FlyRecap Privacy Policy

Effective date and last updated November 3, 2026

Document version: 2026-11-03.1

This Privacy Policy explains how FlyRecap LLC collects, uses, discloses, retains, and protects personal information when you use the FlyRecap application, website, accounts, subscriptions, and related services.

FlyRecap is designed around private flight-training reflection and controlled student-instructor sharing. We do not sell personal information, use it for cross-context behavioral advertising, or use voice recordings to create biometric voiceprints. Because recordings, transcripts, and training information can be sensitive, review the sharing controls carefully and record other people only with legally required permission.

Contents

1 Scope and Controller

This Policy applies to the FlyRecap mobile application, FlyRecap website, support, and related services (collectively, the Service). It applies to Students, CFIs, prospective users, and website visitors. It does not apply to third-party sites, services, flight schools, instructors, or organizations that process information under their own policies.

The Service is offered only to individuals located in the United States who are participating in or supporting U.S.-based flight training. It is not offered or directed to individuals outside the United States.

FlyRecap LLC is the controller or business responsible for the personal information described in this Policy, except when another party independently determines how it will use information it receives from you. FlyRecap is organized in Minnesota and may be contacted using Section 21.

This Policy is a disclosure of our practices and does not waive or limit rights that cannot be waived under applicable law. The Terms of Use govern use of the Service.

2 Information We Collect

The categories below describe the current app and related account services. Some information is optional or exists only when you use the corresponding feature.

2.1 Accounts Profiles and Guardian Approval

Our authentication provider handles passwords and authentication credentials. Passwords are not made available to FlyRecap in readable form. Sessions, recovery links, and security tokens are used to sign you in and recover or secure an Account.

Age eligibility is based on the age bracket declared during account setup rather than a requirement to supply an exact birth date. An Account for a user age 16 or 17 remains restricted pending guardian approval. The guardian receives a single-use, time-limited link and submits the information and confirmations described above. Guardian records and legal or AI-permission decisions are not ordinary profile fields disclosed to connected instructors or students.

Profile photos are stored in private storage. Your photo and limited training context may be available to active connections under Section 6. Your home airport is entered by you; the app does not obtain it from device location. The current app does not request a biography, Social Security number, or instructor certificate-number verification.

2.2 Training Content and Device-Only Information

We collect content you enter, record, import, upload, receive from an instructor, or direct the Service to share. A CFI may supply ratings, feedback, voice notes, and amendments about the intended student's lesson. These are linked to the relevant accounts and lesson.

Recaps and transcripts are not official pilot logbooks, endorsements, or required training records. Maintain required aviation records independently.

Some convenience data, including saved Between Flights questions, review completion state, local reminder preferences, drafts, and pending synchronization items, can remain on your device. Not every local item is restored on another device.

2.3 Information Outside the App's Core Needs

The app does not request device GPS location, address-book contacts, health records, or financial-account credentials. Do not put Social Security numbers, payment credentials, medical records, or other unnecessary sensitive information in recordings, notes, photos, or support messages. If you include it, it remains part of the submitted content and may reach the providers or recipients needed for that feature.

FlyRecap does not create biometric voiceprints, identify people by vocal characteristics, or use voice to authenticate an Account. Audio and transcripts can nevertheless identify you or another person. We do not remove every name or identifier from ordinary recordings and text before processing them.

3 Sources of Information

• From you. Registration, profile, permissions, recordings, imports, notes, training responses, milestones, support, and privacy requests.

• From a parent or legal guardian. Contact, relationship, approval or decline, electronic-signature, and consent-record information submitted through the minor approval process.

• From other users. Invitations addressed to your email, connection requests, CFI feedback and amendments, shared training information, reports, and connection changes.

• Automatically. Network, authentication, purchase, delivery, processing, quota, security, and error events generated when the Service or its providers are used. Local diagnostic information may also be included if you choose to submit a support report.

• From platforms and providers. Subscription entitlements and limited transaction data from Apple and RevenueCat; authentication, storage, delivery, and system events from infrastructure providers.

• Created by FlyRecap and its processors. Transcripts, supported training-topic observations, milestone determinations, progress patterns, handoff summaries, and other outputs derived from the information above.

