Privacy Policy

1. Overview and Who We Are

VatSight is a free, open-source project built around a live radar app for the VATSIM virtual air traffic network, its website and its newsletter. This privacy policy explains what information is used, where it comes from, and how it is handled across all three:

• the website at vatsight.com (Section 2)
• the VatSight newsletter (Section 3, plus cookies in Section 4)
• the VatSight iOS app, covered in full technical detail (Sections 5–12)

VatSight is developed and maintained by Marcel Marzec, an individual based in the United Kingdom. For the purposes of UK data protection law (the UK GDPR and the Data Protection Act 2018), Marcel Marzec is the controller of any personal data described in this policy. You can reach him at contact@marcelmarzec.com.

2. The Website

The vatsight.com website has no user accounts, no analytics, no advertising and no tracking pixels, and it does not set any cookies (the newsletter pages are the one exception; see Section 4). Like almost every website, it still involves some technical processing:

• Server logs. When you visit, our web hosting provider's server automatically records standard technical information: your IP address, browser user agent, the page requested, the referring page and the time. These logs are used only to keep the site running and secure, and they are deleted automatically on the hosting provider's rotation schedule.
• Cloudflare. The vatsight.com domain uses Cloudflare for DNS. Where traffic is routed through Cloudflare's network, Cloudflare processes your IP address to deliver the site and protect it from attacks. See Cloudflare's privacy policy.
• Google Fonts. The site's typefaces are loaded from Google Fonts, so your browser connects to Google's servers, which receive your IP address and user agent. See Google Fonts' privacy FAQ.

Our lawful basis for this processing is our legitimate interests (UK GDPR Article 6(1)(f)) in running a secure, working website. We do not use this data to identify you, build profiles or track you across other sites.

3. The Newsletter

You can choose to join the VatSight newsletter on the sign-up page or the home page. It is used only to send you your invite to the VatSight TestFlight open beta (included in the welcome email you receive once you confirm), and then to email you about the App Store launch and major VatSight updates.

What we store

We do not track whether you open our emails or which links you click, and we don't ask for your name or any other details.

Double opt-in and consent

When you sign up, we send a confirmation email. You're only added to the list after you click the link in it, so nobody can subscribe you without your agreement. Our lawful basis for sending the newsletter is your consent (UK GDPR Article 6(1)(a) and regulation 22 of the Privacy and Electronic Communications Regulations). You can withdraw your consent at any time. This doesn't affect anything we sent before you withdrew it.

Unsubscribing

Every newsletter email has an Unsubscribe link that removes you with one click, and supports the one-click unsubscribe button many email apps show. You can also unsubscribe here, change your details here, or just email us.

Where your data is kept and who can see it

The newsletter runs on phpList, open-source software that we host ourselves on the same web server as this website, at vatsight.com/phplist. Emails are sent from our own mail server. We do not use a third-party email marketing service. Your address is never sold, rented or shared with anyone, and it's used for nothing except this newsletter. The only third party involved is our web hosting provider, which stores the server data on our behalf as a processor under a data processing agreement.

If our hosting provider stores or processes any of this data outside the UK, we make sure the transfer is covered by adequacy regulations or appropriate safeguards, as UK data protection law requires.

How long we keep it

• While you're subscribed: we keep your details for as long as you stay on the list.
• If you never confirm: unconfirmed sign-ups are deleted regularly, normally within a month.
• After you unsubscribe: we keep only your email address and the date you opted out, on a suppression list, so that you are never emailed again. This is based on our legitimate interest in respecting your choice. Ask us and we'll delete it completely, but then we can't guarantee you won't be re-subscribed if someone enters your address again.
• If the newsletter closes: we delete the whole list.

4. Cookies

The main VatSight website does not set any cookies. The newsletter's sign-up, confirmation and preferences pages (under vatsight.com/phplist/) set a single session cookie that phpList needs to process your form. It contains no personal information and expires when you close your browser. Because it's strictly necessary for the service you've asked for, it doesn't require consent under PECR.

5. Information the App Does NOT Collect

Mapbox's own SDK telemetry is disabled by default (see Section 8), and unless you choose to enable the optional ads described in Section 9, the VatSight app does not collect, transmit, or share any of the following:

• Your name, email address, or any contact information
• Your device's location (GPS or network-based)
• Device identifiers (IDFA, IDFV, or similar)
• Usage analytics or behavioural telemetry
• Crash reports (no third-party crash reporting SDK is integrated)
• Health, financial, biometric, or sensitive personal data
• Contacts, photos, microphone, or camera data

6. Information Stored On-Device Only

VatSight stores a small amount of data locally on your device using SwiftData (Apple's encrypted, on-device database). This data never leaves your device and is never transmitted to any server.

If you choose to enable optional ads (see Section 9), the advertising SDK will make its own additional network requests while ads are enabled, in order to fetch and report on ad content.

Your VATSIM CID is a publicly visible network identifier — it is not a password or secret credential. VatSight treats it as a reference to look up publicly available data, not as personal information.

