Privacy Policy for SK4
Last updated: July 31, 2026
SK4 is developed by the SK4 Team ("we", "us"). This Privacy Policy explains what personal data is collected when you use the SK4 app, how it is used and shared, and your rights under the General Data Protection Regulation (GDPR).
Data Controller
SK4 Team
What Data We Collect and Why
Account Data
When you create an account, we collect:
| Data | Source | Purpose |
|---|---|---|
| Email address | Apple or Google sign-in | Account identity; used to generate your profile avatar |
| Full name | Apple sign-in (first sign-in only) | Initial display name |
| Username | Auto-generated from your email; you can edit it | In-app identity |
| Bio (optional) | You enter it | Public profile |
| Location text (optional, e.g. "Copenhagen, Denmark") | You enter it | Public profile — this is plain text, NOT your GPS position |
Location Data (GPS)
SK4 requests your device's location while the app is in the foreground ("when in use"). Your coordinates are used in two ways:
- Live flight search — Your coordinates are sent to our server to find aircraft flying near you in real time. They are not stored beyond the duration of your session.
- Flight spot records — When you log a flight spot, your coordinates at the moment of spotting are permanently stored as part of that spot record.
We deliberately reduce the precision of your position. Before your coordinates leave your device, they are rounded to two decimal places — an area of roughly one kilometre. Our server rounds them again on arrival, so neither our systems nor anyone we share them with ever sees your exact position. That is precise enough to find aircraft near you and to remember roughly where you were standing, but not precise enough to identify your home or workplace. Your full-precision position is only ever used on your own device, for example to centre the map or to point the augmented-reality view at an aircraft — it is never transmitted.
Rounding applies to spots logged from the release that introduced it onward; spots you logged before that keep the precision they were stored with, and you can delete any spot at any time.
Flight Spot Records
Each spot you log stores: date and time, aircraft registration, airline, callsign, aircraft type, your rounded GPS coordinates (see above), the aircraft's GPS coordinates and heading, any personal note you wrote, and an optional photo.
Spot Photos
If you add a photo to a spot, the image is uploaded to and stored on cloud storage located within the EU.
Authentication Tokens
Your login tokens (access token, refresh token) are stored securely on your device using your operating system's secure credential storage. They are never synced to the cloud.
Usage Analytics
To understand how SK4 is actually used and where it falls short, we record a small set of product events — for example that you logged a flight spot, opened a screen, completed a collection, or that a sign-in failed. Each event carries the platform (iOS, web, or our server), the app version, and a few non-identifying details about the action itself, such as whether a spot was logged from the live list or in AR.
- Events are linked to your SK4 account ID. They are not linked to any advertising identifier — SK4 never requests the iOS advertising identifier (IDFA).
- We do not record the content of your notes, your photos, or your GPS coordinates as analytics data.
- We do not follow you outside SK4. No analytics data is collected on any website or app that is not SK4 itself.
- You can turn this off at any time under Settings → Privacy & Data → Share usage data in the iOS app, or Profile → Privacy & Data → Share usage data in the web app. The setting is shared across both. When it is off, neither the app nor our server records any product events for you, and the rest of SK4 keeps working exactly as before.
Analytics are processed on our behalf by PostHog (see Third-Party Services below), on servers in the EU.
Lawful Basis for Processing (GDPR)
Processing of your account data, flight spots, spot photos, location data and authentication tokens is based on the performance of the contract with you (Article 6(1)(b) GDPR) — all of it is necessary to deliver the SK4 service you registered for.
Usage analytics — and only usage analytics — is instead based on our legitimate interest (Article 6(1)(f) GDPR) in understanding how SK4 is used so we can fix problems and decide what to build next. We have assessed that this processing is limited, expected, and low-risk to you: no advertising, no profiling that affects you, no sharing with third parties beyond our processor, and a 12-month retention limit.
You have the right to object to this processing at any time under Article 21 GDPR. You do not need to contact us to do so — turning off Share usage data (under Settings → Privacy & Data in the iOS app, or Profile → Privacy & Data in the web app) is a complete and immediate exercise of that right.
Third-Party Services
Services We Host Ourselves
We operate our own authentication system, hosted on servers located in the EU, which acts as an identity broker between SK4 and Apple/Google sign-in.
External Services
- Google — If you sign in with Google, Google's own Privacy Policy applies to the consent flow. We receive your email and name from Google as part of the sign-in process.
- Apple — If you sign in with Apple, Apple's own Privacy Policy applies. We receive your email and name from Apple (name is shared by Apple on the first sign-in only).
- Gravatar (gravatar.com) — A hash of your email address is used to construct a Gravatar profile picture URL. Your device makes a direct request to gravatar.com to load the image. Gravatar's Privacy Policy applies.
- A third-party flight-data provider — Your rounded coordinates (latitude, longitude, and search radius) are forwarded to this provider to find nearby aircraft. Only the rounded position described above is shared — never your exact position, and never your name, email, or account details.
- A cloud storage provider (EU-based) — Stores user-uploaded spot photos and encrypted backups of our database.
- PostHog (posthog.com) — Processes the usage analytics described above. PostHog acts as our data processor under a signed Data Processing Agreement and stores the data in its EU region (Frankfurt, Germany). No data is used by PostHog for its own purposes. PostHog's Privacy Policy applies.
What We Do NOT Do
- We do not collect, store, or share your exact GPS position — it is rounded to about a kilometre before it leaves your device.
- We do not show advertising.
- We do not use advertising or cross-app tracking SDKs.
- We do not sell or rent your personal data to any third party.
- We do not track you across other apps or websites.
Data Retention
| Data | Retention |
|---|---|
| Server logs | Deleted automatically after 30 days |
| Infrastructure metrics | Deleted automatically after 30 days |
| Account data and flight spots | Retained until you delete your account |
| Spot photos | Deleted when you delete your account |
| Anonymized flight spots | Kept indefinitely (not linked to any identity) |
| Usage analytics | Deleted automatically after 12 months |
Account Deletion
You can delete your account at any time from Settings → Delete Account in the app. This action is permanent and cannot be undone. After deletion, your flight spots are preserved in anonymized form (no longer associated with you or your identity).
Your Rights Under GDPR
You have the right to:
- Access — Request a copy of the personal data we hold about you
- Rectification — Request correction of inaccurate data
- Erasure — Request deletion of your data ("right to be forgotten")
- Restriction — Request that we limit how we process your data
- Portability — Receive your data in a structured, machine-readable format
- Object — Object to processing of your personal data. For usage analytics you can exercise this yourself at any time via Share usage data (under Settings → Privacy & Data in the iOS app, or Profile → Privacy & Data in the web app).
To exercise any of these rights, contact us at contact@sk4.app. We will respond within 30 days.
You also have the right to lodge a complaint with the Danish Data Protection Agency:
Datatilsynet Website: datatilsynet.dk Phone: +45 33 19 32 00
Security
- Login tokens are stored using your device's secure credential storage, with device-only access.
- All data in transit is encrypted using TLS/HTTPS.
- Our servers and storage providers are located within the EU.
Children
SK4 is not directed at children under the age of 13. We do not knowingly collect personal data from children under 13.
Changes to This Policy
We may update this Privacy Policy from time to time. The "last updated" date at the top of this page reflects the most recent revision. Continued use of the app after a change constitutes your acceptance of the revised policy. For significant changes, we will notify you within the app.
Contact
For any questions about this Privacy Policy or your personal data:
SK4 Team
