TAILFIN
Privacy policy
What Tailfin keeps, and why
Last updated: 28 October 2026.
In short: Tailfin keeps only what it needs to run your account and keep it safe. There are no adverts, no tracking across apps or websites, no analytics companies, and nothing is sold.
Who is responsible
Jamie Barry – Tailfin
c/o flexdienst – #22504
Kurt-Schumacher-Straße 74
67663 Kaiserslautern
Germany
Phone: +49 631 31195729
Email: privacy@tailfin.info
This policy follows the EU General Data Protection Regulation (GDPR) and German law. It covers the Tailfin app on iPhone and Android and this website.
Using Tailfin without an account
You can browse routes, airlines and aircraft without an account. The app then sends only its requests (for example "the routes from LHR") to our server; it sends no name, no advertising identifier and no location. Like every server, ours and our network provider receive your device's IP address to answer; Tailfin itself does not store it, except as described under "Security" below.
Your account
| What | Why | How long |
|---|---|---|
| Your email address, and when it was confirmed | To sign you in, send codes and tell you about changes to your account | Until you delete your account |
| Your password, kept only in a form that cannot be turned back into it (Argon2id hash) | To check your password at sign-in | Until you change it or delete your account |
| Signed-in devices: a device type ("iPhone"), when you signed in, and a sign-in token stored only as a hash | To keep you signed in, and to sign out a device | Until the device signs out (then deleted within 30 days), or 60 days after it was last used |
| When you last signed in and last used the app, and the days you used it | To understand how much Tailfin is used (only as totals) and to spot misuse | Until you delete your account |
| Two-step sign-in, if you turn it on: the authenticator key (encrypted) and your recovery codes (as hashes) | To check the codes from your authenticator app | Until you turn it off or delete your account |
| Your display choices: units for distances and speeds, and light or dark mode | To show the app the way you set it on every phone you sign in on | Until you change them or delete your account |
| 6-digit email codes (as hashes) | To confirm your address or reset your password | 15 minutes; deleted within 30 days |
Your flights, aircraft and favourites
If you use these features, Tailfin keeps the following with your account. Only you can see them.
| What | Why | How long |
|---|---|---|
| Your favourites: a home airport, an airline and up to three aircraft types | To open the map at your airport and show your favourites first | Until you remove them or delete your account |
| Your trips: flights you mark with "I'm on this flight" or "I was on this flight", with what is known about each flight (route, times, terminals, gates, runways, delays, the aircraft type and registration). Together these are a record of where and when you travelled | To show your upcoming flights and your logbook, to tell you about changes to them, and to tell you when you have flown on an aircraft before | Until you remove a trip or delete your account |
| One flight you follow without being on it (for example a relative's) | To show its progress and tell you about changes to it | Removed automatically 6 hours after it lands, or when you stop following it |
| Up to two aircraft you follow, by registration | To tell you when they depart and land | Until you stop following them or delete your account |
| Notifications about these flights and aircraft (for example "gate B36", "boarding", "landed") | To show you the latest updates, and later to send them to your device | 90 days |
These come from public flight information, not from your device: Tailfin does not use your location, and does not share your trips with anyone. When you look a flight up by its number, the flight's details may be fetched from our flight data provider; that request names the flight, never you. To keep a flight you follow up to date around its departure and arrival, Tailfin asks the provider for those airports' latest departures and arrivals, again without any detail about you. Legal basis: providing the features you asked for (Article 6(1)(b) GDPR).
Legal basis: providing the account you asked for (Article 6(1)(b) GDPR). The usage figures rest on our legitimate interest in running and improving the service (Article 6(1)(f)).
Security
When a sign-in fails, we keep the email address that was typed, the IP address and the time, to slow down anyone guessing passwords. These records are deleted when you sign in successfully, and within 30 days in any case. Our network provider also filters attacks and limits how often an IP address may call the sign-in endpoints. Legal basis: our legitimate interest in protecting accounts (Article 6(1)(f)).
On your device
The app keeps your sign-in token in your phone's secure storage (the iOS Keychain or the Android Keystore) so you stay signed in; it is removed when you sign out. Your display choices (units, light or dark mode) are kept there too, so they also work without an account. The app uses no advertising or analytics tools.
Who helps us run Tailfin
These companies process data for us under data processing agreements:
| Company | For | Where |
|---|---|---|
| DigitalOcean | The server and the database | Amsterdam, Netherlands |
| Cloudflare | The network in front of the server (security, encryption), and this website | Worldwide; a US company |
| Resend | Sending the account emails (codes and notices) | United States |
| Proton | Our support and privacy mailboxes | Switzerland |
Transfers to the United States rely on the EU–US Data Privacy Framework or the EU's standard contractual clauses. Switzerland is recognised by the EU as giving an adequate level of protection. The flight data provider (AeroDataBox) receives no personal data: only which airport, time or flight number we ask about.
Your rights
You can ask for a copy of your data, have it corrected or deleted, restrict or object to its use, and receive it in a portable form (Articles 15 to 21 GDPR). You can delete your account yourself at any time in the app (Account → Delete account); everything kept for it is deleted at once. For anything else, write to privacy@tailfin.info.
You may also complain to a data protection authority, for example ours: the Berliner Beauftragte für Datenschutz und Informationsfreiheit, datenschutz-berlin.de.
Age
Tailfin accounts are for people aged 16 and over.
This website
This site sets no cookies and has no tracking. It is served by Cloudflare, which processes your IP address to deliver the pages and protect the site.
Changes
If this policy changes, the new version will be here with a new date. Important changes will also be announced in the app.