4 How We Use Information

We use personal information for the following purposes:

• create, authenticate, recover, maintain, and secure Accounts;

• determine age-based eligibility, send and administer parent or guardian approval requests, document approval or withdrawal, and activate or restrict Accounts for users age 16 or 17;

• provide recording, import, transcription, recap, reflection, Between Flights, milestone, ACS progress, training-insight, connection, handoff, CFI feedback, notification, export, and subscription features;

• sync and restore server-backed Account and training information across supported devices and reconcile local access with current server permissions;

• display information to Connected Users only as directed or permitted by the applicable connection, sharing, handoff, or instructor feature;

• identify shared recaps that may need instructor attention and surface recurring themes or progress supported by information the CFI is already authorized to view;

• process purchases, verify entitlements, restore purchases, administer paid access, and understand subscription and purchase performance;

• communicate about security, password recovery, account activity, feedback, connections, feature events, updates, and support;

• check instructor feedback and amendments with automated content moderation, withhold content pending review, process reports, enforce blocks, prevent blocked reconnection, and investigate abuse, impersonation, harassment, fraud, unlawful recording, and security incidents;

• personalize the Service using your training stage, preferences, and activity;

• debug, maintain, analyze, and improve reliability, usability, accessibility, and product performance;

• enforce the Terms of Use and protect FlyRecap, users, and others;

• comply with law, legal process, tax, accounting, and regulatory obligations; and

• create aggregate or deidentified information for analytics and product improvement, provided we do not attempt to reidentify it except to test our deidentification methods or as permitted by law.

We use account and training data to provide the features you request and to operate and secure the Service. We request separate device permissions and optional AI permission as described below. Required instructor-feedback moderation is a separate disclosure under Section 5.2. Nothing in this Policy replaces consent or another legal basis that applicable law requires.

5 Audio Transcription and Artificial Intelligence

5.1 Optional Transcription and Training Analysis

OpenAI is FlyRecap's third-party transcription and AI-analysis provider. With account permission, our backend sends recorded or imported recap audio and instructor voice notes to OpenAI for transcription. It can send typed recap answers, instructor feedback or amendments, or portions of their transcripts for analysis of supported training topics, strengths, and focus areas. The results include transcripts, topic labels, and short supporting excerpts. Not all summaries or progress features use a separate AI request; many are calculated by rules in the app.

Before optional transcription or analysis, the app presents a notice and records the notice version, your decision, its source, and the server timestamp against your Account. Permission applies across devices. You may decline or withdraw it in Settings → Legal & Privacy → AI Processing. Turning it off stops new authorized transcription and analysis; a request already underway may finish. It does not erase transcripts, observations, or content already created. Delete the relevant content where controls are available or contact us under Section 14.

The student's account choice controls optional processing of student recap answers. The instructor's account choice controls optional processing of that instructor's feedback and amendments, including information about the student. Declining AI processing for your own Account does not change another author's separate choice for content they lawfully submit, or turn off the required feedback checks below.

With optional AI off, you can still use manual content, sharing, and retained playback subject to normal role and subscription restrictions. Recording requires microphone permission; refusing microphone access prevents new microphone recordings but does not prevent typing or supported audio import. Turning AI permission on later may automatically process saved student answers awaiting transcription, analysis, or retry. Instructor voice feedback needing a transcript remains pending until transcription is permitted and required safety checks succeed. Previously transcribed feedback can still be checked under Section 5.2.

The transcription and training-topic requests do not add your account email, photo, subscription details, or internal account identifier to the content sent to OpenAI. However, the submitted words or audio can contain names, contact details, and other identifying information. Ordinary transcription and analysis do not automatically redact all such information.

5.2 Required Instructor Feedback Moderation

When a CFI submits feedback or an amendment, FlyRecap sends the text needed for an OpenAI moderation check before making the feedback available to the student. The check can include the CFI's display name, typed feedback or voice transcript, and skill or rating labels. This check runs even when optional AI processing is off. If you do not want that processing, do not submit instructor feedback or amendments through the feature. A new voice note cannot be delivered without a usable transcript and the required check. Flagged content is withheld, and a failed or unavailable check can leave the content pending. FlyRecap stores moderation status, categories, timestamps, and related processing events for administration and safety.

