What we collect
- Account data: name, email, password (stored only as a salted scrypt hash — we cannot read it).
- Profile and operational records you create: pilot profiles, credentials, aircraft records, missions, sites, messages, documents you upload, and compliance records.
- Payment identifiers: Stripe account and transaction identifiers only. Card numbers and bank details go directly to Stripe and never touch our servers.
- Usage telemetry: first-party, aggregate daily counters (page views, searches, signups). No analytics or advertising trackers, no advertising pixels, no fingerprinting.
- Services your browser contacts directly: pages load fonts from Google Fonts, map code from unpkg, and map imagery from Esri and other map tile providers. Those providers receive your IP address and standard request details under their own privacy policies; NOREVYN sends them none of your account data.
How we use it
To operate the product: matching, mission records, notifications, safety and abuse prevention, and legally required recordkeeping. We do not sell personal data, and we do not share it with third parties except the processors that run the service (hosting, database, Stripe for payments) and where required by law.
Who can see what
- Your public pilot profile shows what you chose to publish. Certificate numbers, policy numbers, aircraft serials, exact home location, documents, and payment status are never public.
- Site access details (gate codes, on-site contacts) are visible only to that mission's customer and assigned pilot.
- Mission compliance records are visible to the mission's participants (and organization admins of the participating org). Sensitive identifiers are masked in records (e.g. certificate ••••1234).
- Messages are visible to the conversation's participants.
Security
Transport encryption (TLS with HSTS); passwords hashed with scrypt; per-account login lockout and rate limiting; role- and capability-based authorization on every endpoint; separation between organizations enforced in code and checked by the automated test suite before release. Records are stored in a managed PostgreSQL database operated by Neon.
Retention and deletion
Your data is retained while your account exists. Email info@norevyn.io from your account address to delete your account; personal data is removed, and compliance records of completed transactions with the other party may be retained in redacted form for that party's legitimate recordkeeping.
Contact
info@norevyn.io. We will update this policy as the product evolves; material changes are announced in the product.