7. Network Requests

VatSight makes outbound network requests solely to fetch publicly available data needed to power the radar. No user data is included in any of these requests.

8. Third-Party SDKs

VatSight uses the following third-party libraries:

Mapbox Maps iOS SDK

Used to render the interactive map. The SDK has its own optional telemetry feature which, if active, would send a small amount of technical data to Mapbox in order to operate and improve their mapping service:

• IP address (retained by Mapbox for up to 30 days, then deleted)
• A rotating session identifier (not linked to your identity beyond 24 hours)
• Timestamps and device/OS information (user agent)
• The app's bundle identifier
• Basic map interaction events (e.g. map loads/views)

VatSight disables this telemetry by default for every user — it is switched off automatically each time the app launches, with no action required from you. If you actively choose to re-enable it during a session via the ⓘ attribution button on the map (as a way to help improve OpenStreetMap and Mapbox), it will be switched off again the next time you launch VatSight. Because VatSight never requests location access (see Section 10), this telemetry cannot include your GPS location even if enabled. VatSight does not pass your VATSIM CID, tracked CIDs, or any other identifier to Mapbox, and Mapbox states it does not sell personal data or use this telemetry for advertising. You can review Mapbox's full data practices at mapbox.com/legal/privacy.

Separately, Mapbox's SDK sends its own anonymous, non-personal "active user" ping to Mapbox regardless of the telemetry setting above — this is required by Mapbox's terms of service for billing purposes and does not carry device, session, or IP-level telemetry.

ZIPFoundation

An open-source Swift library used to decompress VATGlasses sector data downloaded from GitHub. It operates entirely on-device and makes no network requests.

GEOSwift

An open-source Swift library used for geographic polygon operations (merging airspace sectors). It operates entirely on-device and makes no network requests.

9. Optional Advertising

VatSight includes an optional way to support development: watching rewarded ads. Ads are off by default and are never shown automatically — you must actively choose to enable them from Settings, and you can turn them off again at any time.

When you choose to watch ads, you decide how many to watch in that session. This is a voluntary way to support the project — it does not unlock any feature, since every feature currently in VatSight remains free whether or not you choose to watch ads.

Ads are served by a third-party advertising SDK. While ads are enabled and being shown, that SDK may collect technical data such as advertising identifiers, IP address, and device information in order to serve and measure ads. Where this involves cross-app tracking, you will be shown Apple's separate App Tracking Transparency permission prompt before any tracking-based identifier is used. If you never enable ads, none of this applies to you.

10. Location Services

VatSight does not request access to your device's location. The app does not use CLLocationManager or any GPS / network location API. The map is centred based on your previously saved map position, which is stored only on-device.

11. iCloud Backup

Your VatSight preferences (stored via SwiftData) may be included in iCloud backups if you have iCloud Backup enabled on your device. This is handled entirely by iOS and subject to Apple's privacy policy. The VATGlasses cache file is stored in the Documents directory and may be included in iCloud backups; it contains only public airspace data (no personal information).

12. App Data Retention and Deletion

All on-device data (preferences, CIDs, cache) is stored only on your device. You can delete all stored data at any time by uninstalling VatSight. The app contains no server-side user accounts, so there is no app data to delete from any server.

The VATGlasses sector data cache can also be cleared from within the app via Settings → VATGlasses Sector Data → Redownload.

13. Children's Privacy

VatSight is not directed at children under 13. The app collects no personal information from any user, including children. The optional advertising feature described in Section 9 should only be enabled by adult users; VatSight does not knowingly direct ads at children. You must be 13 or older to subscribe to the newsletter. If you believe a child under 13 has subscribed, contact us and we'll delete their details.

14. Security

VatSight's on-device data is stored by SwiftData, which uses the standard iOS data protection mechanisms. All network requests use HTTPS (TLS). The app does not store or transmit any authentication credentials.

The website and newsletter pages are only served over HTTPS. Access to the newsletter's admin area is limited to the developer and protected by a strong password, and the software is kept up to date.

15. Your Rights

Under UK data protection law, you have the right to:

• access the personal data we hold about you and get a copy of it
• rectify it if it's wrong or incomplete
• erase it
• restrict or object to how we use it
• data portability, which means getting your data in a machine-readable format
• withdraw consent at any time, for example by unsubscribing from the newsletter

To use any of these rights, email contact@marcelmarzec.com. We'll reply within one month. There's no charge.

If you're unhappy with how we've handled your data, please contact us first so we can put it right. You also have the right to complain to the UK's data protection regulator, the Information Commissioner's Office (ICO), on 0303 123 1113.

16. Changes to This Policy

If VatSight's data practices change, this policy will be updated and the "Last updated" date at the top will be revised. If a change significantly affects how we use newsletter subscribers' data, we'll also tell subscribers by email before it takes effect.

17. Contact

If you have any questions about this privacy policy or VatSight's data practices, please contact:

Marcel Marzec
contact@marcelmarzec.com

VatSight (the app, website and newsletter) is an independent project and is not affiliated with, endorsed by, or sponsored by VATSIM, Mapbox, VATGlasses, or phpList.