Privacy Policy
Last updated 26 August 2026
The short version
SpotFlight has no accounts, no analytics, and no tracking of any kind. Your settings stay on your iPhone. There are no ads anywhere in the app — with one exception you choose yourself, described in section 3.
I do run servers for this app — five of them, which hold a snapshot of the world's air traffic in memory and answer the question below. What they do not do is keep anything about you: they record neither your position nor your network address, and there is no code in them capable of linking one to the other.
One thing does leave your device: your location. SpotFlight sends your latitude and longitude to my relay — and, if it cannot be reached, to the public service api.adsb.lol — because that is literally the question being asked — "which aircraft are near this point?" There is no way to answer it without saying where the point is. That is the whole of the data story, and the rest of this page explains it properly.
1. Who is responsible
SpotFlight is made by Mourad Toumi, an independent developer. Contact details are in section 10.
I run five relay servers for this app, rented from ordinary hosting providers in Europe (Hetzner, Scaleway and OVH). They exist for one reason: each downloads a snapshot of world air traffic every few seconds, keeps it in memory, and answers "what is near this point?" from it. They hold no database, and nothing is written to disk about who asked what.
There is no SpotFlight account system. I have no way to identify you, and I hold no records about you — not as a policy I ask you to trust, but because the software has no facility for it: the relay reads no client address anywhere in its code, and its web front end is configured to log neither addresses nor coordinates. Section 5 sets out precisely what is written down.
2. What SpotFlight uses, and why
2.1 Your location
What. Your device's latitude and longitude, and its altitude above the WGS84 ellipsoid, obtained through iOS Core Location with the "While Using the App" permission.
Why. Your position is the origin of every calculation the app performs: the bearing and elevation to point your phone at, the distance to each aircraft, the closest-approach prediction, the Sun and Moon transit predictions, your position on the map, and the viewing cone drawn on it. Without it there is nothing to compute.
Where it goes. Your coordinates are placed in the address of a request to the public aircraft-data service api.adsb.lol, in this form:
`` https://api.adsb.lol/v2/point/{latitude}/{longitude}/{radius} ``
This is how the service is queried. The coordinates are the query. While the app is open and in the foreground, this request repeats about once a second against my relay, or every seven seconds against the public fallback. Sending the app to the background stops it: nothing is requested while you are not looking.
The altitude never leaves your device. Neither does anything from your attitude sensors.
Background use. None. SpotFlight requests "While Using the App" access only. It has no background location capability, no background app modes, and no "Always" permission. When you leave the app, location updates stop.
If you refuse. The app keeps working. It falls back to a fixed placeholder position and shows the traffic there instead, so you can still see how it behaves — but the aiming, distances and predictions will not relate to where you actually are. You can change your mind at any time in iOS Settings → Privacy & Security → Location Services → SpotFlight.
2.2 What you type into the search box
What. A flight number, radio callsign, aircraft registration, or 24-bit ICAO address — for example AF498, AFR498, F-GKXA, or 4CAEE8.
Why and where. The search term is sent to api.adsb.lol to look up that aircraft. Your location is not attached to a search.
SpotFlight keeps no search history. There is no history feature, nothing is written to disk, and nothing is sent to me.
2.3 Aircraft callsigns, for route names
What. The radio callsign an aircraft is broadcasting — not anything of yours.
Why and where. To show "Paris → Seattle" instead of a bare flight number, SpotFlight asks the public service api.adsbdb.com which cities a callsign flies between. These answers are held in memory for the current session so the same callsign is not looked up twice, and are gone when the app closes.
You can turn this off. In Settings, switch off the departure and arrival cities. With it off, SpotFlight sends no requests at all to api.adsbdb.com.
2.4 The camera
The camera feed is the live backdrop of the aiming view. SpotFlight also reads the lens's real field of view so that labels land in the right place on screen.
No image is ever examined, recorded, saved, or transmitted. The app does not read individual frames, does not recognise anything in the picture, and does not use ARKit or any image analysis. Aircraft are placed on screen purely by geometry — your position, your phone's orientation, and the aircraft's broadcast position. Nothing in the image is used.
If you decline camera access, the app draws a plain synthetic sky instead and everything else continues to work.
2.5 Motion sensors
SpotFlight reads your iPhone's device-motion data (the compass, gyroscope and accelerometer, combined by iOS into an orientation) to know which way the phone is pointing. This never leaves the device.
The app does not use the Motion & Fitness activity or step-counting interfaces, so it does not see your movement or activity history.
2.6 Notifications
SpotFlight can notify you shortly before an aircraft passes close overhead, or before one crosses the Sun or Moon, so that you have time to walk outside and look up.
These are local notifications, scheduled on your iPhone by the app itself. There is no push service, no APNs token, and no server involved. Permission is requested only when you press the button for it in Settings — never automatically at launch.
2.7 Your settings
Three preferences are stored on your device, using the standard iOS preferences store:
- map range (50, 100 or 200 km),
- whether departure and arrival cities are shown,
- whether Sun and Moon transit prediction is enabled.
That is everything SpotFlight writes. No files, no database, no keychain entries, no documents. These settings never leave your iPhone and are removed when you delete the app.
