cleared; they are also lost on server restart. This is separate from infrastructure access logs.

As verified on 12 October 2026, the Google Cloud project routes ordinary application and request logs to its global _Default logging bucket, configured to retain them for 30 days. The separate _Required bucket retains specified administrative and system audit logs for 400 days; this is not a 400-day retention period for ordinary app requests. These periods concern Cloud Logging, not every provider or support record.

Our retention policy for ordinary support correspondence is deletion from the mailboxes and working copies we control within 90 days after the enquiry is resolved. If a correspondence record is necessary for a security investigation, it is handled under the security-record policy below.

Our retention policy for identifiable security-incident records that we separately preserve is deletion or anonymisation within 12 months after the incident is closed. We retain a restricted, relevant subset for longer only where necessary to comply with a legal obligation or establish, exercise or defend a specific legal claim; we review that need and delete it when the reason ends. These are operator retention rules, not statements that email deletion is automated.

GitHub controls retention of its own service records. Its published privacy statement uses purpose-based criteria, including contractual needs, legal obligations and dispute resolution, rather than a single visitor-log deletion deadline. See https://docs.github.com/en/site-policy/privacy-policies/github-general-privacy-statement. We do not assign an unverified number of days to GitHub’s records.

Deleting a message or working copy does not necessarily immediately remove provider recovery copies, backups or records independently retained by the provider. Microsoft describes its retention criteria, including service needs and legal obligations, at https://www.microsoft.com/en-us/privacy/privacystatement. Provider-managed records follow the applicable provider terms and settings; our 90-day support rule is not a promise that all provider copies are erased on that date.

9. Your rights

Subject to applicable conditions, you may request access, correction, erasure, restriction, and portability of your personal data, and object to processing based on legitimate interests. If processing relies on consent, you can withdraw it without affecting the lawfulness of earlier processing.

Email tafcast@outlook.com to exercise rights. We may request proportionate information to identify the relevant records and verify a request, but do not require an account or collect additional identification solely to make otherwise anonymous records identifiable. Requests are normally addressed within one month; lawful extensions and limitations will be explained.

You may complain to Portugal's Comissão Nacional de Proteção de Dados (CNPD), https://www.cnpd.pt/, or another competent supervisory authority, including where you habitually reside or work. You do not need to contact us first. Other mandatory privacy rights available in your location are preserved.

10. Children and optional notifications

TAFCast is open to a general audience, including learners; no age, account, or pilot licence is requested. Children should involve a parent or guardian where local law requires it and avoid sending personal information unnecessarily. Contact us with concerns about a child's data. The same technical requests described above can occur for younger users.

Where supported and enabled, weather alerts use device background checks and local notifications. Notification permission can be changed in device settings. These alerts are not guaranteed and are not a safety-monitoring service.

11. Changes

We will explain material changes to this notice in the Service or on the website. A revised notice does not itself authorise new processing requiring consent or another legal basis. Contact tafcast@outlook.com with privacy questions.