Privacy policy (draft)

Draft: pending review. This text has not yet been approved by the site's owner and is not final. It describes what the site does today.

If you buy a report

When you ask for a sign-in link, we use your email address to send it. An account is created only when you use the link, which proves you receive mail at that address.
Your signed-in session is stored with your IP address and your browser's user agent, and lasts up to 8 hours.
Payments are handled by Stripe. We do not receive or store your full card number.
For each checkout we store Stripe's record of it: the email address Stripe holds, the amount, the receipt link, and what Stripe returns about the payment, which can include your name, billing details and your card's brand, last four digits and expiry date. Only the site's administrators can read that record, and it is never written to our logs.
We store the PDF report you bought, so you can download it again.
For each email we send you (receipt, report ready, refund notice, alert digest) we record that it was sent and the mail provider's message id, not its content; for an alert digest we also keep the alert lines it carried, which you can see under Your alerts.
Each refund request is recorded with its outcome, whether it was granted or refused.

Saved aircraft, watched models and alerts

If you sign in and save an aircraft or watch a model, we store which aircraft and models you watch, the alerts we found for them, and when each was emailed to you. Only you and the site's administrators can see them.
We send at most one alert email a day, and only when there is news. Each kind of alert (airworthiness directives, NTSB records, ownership and registry status) has its own off switch, and every alert email has links that turn them off without signing in.
Alerts come from public FAA and NTSB records and never name an aircraft's owner.

Estimating what an aircraft is worth

When you ask for an estimate, we store the tail number, what you enter (airframe and engine times, avionics, damage history, whether it is hangared, a ZIP code if you give one, and an email address if you ask for the estimate by email), the result, and a salted hash of your IP address used only to limit requests. Only our staff can read them.
If you give an email address, we send you that one estimate. It does not sign you up for anything; offers and listing alerts are sent only if you also tick the separate box.
Estimates are worked out from asking prices in aircraft-for-sale ads we collect. We publish only totals and spans from them (how many aircraft, which years, which months), never an individual ad, its price, its seller or its aircraft.

The broker plan

Brokers pay for the plan through Stripe. We record each paid month of the plan, and we log every report a broker downloads under it, so usage can be reviewed.
The plan starts with one free trial per person. To keep it to one, we record each trial with a one-way hash of the email address (not the address itself), the card fingerprint Stripe gives us (not the card number) and the account it was for. That record is kept after an account is deleted, so the same person cannot start a second trial.
The broker plan is for one named person. A subscriber gives us their own name, and may add a phone number and a photo; these appear on their customised reports and listing pages, and every report they download under the plan carries their name and email address on each page. We keep the card holder's name Stripe reports at the subscription checkout, to check it matches.
To spot an account being shared, a daily check reads the sign-ins we already record (browser and network, which we reduce to a device fingerprint without keeping any IP address for the check), the download log and the broker's listing pages. It only alerts our staff; it never blocks an account by itself.
What a broker adds to a customised TailFax (a description, stated hours, equipment, notes, photos and a logo) is stored by us and shown, marked as provided by the seller, to the buyers the broker shares it with and, if the broker publishes one, on a public listing page.
To open a broker's share link, a buyer signs in with an email address. The broker sees how many people opened it; a buyer's email address reaches the broker only if that buyer ticks the box to share it.
When a broker saves their photos and details with the licence box ticked, or publishes a listing, we record the exact licence wording and its version, the time, the account and a salted hash of the IP address. These records are kept, unchanged, after the broker's subscription or account ends, because the licence they record continues. They never include the broker's personal contact details, which this policy covers.
A listing page's contact form collects your email address and your message (and your name or phone number only if an older form sends them), with a salted hash of your IP address used only to limit submissions. The message is stored for the broker and our staff to read in the app; no email is sent about it.

Public records on this site

The site is built from public FAA and NTSB records.
The paid report includes owner names from the FAA registry's ownership history and party names from documents filed with the FAA about the aircraft.
The free public pages (the aircraft page, model pages, Find and Compare) show no owner names or addresses.

Aircraft-for-sale listings

We collect public aircraft-for-sale ads from listing sites, starting with Barnstormers, for internal price research. Our collector reads each site's public ad lists about once a week, one page at a time, obeys the site's robots.txt, says who it is, never signs in, and stops if the site shows a CAPTCHA or blocks it. Staff can also paste a listing into the site by hand.
For each ad we store what it says about the aircraft (such as the asking price, hours, location and equipment), and, separately, the full ad text and the seller's name, phone number and any email address written in the ad.
The seller's contact details and the full ad text are locked: no role on the site can read them, and no screen, data interface or assistant shows them. They are used only inside the app to check whether the seller is the aircraft's registered owner; for a collected ad, staff see only the result of that check and whether the ad calls the seller an owner or a broker.
We publish none of it: listings are seen only by our staff inside the app, never on the public site, and we do not share them with anyone.
Our database backups contain these contact details too.

Messages and privacy requests you send us

The contact form collects your name, email address, phone number if you give one, a topic and your message.
The privacy-request form collects who you are, what you are asking for, the name, email address, country, state or province, phone number if given and any further details of the person the request is about, and, when you act for someone else, your own name and email address.
With each message or request we store a salted hash of your IP address, used only to refuse more than five submissions from one address in an hour; we never store the address itself.
These messages and requests are read by TailFax staff and by an AI assistant operating for TailFax, which handles them inside the app; no other visitor or customer can read them. Neither can change anything in them but their status.
We use them only to reply to you and to act on your request, and we keep them until they are deleted. We send no notification email about them.

Who else handles it

Stripe processes payments and refunds.
Resend delivers our emails.
Our staff have an in-app assistant that sends their questions and the data it looks up to an AI model provider (Anthropic). It is not available to buyers, and its tools are blocked from the customer and order records. It reads contact messages and privacy requests so they can be handled in the app.
We do not sell personal information, and we do not share it for advertising.

Email

Offers, product news and listing alerts are sent only if you tick the box asking for them. When you tick it we record your email address, the exact wording you agreed to and its version, the page you were on, the time, a salted hash of your IP address and, if you are signed in, your account. A box ticked before you sign in counts only once you use the sign-in link we send you within 24 hours.
We keep one record of your email choices for each email address, saying which kinds of optional email you want and how you last changed them.
Every optional email carries an unsubscribe link that works with one click, without signing in. Turning something off is recorded the same way as agreeing; an unsubscribe is never switched back on unless you do it yourself while signed in.
Receipts, sign-in links, report-ready and refund emails are not optional and are sent regardless of these choices.

Cookies and tracking

We set a cookie to keep you signed in. The site stores your display-theme choice in your browser.
We count page views ourselves: per page and day, the page's address, the linking site's domain and phone/tablet/computer. No IP address, no cookie; we cannot tell one visitor from another.
No advertising trackers and no third-party analytics.

Records we keep

Changes made through the site's data interface by signed-in users are recorded in an audit log, with the user and their IP address.
We have not yet set periods after which data is deleted automatically: data is kept until it is deleted.

Questions about your data

See Contact. See also Do not sell my personal information.