Privacy policy
Privacy policy
Last updated: July 15, 2026
1. Information We Collect
We collect information you provide directly: name, email address, phone number, business name, and message content when you use our contact form; account credentials, profile details, and billing information when you sign up for Flight1AP; and content you upload to the platform. We also collect basic technical data such as IP address, browser type, and referring page for security and analytics.
2. How We Use Your Information
We use the information to respond to inquiries, provide and operate Flight1AP, deliver galleries to your clients, process payments, send transactional notifications and (with consent) marketing email, prevent fraud and abuse, and comply with legal obligations. We do not sell or rent your personal information.
3. Google API Services User Data — Limited Use Disclosure
Flight1AP's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Specifically, when you connect a Google Drive account to Flight1AP:
- We request the minimum scopes needed to upload files you create in Flight1AP and to read files you explicitly select for delivery to your clients.
- Google user data is used solely to provide user-facing features of Flight1AP (uploading media to your Drive, organizing project folders, and generating shareable links for your clients).
- We do not use Google user data to train generalized or artificial intelligence / machine learning models.
- We do not transfer Google user data to third parties except as necessary to provide or improve user-facing features, comply with applicable law, or as part of a merger, acquisition, or sale of assets with appropriate notice to users.
- We do not use Google user data for serving advertisements.
- Humans do not read Google user data unless we have your explicit consent, it is necessary for security purposes (such as investigating abuse), to comply with applicable law, or the data is aggregated and used for internal operations in accordance with the User Data Policy.
You may revoke Flight1AP's access to your Google account at any time from your Google account permissions page, or by disconnecting the provider inside Flight1AP settings.
4. Microsoft, Dropbox, and Box Data
The same principles above apply to data received from Microsoft OneDrive, Dropbox, and Box: minimum scopes, used only to power features you invoke, not sold, not used to train AI models, and revocable at any time from the respective provider's account permissions page or from Flight1AP settings.
5. Where Your Content Is Stored
Original media you upload to Flight1AP is streamed to the cloud storage provider you connect (Google Drive, OneDrive, Dropbox, or Box). When you have no provider connected, uploads are held on Flight1AP infrastructure so you can preview and download them, and are retained until Flight1AP removes them or you request their deletion. Small derivatives such as thumbnails and previews may be cached on Flight1AP infrastructure to power the interface.
6. Data Security
We use industry-standard controls including TLS in transit, encrypted OAuth token storage using AES-256-GCM, role-based access controls, database row-level security, and audit logging. No system is perfectly secure; you use the service at your own risk.
7. Third-Party Services
We rely on the following categories of subprocessors to operate the service: cloud database and authentication (Supabase), transactional email (Resend / MailerSend), analytics (Google Analytics), and the storage providers you choose to connect. These subprocessors are contractually obligated to protect your data and use it only to provide services to us.
8. Cookies & Analytics
We use first-party cookies for authentication and Google Analytics 4 for aggregate usage measurement. Analytics data is IP-anonymized where supported. You can disable cookies in your browser; some features (such as signing in) require cookies to function.
9. Your Rights
You have the right to access, correct, export, or delete your personal data, and to withdraw consent for marketing communications. Depending on your jurisdiction you may also have rights under the GDPR, UK GDPR, or CCPA/CPRA including the right to opt out of "sale" or "sharing" — Flight1AP does not sell or share personal information as those terms are defined under those laws. To exercise any right, email [email protected].
10. Data Retention
Account data is retained while your account is active and for up to 90 days after account deletion to allow recovery and to satisfy legal or accounting obligations. Media uploaded without a connected cloud storage provider is retained until Flight1AP removes it or you request its deletion. Media uploaded to your connected storage provider is governed by that provider's retention and by your own project deletions.
11. Children's Privacy
Our services are not directed to individuals under the age of 13, and we do not knowingly collect personal information from children. If you believe a child has provided us with personal data, contact us and we will delete it.
12. International Users
Flight1AP is operated from the United States. If you access the service from outside the U.S., you consent to the transfer and processing of your information in the United States.
13. Changes to This Policy
We may update this policy from time to time. Material changes will be reflected by updating the "Last updated" date above and, where required, by notifying you by email.
14. Contact
For questions about this Privacy Policy, our data practices, or to exercise your privacy rights, contact us at [email protected].
15. Open-Source & LUT Acknowledgments
Our AI photo editor uses color look-up tables (LUTs) sourced from the following freely licensed packs. We gratefully acknowledge their authors: