Privacy Policy

1. Who is responsible and what this policy covers

This policy applies to KoAir on the web and in the iOS and Android mobile apps. When we say “KoAir,” “we,” or “the app,” we mean the service that lets you practice aviation communications, manage your account, and access your sessions, progress, and subscriptions.

The controller is Edel González Garcés, Calle O, Edificio 2, Piso 2, Oficina 214, 31110 Noáin (Navarra), Spain, owner of KoAir. If you use KoAir through a school, see section 6: for that data, your school is the controller.

If you have a privacy question or want to exercise your rights, email us at sim@koair.app. This is also our contact point for requests involving personal data.

2. Information we process

• Account and identity information: your email address, your name if you provide it, a non-reversibly encrypted password when you sign in with email, and the identifiers needed for Google or Apple sign-in when you choose those options.
• Profile and preference information: preferred aircraft registration, city, preferred language, and push-notification preference.
• Training information: scenarios and exercises you open, sessions started or completed, turns, transcripts, assessments, scores, experience points, progress, debriefs, and timestamps associated with your use of the service.
• Cockpit audio: your voice transmissions when you press and hold PTT or use an equivalent function during a session. Simulator response audio associated with that session may also be generated and stored.
• Subscription and payment information: active plan, subscription status, purchase channel, technical customer or product identifiers, and relevant renewal, cancellation, or expiration dates. KoAir does not store your full card number.
• Technical and security information: information needed to maintain your session, protect your account, diagnose errors, detect abuse, and support the basic operation of the web and mobile apps.
• Usage information (analytics): which screens you visit and what you do on the website and in the app, so we can understand what works and improve the product. It is collected by PostHog on its European Union instance, with text fields masked. Some sessions are recorded to see how the interface is used and where people get stuck or hit errors.
• If you use KoAir through a school: your name as your school enters it and a personal access code. Accounts created with a code only have no email address.
• Support information: information you provide when contacting us by email.

3. How we obtain this information

• Directly from you when you create an account, complete your profile, train, contact support, or purchase a subscription.
• From your device, but only when you enable a feature that requires it, such as microphone access for transmissions or push notifications if you choose to enable them.
• From third parties you select or that are needed to provide the service, such as Google or Apple for social sign-in, Stripe for web payments, and the App Store or Google Play for mobile subscriptions.
• From activity within KoAir, such as the generation of transcripts, assessments, session history, or progress states.

4. Why we use your information and our legal basis

• To create and maintain your account, identify you, and let you sign in on the web or in the app. Typical legal basis: performance of the service you request.
• To process your transmissions, transcribe audio, assess your phraseology, and generate simulated ATC responses. Typical legal basis: performance of the service and, where applicable, your consent when granting device permissions.
• To show your history, progress, scores, unlocked content, and subscription status. Typical legal basis: performance of the service.
• To charge, renew, synchronize, or verify subscriptions and resolve payment issues. Typical legal basis: performance of a contract and compliance with legal or accounting obligations.
• To send notifications when you enable them. Typical legal basis: your settings and, where required, your consent.
• To occasionally email you to ask for your opinion of KoAir, for example if you leave the trial or never start it. These are not marketing emails, and you only need to reply to ask us not to write again. Typical legal basis: our legitimate interest in improving the service.
• To prevent fraud, protect accounts, investigate abuse, resolve technical issues, and improve stability and security. Typical legal basis: our legitimate interest in operating the service safely and reliably.
• To respond to support requests or requests to exercise your rights. Typical legal basis: performance of the service, legitimate interests, and legal compliance, as applicable.

5. Who we share information with

We do not sell your personal data or share it with advertising networks to build commercial profiles about you. We do work with service providers that support specific KoAir features, and they receive only the information needed to provide those services.

• Hetzner Online (Germany): hosting of the server and database where KoAir runs.
• OpenAI (United States): transcription of your voice transmissions and AI features used in training. It receives the audio of each transmission to transcribe it; KoAir does not keep that audio in voice exercises, only the transcript and the score.
• PostHog (European Union): usage analytics for the website and the app.
• Resend (United States): account emails (verification, password, notices).
• OneSignal (United States): delivery of push notifications, if you enable them in the app.
• Google Drive (Google): database backups, encrypted on our server before upload; Google cannot read them.
• Google and Apple: if you choose to sign in through either provider, we receive the identity information that provider shares for authentication.
• Stripe: for web payments and subscription management.
• RevenueCat: to synchronize and manage mobile subscription status.
• Apple App Store and Google Play: for in-app purchases, renewals, cancellations, and validation of the subscription channel on iOS and Android.
• Weather-data and synthetic-voice providers (CheckWX, Fish Audio): they generate exercise content (METARs, tower voices). They do not receive your personal data.