3. What SpotFlight does not do
To be unambiguous:
- No account, no sign-in, no email address, no password. There is nothing to register.
- No analytics. No Firebase, no Google Analytics, no Mixpanel, no Amplitude, no
first-party event logging. Nothing counts your taps.
- No advertising you did not ask for. Nothing in this app displays an ad on its own — not on launch, not between screens, not while you are looking at the sky.
The one exception, and it is entirely yours to take or leave. For the first 24 hours after you install the app, everything is open and nothing is asked of you. After that, the augmented-reality view and Sun and Moon transit prediction are unlocked for a further 24 hours by watching a short video, only when you tap the button that offers one. That video is served by Google's mobile ads software, which runs on your device and collects data of its own under Google's policy — not mine. I request non-personalised ads, which is the least it will accept, and I do not request the advertising identifier (IDFA), so there is no App Tracking Transparency prompt.
What that software does, and what it does not. It is part of the app, and it sets itself up when the app launches — that is how the library is built, and I cannot switch it off. What it does not do is fetch or show an ad on its own: no ad is requested during your first 24 hours, none while an unlock is running, and none at any time unless you tap the button that offers one. Once the free period ends, the app asks it whether a video is available at all; if none is, the app simply stays unlocked rather than shutting you out. The map, the list, the search and the passage alerts never require it.
- No tracking by me. No IDFA request, no App Tracking Transparency prompt, no device fingerprinting, no cross-app or cross-site profiling, and no data brokers. What Google's ad software does once you have chosen to watch a video is governed by Google's policy, linked in section 4 — I ask it for the least intrusive setting available, and I will not pretend that amounts to nothing.
- No third-party SDKs at all. The app is built entirely on Apple frameworks. Its
dependency list is empty, so no outside code runs inside it.
- No crash or performance reporting collected by me. (If you have opted in to share
analytics with Apple system-wide, Apple may pass me anonymised, aggregated crash reports. That is Apple's mechanism, under your control in iOS Settings → Privacy & Security → Analytics & Improvements.)
- No photos, contacts, microphone, health, Bluetooth, calendar, or local-network access.
The app never asks for them.
- No data sold or shared. There is none to sell.
- No profile of you. Your coordinates are never combined with an identifier, because
there is no identifier.
4. Third-party services
SpotFlight talks to three hosts. One is mine — the relay, spotflight.ftso.paris — and the other two are free public services that I do not own, operate, or have any commercial relationship with. Every request is over HTTPS, every request is a simple GET, and no request carries a cookie, a login, or a device identifier. The only custom header sent is a fixed product name, SpotFlight/1.0 (iOS), which contains nothing about you or your device.
Like any internet service, all three will see your IP address while the connection is open — that is inherent to making a network request and cannot be avoided without a proxy. The difference is what happens next: on my relay it is neither recorded nor read by the software, whereas what the two public services do with it is theirs to decide.
Why my own server is the first one asked. Not for my benefit: measured side by side, it answers faster, it is not rate-limited by network address, and it runs on a different network from the public fallback — so an outage or a block affecting one leaves the other working. The public API remains the fallback, and it works on its own if my relay ever disappears.
| Service | What it receives from SpotFlight | Its own terms |
|---|---|---|
| spotflight.ftso.paris — my relay, live aircraft positions (asked first) | Your latitude and longitude, in the request address, and anything you type into the search box. Neither is recorded — see section 5 | This page. Hosted in Europe (Hetzner, Scaleway, OVH) |
| adsb.lol — live aircraft positions (fallback only) | Your latitude and longitude (in the request address), and anything you type into the search box | adsb.lol privacy & licence · adsb.lol |
| adsbdb.com — departure and arrival cities | Aircraft callsigns only. Never your location. Nothing at all if you turn routes off | adsbdb.com · source code |
An honest note about adsbdb.com: at the time of writing, that service publishes no privacy policy and no terms-of-use page. I cannot tell you what it logs or for how long, and I will not guess. What I can tell you is exactly what SpotFlight sends it — a callsign, and nothing else — and that the toggle in Settings stops those requests entirely.
Requests to both services may be handled by servers outside your country, including outside the European Economic Area. Once a request reaches them, what they do with it is governed by their practices, not mine.
5. How long anything is kept
| Data | Kept for | By whom |
|---|---|---|
| Your location | Not stored. Used for the calculation on screen and replaced by the next reading a moment later | Nobody |
| Your searches | Not stored. No history is kept anywhere in the app | Nobody |
| Route lookups | Held in memory only, for the current session; discarded when the app closes | Your device |
| Your three settings | Until you change them or delete the app | Your device |
| Your position, on my relay | Not written down at all. It is read from the request address to compute an answer, and is gone with the request | — |
| Your IP address, on my relay | Not written down at all, and not read by the software: the relay contains no code that inspects it | — |
| Server access log lines | 14 days. Each line records the kind of request ("/v2/point"), the status code, the size, and how long it took — never the address, never the coordinates | Me |
| Server error log | 14 days, and limited to critical faults. At that level entries are rare; I state plainly that such an entry can still carry a client address, which is why the level is set where it is | Me |
| Access logs at adsb.lol and adsbdb.com | Unknown to me — determined by those services | Those services |
One technical detail, for completeness: iOS maintains a standard HTTP response cache for apps. It may briefly hold recent responses, and the request addresses that produced them, inside SpotFlight's own sandboxed cache folder on your iPhone. That folder is private to the app, is managed and cleared by iOS, and is deleted when you delete the app.
