SimNavLog (the "service") is operated by Virtual Void Stockholm AB, Sweden — the data controller for the personal data described here.

We keep only what is needed to run your account:

• Email address and a hashed password — to create your account, sign you in, and send account emails (confirmation, password reset, email change).
• Sign-in provider identifiers (e.g. Microsoft) — only if you choose to sign in with a third-party account.
• Flight plans you create (routes, waypoints and nav logs) — stored so you can save and reload your work.

Our lawful basis for processing your account data is performance of a contract — providing the service you asked for (GDPR Article 6(1)(b)). We do not use your data for advertising and we do not sell it.

Our server records ordinary operational logs for every request — the time, the page requested, and the IP address it came from. These are needed to keep the service running and to stop abuse such as password-guessing and sign-up floods. They are kept on the server only, capped in size and rotated away automatically; they are never stored in the database, never combined with your account, and never shared.

We set only strictly-necessary, first-party cookies: a signed session cookie, an optional "remember me" cookie (only if you tick that box at login), and a CSRF-protection token. We use no analytics, advertising or third-party tracking cookies. Because these cookies are strictly necessary to provide the service, no cookie-consent banner is required.

• Map tiles. The interactive map loads chart tiles directly in your browser from OpenStreetMap, OpenTopoMap, Open Flightmaps and (for US charts) Esri/ArcGIS. Those providers therefore receive your IP address and the map area you view. The Esri/ArcGIS request involves a transfer to the United States.
• Weather and navigation data. METAR, winds-aloft, terrain, magnetic-variation and airport lookups are made by our server (not your browser) and send only coordinates or station codes — no personal data.
• Email delivery. Account emails are sent through an email provider, which processes your email address to deliver them.
• Signing in with Microsoft. Only if you choose it. Your browser goes to Microsoft, which tells us your account identifier and email address once you approve. Microsoft learns that you signed in to SimNavLog; we never see your Microsoft password. This involves a transfer to the United States.

You can, at any time:

• Access / export your data — download a copy from your account settings .
• Rectify your data — change your email or password from account settings.
• Erase your account — delete it from account settings. Your account, sign-in tokens and personal nav logs are removed. The routes you created — the bare lists of waypoints, without the nav logs around them — are kept as anonymous records, no longer linked to you: they are a shared resource, as the terms explain.

You also have the right to lodge a complaint with your national data protection authority. Ours is the Swedish Integritetsskyddsmyndigheten (IMY) .

We keep account data for as long as your account exists. Abandoned unconfirmed sign-ups are deleted automatically after a short period, and sign-in tokens expire after a set time. Error diagnostics, which may contain incidental personal data, are purged automatically after a few months. When you delete your account, your personal data is removed immediately.

For any privacy question or data request, contact us at info.simnavlog@virtualvoid.se . We answer data-subject requests within one month (GDPR Article 12(3)).

We may update this policy as the service evolves. The date at the top shows when it last changed.