PPL Buddy — Privacy Policy
Effective date: 13 July 2026 · Last updated: 13 July 2026
This policy explains how PPL Buddy collects and uses your personal data, under the UK GDPR and the Data Protection Act 2018.
1. Who is responsible for your data (the "controller")
The data controller is Rob Watkiss, trading as PPL Buddy (a sole trader in the UK).
- Email: hello@pplbuddy.com
- Postal address: Lionel Road North, Brentford, TW8 9QU, United Kingdom
2. What we collect, and why
| Data | What it is | Why we process it | Legal basis (UK GDPR) |
|---|---|---|---|
| Email address | Used to create your account and send your sign-in one-time codes | To provide the account and sign-in | Performance of a contract (Art. 6(1)(b)) |
| Study progress | Which sections you've viewed, practice/exam results, flashcard schedules | To save and sync your progress across devices | Performance of a contract (Art. 6(1)(b)) |
| Payment & subscription data | Handled by Stripe. We store a Stripe customer ID, subscription status, plan, and access-expiry — not your card number | To take payment and manage your subscription/entitlement | Performance of a contract (Art. 6(1)(b)) |
| Weather favourites | The ICAO codes of airfields you favourite, stored in a first-party cookie on your device | To show your chosen airfields on the weather page | Strictly-necessary/functional — see cookies (section 7) |
| Technical/log data | Standard server and security logs generated by our host (e.g. IP address, request info) | To run the Service securely and diagnose problems | Legitimate interests (Art. 6(1)(f)): security & reliability |
We verified the following in the product and they are worth stating plainly:
- We do not store your card details. Card data is entered directly with Stripe and handled by them.
- We do not use third-party analytics, advertising, or tracking. The codebase contains no Google Analytics, no ad networks, no social-media trackers, and no cross-site tracking.
- Your sign-in session is stored in your browser's
localStorage(web) or the app's secure storage (Android) — not in a tracking cookie.
3. Who we share data with (processors and sub-processors)
We use trusted providers who process personal data on our behalf, under contract. We do not sell your personal data.
| Provider | Role | Data it handles | Location |
|---|---|---|---|
| Supabase | Authentication + database (accounts and study progress) | Email, study progress, subscription/entitlement fields | the European Union (AWS eu-north-1, Stockholm) |
| Stripe | Payment processing & subscription billing | Name/email as entered at checkout, card data (held by Stripe, not us), billing/transaction records | US + global; UK/EU entities under its DPA |
| Vercel | Website & app-backend hosting | Technical/log data, and data in transit | US/global edge |
4. How long we keep your data
Account and progress data: kept while your account is active. If you delete your account (or ask us to), we delete or anonymise it within 30 days, except where we must keep some records longer by law.
Payment records: retained as required for tax/accounting purposes. These are largely held by Stripe.
Logs: kept for a limited period for security and diagnostics.
5. Your rights
Under UK data-protection law you have the right to: access your data; rectify inaccurate data; erase your data ("right to be forgotten"); restrict or object to processing; data portability; and to withdraw consent where we rely on it. To exercise any of these, contact hello@pplbuddy.com. We will respond within the statutory time limit (generally one month).
You can also delete your account and all your data yourself at any time — see Account Deletion.
You also have the right to complain to the UK regulator, the Information Commissioner's Office (ICO) — ico.org.uk — though we'd appreciate the chance to help first.
6. International data transfers
Some providers (notably Stripe and Vercel, and possibly Supabase depending on region) may process data outside the UK, including in the United States. Where that happens, we rely on appropriate safeguards such as the UK International Data Transfer Agreement / Addendum or equivalent approved mechanisms.
7. Cookies and local storage
We keep this deliberately minimal, and this was verified in the code:
- No advertising or cross-site tracking cookies.
wx-stations— a first-party functional cookie storing your favourite airfield codes (a list of ICAO identifiers) so the weather page can load them. It expires after about a year and contains no personal identifiers.- Sign-in session is stored in your browser's
localStorage(or the app's secure storage), not a cookie. It exists only to keep you signed in.
8. Children
PPL Buddy is intended for people studying for a pilot's licence and is not directed at children. The Service is for users aged 16 or over.
9. Changes to this policy
We may update this policy. Material changes will be notified by email or an in-app notice before they take effect. The "last updated" date at the top always shows the current version.
10. How to contact us / make a data request
Email hello@pplbuddy.com, or write to Lionel Road North, Brentford, TW8 9QU, United Kingdom, for any privacy question or to exercise your rights. See About & Contact.