The optional AI switch does not turn off this feedback-moderation service. Accepting a Privacy Policy or granting one user's AI permission does not give permission to record or share another person unlawfully.

5.3 Provider Handling and Output Limitations

We use OpenAI's business/API services and do not authorize our service content to be used to train general-purpose AI models. API data is not used for model training by default. Provider retention differs by endpoint and account controls. For example, text-analysis requests may be retained in abuse-monitoring logs for up to 30 days under the provider's default terms, with possible security or legal exceptions. This is separate from FlyRecap's own storage and deletion rules; deleting a FlyRecap recording does not itself erase a provider log. We do not promise that all provider processing has zero retention.

Authorized personnel and providers may access relevant content when reasonably needed for support, security, abuse review, legal obligations, or operating the requested feature, subject to applicable confidentiality and data-protection obligations.

Transcription, topic classification, summaries, and moderation can be wrong. Review outputs and discuss training questions with your instructor. FlyRecap does not use these outputs to make legal decisions about solo eligibility, endorsements, certification, checkride readiness, employment, insurance, credit, housing, or another legal or similarly significant matter.

6 Student CFI Connections and Sharing

A Student Account currently supports one active CFI connection; a CFI can support multiple students. Either side can initiate a request, and the recipient must accept before the connection becomes active. Entering an exact email address may reveal whether it belongs to a matching Student or CFI Account and limited identifying information needed to request a connection. A pending invitation does not grant access to private lesson content.

6.1 Invitations to People Without an Account

A user can enter an email address to invite someone who does not yet have a FlyRecap Account, such as a CFI inviting a student or a student inviting a CFI. If you receive an invitation, FlyRecap holds your email address, the inviter's name and role, and the status of the invitation (sent, accepted, declined, or removed). We use that information only to deliver and administer the invitation, to show the inviter its status, and to prevent abuse such as repeated or excessive sending. We send the invitation through our email provider (see Section 9). We do not add your address to a marketing list, and an invitation does not give anyone access to your information because you have no Account. You can ignore the message, or email hello@flyrecap.com to ask us to delete your address from invitation records and to stop further invitations. See Section 12 for how long these records are kept.

Ordinary connection sharing and a Training Handoff are separate grants. Review and revoke existing Handoffs explicitly rather than assuming that disconnecting or unsharing one recap withdraws every handoff. Blocking restricts access as supported by the Service. After access changes, the server enforces current permissions and the app reconciles its authorized view on a successful synchronization. Revocation cannot recall content already viewed, copied, exported, or stored outside FlyRecap. It does not erase delivered instructor feedback from the student's own history.

7 Progress Handoffs Milestones and Inferences

FlyRecap uses lesson content, transcripts, instructor feedback, selected or CFI-confirmed task statuses, and app activity to produce training observations, milestones, trends, review activities, CFI Pulse indicators, and continuity summaries. Optional AI extracts supported topics and excerpts from words. App rules also calculate progress and assemble activities or summaries from available training data. Some milestones are generated from app events; others are entered or confirmed by a user.

Between Flights may change the activity highlighted to a student according to calendar time since the most recent recap and the availability of real supporting data. It does not mean FlyRecap knows when the student's next flight or lesson is scheduled. CFI Pulse may surface new shared recaps, unanswered shared recaps, recurring themes, or progress based only on information the CFI is authorized to view.

ACS-related percentages, task statuses, and history are organizational training-progress features. Where a status is identified as CFI-confirmed, it reflects information submitted through the Service by an authorized CFI; it is not an FAA determination.

A student can create a Handoff containing a summary alone or selected full lessons, prior feedback text, and individual student recordings. A summary may reflect broader training history even when the underlying full lessons are not included. The receiving CFI does not receive structured prior-instructor identity fields or raw prior-instructor voice feedback through the Handoff. Known prior-instructor names are redacted from handoff text and summaries; recognizable email addresses and phone numbers are also redacted from prior-feedback text. Unknown names, unusual formats, context, and student-supplied identifiers may remain. Student audio selected for sharing is not redacted. Review the content and obtain any required permission before sharing. Removing identity fields does not guarantee legal anonymity.