6. If you use KoAir through your flight school

Some flight schools buy KoAir seats for their students. In that case, the school signs you up, usually with just your name, and gives you a personal code to sign in. For your school account and your activity, your school is the controller and KoAir acts as its processor, under Article 28 of the GDPR and the contract we sign with the school.

• What your school sees in its panel: your name, which lesson you are on, completed lessons with their score and attempts, your streak, practice time, when you last practised, and the text of your transmissions in voice exercises (what you said versus what was expected). It does not see the audio, which is not stored, or any payment information.
• What we do not do with these accounts: we do not send you marketing emails or use your data for advertising. We do collect the usage analytics described in section 2, which help us detect errors and improve KoAir.
• When the licence ends: your account and progress are kept so you can continue if the school renews or if you subscribe on your own; if you subscribe, KoAir becomes the controller of your account. If your school or you ask for deletion, we delete it within 30 days.
• Your rights: you can exercise them with your school or by emailing sim@koair.app; if you contact us, we coordinate with your school.
• If you are under 18, your school is responsible for having permission from your parents or guardians where required.

7. Device permissions and your controls

• Microphone: KoAir does not need microphone access for general navigation or account management. It is requested only for voice-transmission features in the cockpit. You can revoke access at any time in your device settings.
• Push notifications: these are optional. You can enable or disable them from your profile and from your device's operating-system settings.
• Location: KoAir's core functionality does not depend on your location. If a specific mobile build requests location for an optional device feature, permission will be requested separately and you may decline without losing basic access to the service.
• Social sign-in: you can use an email address and password or, when available, Google or Apple. If you no longer want to use a social provider, you can stop signing in through it and contact us for help reviewing information linked to your account.
• Website: we use cookies and technical storage that are necessary to maintain your session and remember basic preferences, such as language, plus PostHog storage for the usage analytics described in section 2. They are not used for third-party behavioral advertising.

8. How long we retain information

We aim to keep each type of information only as long as needed. Retention periods may vary based on the type of information and whether a legal obligation, security issue, or pending request applies.

• Account and profile information: while your account remains active or while needed to provide the service.
• Sessions, transcripts, assessments, progress, and training audio: while they remain part of your KoAir history, or until you delete your account or request deletion, unless limited retention is required for security, fraud prevention, or legal compliance.
• Subscription, billing, and payment-event information: during the commercial relationship and for any additional period required by tax, accounting, or claims-management rules.
• Technical and security logs: for limited, reasonable, and proportionate periods needed to investigate errors, abuse, or incidents.
• Backups: the database is backed up twice a day. Server copies are deleted after 14 days; off-site copies are kept encrypted and used only to restore the service after a serious failure. Deleted data may remain in them, encrypted and inaccessible, until those copies are deleted.
• School students: as described in section 6 (kept after the licence unless the school or the student asks for deletion; in that case, within 30 days).

9. Account and data deletion

You can delete your account directly from your KoAir profile. Account deletion is intended to be permanent: it removes your access and deletes operational data associated with your account from the active service, including sessions and runs linked to your user profile.

If you cannot access your account or prefer to use a public page, you can submit a request at https://koair.app/en/delete-account to delete your account or specific information.

If we must retain certain information for legal, tax, security, or fraud-prevention reasons, we will keep it only for the strictly necessary period and solely for that limited purpose.

10. Your rights

Where applicable law grants you rights over your personal information, you may request access, correction, deletion, restriction, objection, or portability, as appropriate. You may also withdraw consent you have given, for example by revoking device permissions or contacting us about a specific processing activity.

To exercise these rights, email sim@koair.app from the address associated with your account or provide enough information for us to locate it.

11. Security

• We protect data in transit through secure connections and apply reasonable technical and organizational measures to limit unauthorized access.
• Passwords are not stored in plain text.
• We restrict internal access to information to situations where it is needed to operate, maintain, or protect KoAir.

12. International transfers

Some service providers may operate outside your country or the European Economic Area. When this occurs, we seek to rely on appropriate safeguards, such as contractual clauses, supplementary measures, or the legal framework applicable at that time.

13. Children

KoAir is intended for pilots and flight students and is not designed as a service directed to children. If we learn that an account was created improperly by someone who cannot provide valid consent under applicable law, we may restrict or delete it.

Schools may sign up students under 18; in that case, the school guarantees it has permission from their parents or guardians where required (section 6).

14. Changes to this policy

We may update this policy to reflect changes to the product, our providers, or legal requirements. When a change is significant, we will try to communicate it clearly in the app or on the website before or when it takes effect.

Privacy contact

For questions, rights requests, or any request involving personal information, email us at: