Privacy Policy

1. Who we are

WingPath is developed by Cephra LLC, a California limited liability company (“we”, “us”). We are the controller for the limited processing described in this policy. For anything privacy-related, use the contact form at wingpath.app/support.

2. What this policy covers

This policy covers the WingPath iOS app and our website at wingpath.app. It does not cover Apple's own processing (for example, your iCloud account, App Store purchases, or Apple's system services), which is governed by Apple's privacy policy.

3. Your data in the app

The WingPath app is designed so that we never receive your personal data through it. There is no sign-up, no login, and no WingPath server that stores anything about you. The app stores the following on your device:

Category	Examples	Where it lives
Profile you enter	Display name, role, airline, home airport, time zone	Your device + your private iCloud
Learning progress	Codes studied, answers, scores, streaks, session history	Your device + your private iCloud
Settings	Daily goal, reminder time, preferences	Your device + your private iCloud

If iCloud is enabled on your device, this data syncs between your devices through Apple's CloudKit service using a private database tied to your Apple Account. It is encrypted by Apple in transit and at rest. We have no technical ability to read, access, or recover it — only you can, through your devices and your iCloud account.

4. Location

During first-run setup, WingPath can optionally use your approximate location (reduced accuracy, while using the app) to suggest nearby airports when you choose your home airport. This happens only at that moment and entirely on your device: your location generates the suggestions and is never stored or transmitted to us or anyone else. After you select your home airport, the app does not use your location again — any “airports near you” features are based on the home airport you selected, not your device's location. If you decline the permission, the app simply shows a list of major airports instead.

5. Notifications

Daily reminders are optional and scheduled locally on your device using iOS's notification system. No push notification servers are involved, and nothing about your reminders leaves your device.

6. Purchases

WingPath Pro subscriptions and the lifetime unlock are processed entirely by Apple through the App Store. We never see your name, payment details, or billing address. The app receives only an anonymized receipt from Apple confirming your purchase so it can unlock Pro features. Manage or cancel subscriptions in your device's Settings under your Apple Account.

7. The airport database

The app periodically downloads its reference database — airports, airlines, routes, and hubs — from our server, which is hosted by Cloudflare. These requests work like any web download:

• Sent: a standard network request. No profile, progress, or personal data is included.
• Server logs: Cloudflare, our hosting provider, briefly processes technical data such as your IP address and request metadata to serve the request, for security, and for operations (our legitimate interest). We do not use these logs to identify or profile you, and they are retained only transiently.

8. This website

wingpath.app is a static site served by Cloudflare. It sets no tracking cookies and embeds no third-party advertising or cross-site trackers. Standard, transient server logs (IP address, user agent) are processed by Cloudflare to deliver and protect the site.

We use Cloudflare Web Analytics to understand basic, aggregate site traffic (such as page views and general region). It is privacy-preserving: it uses no cookies, does not fingerprint you, and does not track you across other websites or build a profile of you. We see only anonymous, aggregate trends — not individual visitors.

Our contact form additionally loads Cloudflare Turnstile, a privacy-preserving anti-spam check that confirms you're human without profiling you or tracking you across sites. It is not advertising or analytics, and runs only on the page with the form.

9. When you contact us

The one way we do receive personal data is when you choose to contact us — and that's entirely in your hands.

Contact form. When you submit the contact form on our website, we receive what you put into it: your message, and your email address if you provide one so we can reply. We use this for the single purpose of responding to your support or privacy request (our legitimate interest in running a support channel). Submissions are stored in our database, hosted by Cloudflare, which only we can access; we keep them for up to 12 months so we have context if you write back, then delete them. If we reply by email, that message is delivered through Cloudflare's email service.

Launch updates. If you ask to be notified when WingPath launches, we keep your email address for exactly one purpose — sending you that one launch announcement, with your consent. We delete the list shortly after the launch email goes out, and you can withdraw anytime before then using the contact form.

We never add your address to any other list, and we never share it.

10. What we don't do

• The WingPath app collects no analytics or telemetry and contains no third-party SDKs. Our website uses only privacy-preserving, cookieless analytics, described in section 8.
• We do not show ads and do not use advertising identifiers.
• We do not sell, rent, or share personal information, and have never done so.
• We do not track you across apps or websites, and there is nothing for the App Store's “tracking” label.
• We do not profile you or make automated decisions about you.

11. Service providers

The only parties involved in running WingPath are:

• Apple — iCloud/CloudKit sync (your private database), App Store distribution, and purchase processing, under Apple's privacy policy.
• Cloudflare — hosting for our website, storage for contact-form submissions (Cloudflare D1), and email delivery for our replies, under Cloudflare's privacy policy, providing protection consistent with this policy.

We would also disclose information if legally compelled to — though as described above, we hold essentially none. If WingPath is ever acquired, this policy would continue to apply and we would announce any changes.

12. Retention & deleting your data

Because your data lives with you, deletion is fully in your control:

• On your device: delete the WingPath app to remove all locally stored data.
• In iCloud: on your iPhone, open Settings → [your name] → iCloud → Manage Account Storage → WingPath → Delete Data (wording varies slightly by iOS version).

Step-by-step instructions live at wingpath.app/delete-account. Server logs at our host expire automatically after a short period. If anything is unclear, use the contact form at wingpath.app/support and we'll help.

13. Your rights

Depending on where you live — including the EEA/UK (GDPR) and several US states — you may have rights to access, correct, delete, or export personal data, to object to or restrict processing, and to complain to a supervisory authority. Because WingPath keeps your data on your device and in your private iCloud rather than on our servers, most of these rights are something you can exercise directly, instantly, and without asking us. For anything else, use the contact form at wingpath.app/support — we respond within 30 days, we will never discriminate against you for exercising your rights, and if we ever decline a request you may appeal by replying to our decision.

We do not sell or share personal information as defined by the California Consumer Privacy Act, and we have not done so in the preceding 12 months. Since there is no sale or sharing, there is nothing to opt out of — this is also our response to Global Privacy Control signals.

14. Children

WingPath is a general-audience app intended for aviation professionals and enthusiasts and is not directed at children under 13. We do not knowingly collect personal information from children — by design, we don't collect personal information from anyone. If you believe a child has used the app and you'd like their on-device data removed, the deletion steps in section 12 remove everything.

15. International transfers

Your app data stays within Apple's iCloud infrastructure under your own account. Requests to our website and reference-data server are served by Cloudflare's global network, with operations based in the United States; Cloudflare is certified under the EU-U.S. Data Privacy Framework (including the UK Extension) and offers Standard Contractual Clauses for the limited technical data it processes.

16. Security

Data in iCloud is encrypted in transit and at rest by Apple. Our websites are served exclusively over HTTPS with modern security headers. No method of storage or transmission is 100% secure, but our architecture means the most sensitive thing we could ever lose is… a public list of airport codes. If a breach affecting you somehow occurs, we will notify you as required by law.

17. Changes to this policy

If we make material changes — for example, if a future version of WingPath ever adds accounts or analytics — we will update this page, change the effective date above, and call it out in the app's release notes before the change takes effect.

18. Contact

Privacy and general support: use the contact form at wingpath.app/support.