Handoffs remain available while active until revoked or otherwise restricted; the student retains a record of revoked Handoffs. Revoking a Handoff does not delete the student's underlying content. A valid Handoff may continue to include retained prior-feedback text after the prior CFI deletes an Account, subject to applicable rights and deletion obligations.

These outputs are inferences and organizational aids, not official evaluations. A label such as Meets ACS Standard reflects the input or criteria used in the Service and does not itself establish compliance with an Airman Certification Standard, legal proficiency, solo eligibility, endorsement, or checkride readiness.

We do not use these inferences for targeted advertising or for decisions producing legal or similarly significant effects. You may correct the underlying information where the Service permits, and generated outputs may change when the source data changes.

8 How We Disclose Information

We may disclose personal information in the following circumstances:

• At your direction. To Connected Users or other recipients when you use a sharing, connection, export, or communication feature.

• To service providers. To companies that perform hosting, authentication, private storage, transcription, AI analysis or moderation, subscription management and purchase analytics, notifications, email, security, or support functions for FlyRecap.

• For safety and integrity. When reasonably necessary to detect or respond to fraud, abuse, security threats, unlawful activity, violations of our Terms, or danger to a person.

• For legal reasons. To comply with law, subpoena, court order, regulatory request, or other valid process; protect legal rights; or establish, exercise, or defend claims.

• In a business transaction. In connection with due diligence, financing, merger, acquisition, reorganization, bankruptcy, receivership, or sale of assets, subject to confidentiality and applicable notice obligations.

• With professional advisers. To attorneys, accountants, auditors, insurers, and similar advisers bound by duties of confidentiality.

• In aggregate or deidentified form. For product, research, business, or reporting purposes where the information cannot reasonably be linked to an individual.

The current app does not provide public lesson posting or a general school-administrator dashboard. Listing a flight-school name in a profile does not automatically give that school access to private lessons. An instructor or school that receives information at your direction may separately retain or use it under its own responsibilities and policies.

9 Service Providers

The current app and account-service integrations include:

• Supabase: account authentication, database records, private audio and avatar storage, backend functions, authorization, operational logs, and scheduled processing or cleanup.

• OpenAI: audio transcription, training-topic analysis, and instructor-feedback moderation, with the data and choices described in Section 5.

• RevenueCat: App Store purchase validation, account-linked entitlements, subscription history, restores, and subscription and purchase analytics. The app uses an anonymous RevenueCat identifier at startup and supplies the FlyRecap account identifier after sign-in so purchases can follow the Account. We do not send lesson audio, transcripts, or feedback to RevenueCat for subscription administration.

• Apple: App Store distribution and billing, system photo and file selection, and Apple Push Notification service (APNs). Remote alerts contain notification text and limited routing identifiers, such as a lesson or milestone identifier, rather than full private recaps or recordings. Alerts can appear on the lock screen according to device settings. Some training reminders are scheduled locally on your device.

• Resend: transactional connection-invitation and parent or guardian approval emails. It receives the recipient address and the email contents, which can include an inviter's or student's name, the purpose of the request, and an invitation or approval link. Email delivery events and message identifiers may be retained to administer delivery. Do not forward private approval links.

Website hosting, website forms, and support email can involve separate website or email providers; they do not receive private in-app training content merely because they host the public site. The website's cookie and browser-storage practices are addressed separately in Section 11.

Providers receive information needed for their functions under applicable service and data-protection terms. We require providers acting for us to protect the information and use it for authorized purposes. Provider processing may occur in the United States or other locations where they or their subprocessors operate. We update this Policy when a material change in providers changes the processing described here. The current native app does not include a separate advertising network, behavioral-analytics SDK, or automatic crash-reporting SDK.

10 Sale Targeted Advertising and Profiling

FlyRecap does not sell personal information for money or other valuable consideration and does not share personal information for cross-context behavioral advertising as those terms are defined under applicable U.S. state privacy laws. We do not use third-party advertising networks in the Service and do not allow analytics providers to build cross-app or cross-site advertising profiles from FlyRecap data.

FlyRecap does not profile users in furtherance of decisions that produce legal or similarly significant effects. If these practices change, we will update this Policy, provide required notice, and offer required opt-out or consent controls before the new practice begins.

