Overview
Draft dated November 6, 2026. Samari Studios, LLC should review this policy against the final deployed service, App Store disclosures, and applicable law before publishing it as a final policy. A Sign in with Apple token-revocation step is still required before app release.
Airplane Window is operated by Samari Studios, LLC. It helps you find the estimated position of an aircraft at the time of a photo. The photo stays on your device during a flight lookup. The service receives the flight number and reviewed UTC photo time, not the image itself.
For privacy questions, contact airplanewindow@samaristudios.com.
Photos, capture times, and GPS
When you choose a photo, the app reads its available capture time and GPS metadata on your device. You may review or correct the time and UTC offset. Your chosen image and its original GPS coordinate are not uploaded to the Airplane Window API for a lookup.
If you choose Save copy with estimated GPS, the app writes a new photo asset with the estimated aircraft coordinate in GPS EXIF metadata and Photos location data. The original asset is not changed. The app requests Photos add permission for that action.
The nearby-places search and map display use Apple MapKit. Those Apple features may process map coordinates under Apple's own privacy practices.
Account and lookup information
Sign in with Apple supplies a signed identity token. Our server verifies it and stores the stable Apple subject identifier as an account key. The app stores its Airplane Window session token in the device Keychain. The service stores a credit balance and lookup history for that account.
To protect paid flight-data calls, the app uses Apple's App Attest. A supported device creates a key for this app and Apple attests to it. We store the key identifier, verified public key, App Attest receipt, environment, and a request counter with your account. The private key stays on the device. Short-lived challenge-use records prevent replay and expire after about five minutes. App Attest is required for sign-in and flight lookups in this build; unsupported devices can still explore the sample without an account.
A lookup request contains the entered flight identifier, the reviewed photo time in UTC, and a retry identifier. The server sends flight-related queries to FlightAware AeroAPI. It does not send your photo or original photo GPS to FlightAware. A successful lookup stores the flight number, photo time, and a temporary estimated aircraft position and route reference.
One free lookup is granted once per verified Apple identity. Additional credit purchases are not enabled in the current build.
How long information is kept
- Flight route and positional results: served for no more than 27 days after retrieval. S3 route objects become eligible for lifecycle deletion at day 27; AWS performs physical deletion asynchronously.
- Lookup history: the flight identifier and photo time remain with your account until you delete it, even after the route and position expire.
- Public share links: expire no later than the underlying positional result. The data stops being served then; physical removal by AWS may follow asynchronously.
- Free-lookup claim marker: a one-way HMAC marker is retained after account deletion to prevent the same Apple identity from repeatedly claiming a free lookup. It does not contain the photo, flight history, or readable Apple subject.
- App Attest records: the registered key information and receipt remain with the account until deletion. Used-challenge markers expire after about five minutes; AWS may physically remove expired records later.
On-device remembered-flight suggestions are cleared when you sign out or delete your account. A completed flight's route cache is keyed to the flight, not an individual account, and may remain until its normal expiry after account deletion.
Services involved
Apple provides Sign in with Apple, App Attest, Photos, MapKit, and the iOS share sheet. FlightAware provides flight history and track data requested by our server. Amazon Web Services hosts the API, account records, temporary route cache, and this website. The app does not add advertising trackers.
We use reasonable technical controls in the current design, including a private S3 bucket, encryption provided by AWS services, signed account sessions, and an opt-in share action. No internet service can promise absolute security.
Your choices and account deletion
You can choose not to save a GPS copy, not to share a result, and not to perform a lookup. In the app's Account tab you can sign out or select Delete account. Deletion removes your account, stored lookup history and results, public share links, registered App Attest key records, and on-device remembered-flight suggestions. It also removes unused credits. The one-way free-lookup claim marker described above remains.
The current development build does not automatically revoke your Sign in with Apple authorization when you delete the Airplane Window account. You can manage that authorization in your Apple Account settings. App-driven revocation is a release requirement still being completed.
To ask about your data or deletion, email airplanewindow@samaristudios.com.
Visiting this website
This is a static site served through AWS. Ordinary network requests may provide AWS with information needed to deliver a page, such as your IP address and browser details. The site itself does not set analytics cookies, load third-party fonts, or ask you to sign in.
Contact and updates
Operator: Samari Studios, LLC
Email: airplanewindow@samaristudios.com
This draft will be updated if the app's data practices or service providers change. A final policy should include an effective date and any additional disclosures required for the regions where the app is offered.