6. Legal basis for processing (EU / UK GDPR)
For users in the European Economic Area, the United Kingdom and Switzerland:
To the extent that sending your coordinates to my relay, and onward to api.adsb.lol when the relay is unreachable, amounts to processing personal data, Mourad Toumi is the controller for that processing.
The lawful basis is Article 6(1)(b) — performance of a contract. You bought an app whose single purpose is to show you the aircraft above your location. The transmission is not incidental to that purpose; it is that purpose, and the app cannot deliver what you paid for without it. In addition, iOS asks for your explicit permission before any location is read, and you can withdraw that permission at any time in iOS Settings — which stops the processing immediately.
No decisions are made about you automatically, no profiling takes place, and no special categories of personal data under Article 9 are processed.
7. Your rights
If you are in the EEA, the UK or Switzerland (GDPR)
You have the right to access your data, to have it corrected or erased, to restrict or object to its processing, and to receive it in a portable form. You also have the right to lodge a complaint with your national data protection authority.
I want to be straightforward about what these rights mean in practice here: I hold no data about you. There is no account and no database, and the relay described above keeps nothing: not your address, not your position, not a history of your requests. If you write to me asking for a copy of your data, an accurate answer is the only one I can give — there is nothing to send, because nothing was ever received.
You can exercise the practical equivalent of these rights yourself, immediately, without asking anyone:
- Stop the processing: turn off location access for SpotFlight in iOS Settings, or close
the app.
- Stop the route lookups: turn off departure and arrival cities in the app's Settings.
- Erase everything on your device: delete the app. Your settings and the system cache go
with it.
For anything held by adsb.lol or adsbdb.com, you would need to contact those services directly; I have no access to their systems.
If you are in California (CCPA / CPRA)
In the twelve months before the date at the top of this page, SpotFlight has disclosed one category of personal information as defined by California law: geolocation data (Cal. Civ. Code § 1798.140), disclosed to api.adsb.lol for the sole business purpose of returning the aircraft near you.
- I have not sold your personal information, and never will.
- I have not shared it for cross-context behavioural advertising.
- I do not use or disclose sensitive personal information for any purpose beyond
providing the app's function.
- There are no financial incentives tied to your data.
You have the right to know, delete, correct, and opt out of sale or sharing, and the right not to be discriminated against for exercising them. Since there is no sale and no sharing, there is nothing to opt out of; since I retain nothing, a deletion request has no records to act upon. Deleting the app removes everything stored locally.
Other regions
If your local law grants you rights beyond these — for example under Brazil's LGPD, Canada's PIPEDA, or Australia's Privacy Act — write to me and I will respond, keeping in mind that the honest answer will usually be that no data about you exists to act on.
8. Children's privacy
SpotFlight has no chat, no user accounts, no user-generated content, no links out to social networks, and no data collection by me that could identify anyone.
It does contain optional rewarded video ads, never shown during the first 24 hours after installation, and afterwards only when a user taps the button that offers one. Ad content is served by Google and is not under my control, which is why the app's age rating reflects the presence of advertising rather than claiming there is none.
It is not directed at children, and I do not knowingly collect personal information from children under 13 (or the equivalent minimum age where you live). Since the app has no account system and the relay stores nothing, there is no mechanism by which a child could submit personal information to me. If you believe a child's personal information has somehow reached me, contact me and I will look into it.
9. Security
Every network request SpotFlight makes uses HTTPS with the standard iOS transport security settings. There are no credentials, tokens, or personal records for an attacker to steal from me, because none exist — the relay holds one thing in memory, a snapshot of public aircraft positions that is identical for every user, and writes nothing about anyone to disk. Your settings live inside the app's sandbox on your iPhone, protected by iOS.
10. Contact
Questions about this policy, or about privacy in SpotFlight:
Mourad Toumi 61 rue de Lyon, 75012 Paris, France Email: mourad.toumi@icloud.com
I read every message and aim to reply within 30 days, which is the deadline the GDPR sets.
11. Changes to this policy
If this policy changes, the date at the top changes with it. Material changes — anything that alters what data leaves your device, or where it goes — will also be noted in the app's release notes so you find out without having to check this page.
12. Data sources and credits
Live aircraft positions contain information from adsb.lol, made available under the Open Database License (ODbL).
Flight route information is provided by adsbdb.com. The flight route data is the work of David Taylor, Edinburgh and Jim Mason, Glasgow, and may not be copied, published, or incorporated into other databases without the explicit permission of David J Taylor, Edinburgh.
Aircraft position data is provided as is, with no warranty of accuracy, completeness or availability. SpotFlight is for observation and enjoyment, and must not be used for navigation or any operational purpose.