11 Device Permissions Cookies and Similar Technologies

11.1 Microphone Selected Photos and Files

Microphone access is requested for recording student recaps or instructor voice notes. Without it, the app cannot make new microphone recordings; typed content and supported file import remain available under normal access rules. Adding a profile photo uses the system photo picker to receive the image you select, rather than giving FlyRecap access to your entire photo library. Supported audio import uses the file you choose. The current app does not request camera, GPS, or address-book access. You control device permissions in iOS settings.

11.2 Notifications

Notification permission is optional. The app supports feedback, instructor activity, lesson recap or study reminders, and milestone alerts. Remote notification registration associates an APNs token, app version, and environment with the signed-in Account. Preferences determine the alerts you request; some preferences and reminder schedules are local to your device. Use the app's notification preferences or iOS settings to change alerts and lock-screen previews. Disabling push alerts does not stop necessary account, guardian-approval, recovery, or invitation emails.

11.3 App Storage and Website Cookies

The native app uses local files, preferences, authentication storage, and Supabase and RevenueCat SDK storage for account sessions, purchases, offline content, preferences, and synchronization. These are distinct from browser cookies. The app does not include an advertising identifier integration or cross-app advertising tracker. Operational records and subscription analytics described above are not a general recording of all screen activity.

When you visit the website or open an external page, the website host receives ordinary browser request information, such as IP address and browser details. Website functionality and security can involve essential cookies or similar browser storage. Any optional website cookies or analytics are separate from native-app permissions and are governed by the website's applicable cookie notice and preference controls. Browser settings can also limit cookies. An in-app AI choice does not serve as website-cookie consent. Third-party pages opened from a link have their own policies and controls.

We do not use the Service's data for cross-context behavioral advertising. Where applicable law requires recognition of an authorized universal opt-out signal for covered processing, we honor it. Browser Do Not Track signals do not have a single uniform standard.

11.4 Local Copies and Synchronization

Account-scoped training files, drafts, original recordings, downloaded audio, profile images, and queued writes can be stored within the app's device container. The app relies on iOS device protections and authenticated server access; we do not promise a separate layer of app-specific encryption for every local file or end-to-end encryption that would prevent necessary server processing.

Sign-out clears session playback caches and access to the signed-in view, but is not a request to delete the Account or every original local file. Some account-scoped training data and original recordings can remain on a signed-out device for later sign-in. Following confirmed Account deletion, the app attempts to clear that Account's local training data, saved review questions, queued writes, profile-image cache, and known recordings on the device completing deletion. Another offline device, an export, or a device backup may retain copies.

Server permissions govern connected access. The app reconciles cached CFI-visible material after a successful authorized synchronization; an offline device may not reflect a recent access change immediately. Independently exported files and third-party copies are outside that synchronization.

12 Data Retention

We retain information for the purposes described in this Policy, including account services, user-directed training history, delivery, security, abuse review, disputes, and applicable legal or accounting obligations. Different records have different retention rules; subscription cancellation, deleting a recording, revoking sharing, and deleting an Account are separate actions.

Scheduled cleanup and deletion retries require the relevant services to be available and can be delayed. A deletion request can remove some records before all file cleanup has finished. Audio references are cleared only after the Service confirms the stored object is absent. Exported files, screenshots, independently retained recipient copies, and device backups are not automatically recalled.

13 Account Deletion and Content Deletion

Use Settings → Legal & Privacy → Delete Account, the available account-menu deletion control, or email hello@flyrecap.com. In-app deletion attempts server cleanup first and clears the completing device's known account data after success. File removal or other cleanup can fail and require retry; some records may already have been removed even if the app reports that deletion could not be completed. A pending cleanup is not a promise that the Account is unchanged. Contact us if deletion does not complete. Verified support requests are handled within applicable legal time limits.

13.1 Student Account and Recording Deletion

Student Account deletion removes or unlinks the student's profile, recaps, answers, stored student audio, progress, milestones, Handoffs, connections, and other associated records from active systems, subject to lawful exceptions. Instructor feedback associated only with the deleted student's lessons is removed with those lesson records, including linked voice files where they are not validly used elsewhere.

