Sky Matrix keeps your data on your device and uses outside services only where a feature genuinely needs them. Here's exactly what stays local, what leaves, and why.
What stays on your device
Your flight data lives only in your browser/app storage on your device: the OFP text you load and every field you type (times, weights, crew, notes); your PIN, stored only as a one‑way hash; your biometric enrolment, which stays in your device's secure hardware and is never sent to us; documents you add to the in‑app DOCS store; and your saved announcements. None of this is uploaded to any Sky Matrix server. Clearing the app's data removes it.
What leaves the device, and why
A few features need the internet and send the minimum data required: Licensing & trials — your Device ID and email are sent to our licensing service to issue or validate an access code; AI OFP reading & announcements — when you tap these, the relevant OFP or template text is sent to be processed and returned; Aircraft, weather & NOTAM lookups — a flight number/registration or airport code is sent to the relevant provider; Payments — handled entirely on the checkout provider's site; we never see or store your card details. Anonymous usage milestones — so we can see where people get stuck, the app records that a step happened (app opened, OFP loaded). Only your Device ID and the step name are sent — never OFP content, route, times or any flight data.
Third‑party services
Six providers, each used only for the feature you invoke. Full detail on the Privacy & Security page.
Show what each provider receives
| Service | Purpose | Data shared |
|---|
| Cloudflare (Workers) | Licensing, trials, AI/data endpoints | Device ID, email, OFP/announcement text |
| Anthropic (Claude) | AI OFP reading & announcements | OFP / template text you submit |
| Flightradar24 | Aircraft type & route lookup | Flight number or registration |
| Lemon Squeezy | Checkout & billing (merchant of record) | Payment & contact details (with them, not us) |
| Cloudflare (Workers) | Anonymous usage milestones | Device ID + a step name (app opened / OFP loaded). No OFP content or route. |
| Resend | Sending your access‑code emails | Your email address |
| Cloudflare (Workers) | Hosting the app and website | Standard web request logs |
Each provider processes data under its own privacy policy. We share only what the feature you invoked requires.
Security model
Licences are protected with an ECDSA P‑256 digital signature — only our server holds the private key, so codes can't be forged, and each code is bound to a single device (a subscription covers two devices, so you hold one code per device). Your PIN is stored as a salted one‑way hash; biometric unlock uses the platform authenticator (WebAuthn) and never exposes your fingerprint/face to the app. The app is served only over HTTPS, and sensitive data is never placed in URLs. Honest caveat: any client‑side gate deters casual access but is not a guarantee against a determined attacker — use a strong PIN and keep your device secured.
Your choices
You can stop all outbound data by simply not using the online features — the core briefing works offline. To delete your data, clear the app's storage on your device. For a licence transfer or a data request, email admin@skymatrix.biz. Questions about privacy or security: support@skymatrix.biz.
Full details, including the Android APK checksum for safe sideloading, are on the Privacy & Security page.
