Privacy Policy

Last updated: May 28, 2026

This privacy policy applies to the CloudPath website (cloudpath.app) and the CloudPath mobile applications for iOS and Android.

What We Collect

When you use CloudPath (web or mobile):

• Route data — departure, destination, and via waypoints you entered
• Flight parameters — departure time, airspeed, and display settings
• IP address — your public IP address (web only)
• User agent — your browser or app identification string
• Timestamp — when the request was made

When you create an account:

• Email address — used for authentication and account recovery
• Password — stored as a salted hash; we never see or store your plain-text password
• Google account info — if you sign in with Google, we receive your Google profile name, email address, and a stable Google user identifier from Google's OAuth service. We do not request access to any other Google services (Gmail, Drive, Contacts, etc.).
• Apple account info — if you sign in with Apple (iOS only), we receive an Apple-generated user identifier. We may receive your name and email if you choose to share them; if you use Apple's hide-my-email feature, we receive an Apple-relay address only.
• Favorites and recents — routes you save or recently generated, synced to our server

Mobile App — Offline Data

The CloudPath mobile app allows you to download weather data packs for offline use. These data packs are stored locally on your device only and are never transmitted back to our servers. Offline chart rendering happens entirely on your device.

IP Geolocation

We look up the approximate geographic location of your IP address (country, city, region, ISP) using the ip-api.com service. This lookup is performed once per unique IP and the result is cached locally. We do not share your IP address with any other third parties.

Cookies

The website uses a session cookie for authenticated users to maintain your login state. We do not use tracking cookies, analytics cookies, or advertising cookies. The mobile app uses secure on-device storage for authentication tokens and does not use cookies.

Third-Party Services

• NOAA GFS — weather forecast data (public domain; no personal data shared)
• Google Sign-In — optional; shares your name and email with us if you choose to sign in with Google
• Apple App Store — subscription billing on iOS is handled by Apple; we do not see or store your payment information
• Google Play Billing — subscription billing on Android is handled by Google; we do not see or store your payment information
• Stripe — web subscription billing; payment processing is handled by Stripe. We do not store credit card numbers.
• ip-api.com — one-time IP geolocation lookup (web only)

Payment Processing

CloudPath Premium subscriptions are processed by Apple (on iOS), Google (on Android), or Stripe (on the web). Payment card details are handled entirely by Apple, Google, or Stripe and are never sent to or stored on CloudPath's servers. We receive a transaction identifier and subscription status (active, expired, plan tier) from the payment processor so that we can grant you Premium access on the correct devices.

What We Do Not Collect

• We do not collect your device location (GPS)
• We do not use advertising or tracking SDKs
• We do not sell, rent, or share your personal data with third parties
• We do not use your data for advertising, profiling, or any purpose other than providing the service

Purpose and Legal Basis

We collect this data to provide the CloudPath service, maintain your account, sync your preferences, and understand aggregate usage patterns. We do not use your data for advertising or profiling.

The legal basis for this processing under GDPR is legitimate interest (Article 6(1)(f)) for analytics, and contract performance (Article 6(1)(b)) for account and service functionality.

Data Retention

Account information and route history are retained as long as your account is active. Visit logs are retained indefinitely for aggregate analytics. You may delete your account at any time through the account settings page; when you do, all associated personal data is removed from our servers within 30 days.

Your Rights

Under GDPR, you have the right to:

• Access — request a copy of the data we hold about you
• Rectification — correct inaccurate data
• Erasure — request deletion of your data (“right to be forgotten”)
• Object — object to processing based on legitimate interest
• Portability — receive your data in a portable format

To exercise any of these rights, contact us at hello@cloudpath.app.

Children's Privacy

CloudPath is not directed at children under 13 (under 16 in the EU). We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact hello@cloudpath.app and we will remove it.

International Users

CloudPath's servers are hosted in the United States (Ohio). If you use CloudPath from outside the United States, your data will be transferred to and stored on servers in the United States. By using CloudPath, you consent to this transfer.

Changes to This Policy

We may update this policy from time to time. Material changes will be announced in the app's release notes and on this page. The “Last updated” date at the top reflects the most recent revision. Continued use of CloudPath after a change constitutes acceptance.

Contact

For questions or concerns about this policy, contact hello@cloudpath.app.