Deleting an individual student recording through Settings → Recordings & Privacy removes its audio without deleting its transcript or the lesson. Deleting a full recap removes the associated lesson content as the control explains. Merely turning off AI, unsharing a recap, revoking a Handoff, signing out, or canceling a subscription is not the same as deleting the underlying content. For information without an individual deletion control, contact us under Section 14.

13.2 CFI Account Deletion

CFI Account deletion removes or unlinks the CFI's authentication record, profile, avatar, active relationships, and owned raw voice files. Feedback text and transcripts already associated with a student's training record, dates, ratings, amendments, and CFI-confirmed progress can remain for continuity, subject to applicable law. The author fields are cleared and the source is shown generically, such as Former CFI. Relevant text may also remain in student-authorized Handoffs as Prior CFI Feedback; prior-instructor raw voice is not included in a Handoff.

Removing structured author identifiers does not automatically remove names or identifying details written or spoken into the retained transcript or note. Such text is not guaranteed to be anonymous. Contact us to request review, correction, or deletion of identifiable content. Another user's training-history interest does not override nonwaivable privacy rights.

13.3 Exceptions Provider Records and External Copies

Deletion can be limited where information must or may lawfully be retained for security, fraud or abuse review, a dispute, legal process, tax or accounting duties, or another recognized legal purpose. Recipient copies already exported outside FlyRecap and restricted backups may remain as described above. Data is treated as deidentified only when applicable deidentification requirements are met, not merely because a visible name field was removed.

Apple, RevenueCat, email providers, and AI providers may maintain records under their own applicable retention rules. We handle requests concerning providers acting for us as required by law, but cannot promise immediate deletion of every provider log, independent transaction record, device backup, or previously received email.

Deleting a FlyRecap Account or uninstalling the app does not cancel an App Store subscription. Cancel renewal separately in Apple Account subscription settings. Uninstalling the app also does not delete the cloud Account or its training history.

14 Your Privacy Rights and Choices

Depending on where you live and subject to legal exceptions, you may have the right to:

• confirm whether we process personal information and access categories or copies of it;

• correct inaccurate personal information;

• request deletion of personal information, including identifying information in retained instructor feedback, subject only to exceptions that applicable law permits;

• obtain information you provided in a portable format where technically feasible;

• obtain a list of specific third parties to which personal information was disclosed where applicable law requires it;

• opt out of sale, targeted advertising, or qualifying profiling;

• withdraw consent for future optional processing;

• use available connection, block, report, notification, audio, and sharing controls;

• appeal a refusal to act on a request; and

• exercise rights without unlawful discrimination or retaliation.

You do not need an Account to make a request. For example, someone who received an invitation can ask us to delete their email address from invitation records.

Use available in-app settings or email hello@flyrecap.com with the subject Privacy Request. Identify the right you want to exercise and the Account email. We may verify identity using information already associated with the Account and may deny or limit a request where we cannot verify it or an exception applies. An authorized agent may submit a request where law permits, subject to proof of authority and identity verification.

For a user age 16 or 17, a parent or legal guardian may also contact hello@flyrecap.com to withdraw approval, request review or correction of guardian approval information, or assist with a privacy request, subject to reasonable identity and relationship verification and the teen user's rights under applicable law. Withdrawing approval may require restriction, suspension, or deletion of the teen user's Account, subject to Section 13 and permitted retention.

Where applicable, we respond within 45 days and may extend once when reasonably necessary after providing notice. Requests are generally free, although law may allow a reasonable charge or denial for manifestly unfounded, excessive, or repetitive requests.

To appeal, email hello@flyrecap.com with the subject Privacy Appeal within a reasonable period after our response. Include the original request and why you believe the decision should change. We will respond within the period required by applicable law and explain how to contact the appropriate regulator or state attorney general if the appeal is denied.

15 U S State Privacy Disclosures

U.S. state privacy laws apply only when their scope and thresholds are met. FlyRecap may voluntarily honor reasonable access, correction, deletion, and portability requests even when a particular law does not require it.

For Minnesota residents, the Minnesota Consumer Data Privacy Act provides qualifying consumers with rights that may include access to categories, correction, deletion, portability, opt-out rights, information about qualifying profiling, and a list of specific third parties. The statute generally applies only after specified processing or revenue thresholds and includes a small-business exclusion, but Section 14 describes how to submit a request regardless.

FlyRecap does not currently sell personal information, share it for cross-context behavioral advertising, use it for targeted advertising, or conduct qualifying profiling. Therefore, there is no current sale, sharing, targeted-advertising, or significant-decision profiling activity to opt out of. If that changes, we will add required controls before beginning the activity.

16 California Notice at Collection

For California residents, the table below summarizes the categories collected when current features are used, their purposes, and categories of recipients. It does not mean every category is collected from every person. We do not sell personal information or share it for cross-context behavioral advertising. We use sensitive information only as reasonably needed for the requested Service, security, or other legally permitted purposes.

California residents may request to know, correct, delete, or obtain a portable copy of qualifying information and may use an authorized agent. We do not discriminate for exercising rights. California Shine the Light: we do not disclose personal information to third parties for their own direct marketing purposes.

17 Children and Teen Users

FlyRecap is intended only for users age 16 and older. Users under 16 may not create or use a FlyRecap Account. We do not knowingly permit or maintain Accounts for users under 16. If we learn that an under-16 user created an Account or that we collected personal information from such a user contrary to this Policy, we will take reasonable steps to restrict or deactivate the Account and delete or deidentify the information as appropriate, subject to limited retention permitted or required by law.

Users age 16 or 17 may use FlyRecap only after a parent or legal guardian completes the approval process provided by the Service. FlyRecap generally uses an age range rather than an exact birth date where the Service allows. Until parent or guardian approval is completed, the Account may remain pending or restricted and may not use recording, training-content, connection, communication, or other protected features.

FlyRecap may send a secure approval request to the parent or legal guardian email provided for a 16- or 17-year-old user. The approval process may request the guardian's name, email address, relationship to the user, required confirmations, typed full name as an electronic signature, and an approval or decline response. We record the response, date and time, and the versions of the Terms of Use, Privacy Policy, and consent form presented so that we can administer and document the authorization.

Parent or guardian approval information is not shown to CFIs or other Connected Users. A parent or legal guardian may withdraw approval by contacting hello@flyrecap.com. Withdrawal may require restriction, suspension, or deletion of the teen user's Account. We may retain limited approval records as described in Section 12 when reasonably necessary for security, dispute resolution, or legal or contractual recordkeeping.

We do not sell or share minors' personal information for targeted advertising and do not use teen data for decisions producing legal or similarly significant effects. If you believe a user under 16 is using FlyRecap, contact us promptly at hello@flyrecap.com.

18 Security

FlyRecap uses administrative, technical, and organizational safeguards designed to protect personal information. Depending on the system, these may include authenticated access, encrypted network transmission, private object storage, access-control and database authorization rules, least-privilege practices, protected secrets, logging, password-recovery controls, server-authoritative sharing permissions, and deletion or reconciliation of protected local caches when an Account signs out, is deleted, or loses access after a successful synchronization.

No method of transmission, synchronization, authentication, or storage is completely secure. You are responsible for protecting your credentials, recovery links, and device, installing updates, reviewing recipients before sharing, and keeping exports secure. Notify us promptly at hello@flyrecap.com if you suspect unauthorized access or disclosure.

19 United States Only Service

FlyRecap is based in the United States and is intended solely for individuals located in the United States who are participating in or supporting U.S.-based flight training. FlyRecap is not offered or directed to individuals outside the United States.

A U.S.-only service offering is not a promise of U.S.-only data storage or access. Service providers and their personnel may process information in the United States and other locations where they or their subprocessors operate, subject to applicable terms and confidentiality, security, and data-protection obligations.

If FlyRecap expands outside the United States, we will update this Policy and implement any additional notices, contractual safeguards, representatives, consent mechanisms, or other measures required before offering the Service in those locations.

20 Changes to This Policy

We may update this Policy as the Service, providers, or law changes. We will post the updated Policy and revise the date above. If a change materially affects how we use previously collected personal information, we will provide additional notice and obtain consent where required before applying the change. We encourage you to review the Policy when the Service changes.

21 Contact Us

Questions, privacy requests, appeals, parental requests, or complaints may be sent to:

FlyRecap LLC

11575 E Laketowne Dr

Albertville, MN 55301-4348

United States

hello@flyrecap.com