Skip to main content
Hobbstack

Privacy Policy

Effective Date: August 5, 2026

1. Introduction

Hobbstack L.L.C. (“Hobbstack,” “Company,” “we,” “us,” or “our”), an Arizona limited liability company, operates the marketing website at hobbstack.com and the application at hobbstack.app (collectively, the “Service”). This Privacy Policy explains how we collect, use, disclose, retain, and safeguard your personal information when you use the Service. By using the Service, you consent to the practices described in this Privacy Policy.

2. Information We Collect

2.1 Information You Provide Directly

  • Account information: First name, last name, email address, phone number (optional), and password (stored as a one-way bcrypt hash; we never store plaintext passwords).
  • Pilot credentials: Pilot certificate type (student, private, commercial, ATP, CFI, or none), CFI certificate number, and CFI expiration date (for instructor users). Medical certificate class and expiry, FAA WINGS progress, and emergency contact name and phone, where you choose to enter them.
  • Organization information: Organization name, type, home airport, timezone, logo, and operational settings.
  • Flight data: Reservations, logbook entries (flight times, landings including night full-stop, airports, training descriptions), endorsements, and checkout/dispatch records.
  • Aircraft data: Tail number, type, Hobbs/tach readings, maintenance records (including Airworthiness Directives and MEL deferrals), performance specifications, and photos.
  • Billing data: Billing line items, invoices, payment amounts, and rate information. We do not store credit card numbers. Payment card data is processed and stored exclusively by Stripe.
  • Squawk/maintenance data: Discrepancy descriptions, severity levels, resolution notes, work order information.
  • File uploads: Profile photos, aircraft photos, organization logos, flight plan templates, and documents. Size limits and accepted formats depend on what you are uploading: images and general documents are limited to 5 MB and must be JPEG, PNG, WebP, or PDF; organization logos to 2 MB; aircraft documents to 10 MB; an aircraft flight manual to 30 MB (PDF); and spreadsheet or scheduling-database files imported from another system may be substantially larger.
  • Signature data: Your hand-drawn signature, captured on screen and stored as an image, used when signing logbook entries, endorsements, and stage checks.
  • Terms of Service acceptance: Acceptance timestamps, version accepted, and IP address at time of acceptance.
  • Communication data: Notification preferences, push subscription endpoints, and correspondence with our support team.

2.2 Information Collected Automatically

  • Usage data: Pages visited, features used, interaction patterns, and click events. On the marketing site (hobbstack.com) this is collected via PostHog analytics in a cookie-free configuration (see Section 5.2).
  • Device and browser data: Browser type and version, user agent string, operating system, screen resolution, and device type.
  • Network data: IP address and referring URL. Hobbstack does not itself convert your IP address into a location; our analytics provider derives an approximate city and region from the IP addresses of marketing-site visitors on its own systems.
  • Authentication data: Login timestamps, session duration, and authentication method.

2.3 Information from Third Parties

  • Stripe: Subscription status and payment success/failure notifications. We do not receive or store your full credit card number.
  • Cloudflare Turnstile: Bot-detection challenge results (no personal data collected).
  • Google (if you sign in with Google): Your Google account identifier, email address, whether Google has verified that email, your first and last name, and your profile picture URL. We never receive your Google password.
  • Apple (if you sign in with Apple): Your Apple account identifier, email address, and whether Apple has verified that email. If you choose Apple's “Hide My Email” option, we receive only the forwarding address Apple generates, not your real one. Apple does not send us your name after the first sign-in. We never receive your Apple password.

3. How We Use Your Information

  • Provide the Service: Operate scheduling, fleet management, logbook, billing, dispatch, weather briefing, and all other core platform features.
  • Process transactions: Process subscription payments and generate invoices.
  • Send communications: Deliver transactional emails (account verification, password resets, reservation confirmations, billing statements, maintenance alerts, currency reminders, pre-flight reminders, weekly digests) and push notifications.
  • Automated features: Generate go/no-go flight assessments, logbook description suggestions, and alternate route analysis from flight operational data that carries no name, email, or account identifier. Two further features read a document you upload — proof of a prior subscription when claiming a switching discount, and an aircraft flight manual — and therefore process whatever that document contains. Section 5.4 sets out exactly what each feature sends and what is kept.
  • Security and fraud prevention: Rate-limit authentication endpoints, detect and prevent unauthorized access, manage token blacklisting, and verify bot challenges.
  • Improve the Service: Analyze usage patterns to improve performance, fix bugs, and develop new features.
  • Compliance: Comply with legal obligations, respond to lawful requests, and enforce our Terms of Service.

4. How We Share Your Information

We do not sell your personal information. We do not share your personal information for cross-context behavioral advertising.

4.1 Within Your Organization

Data you create within an organization is visible to other organization members in accordance with the capability-based permission structure configured by your organization's administrator.

4.2 Service Providers

We use the following third-party service providers who process data on our behalf:

  • Stripe (San Francisco, CA): Payment processing and subscription management. Receives: cardholder name, email, payment amounts, organization name.
  • Resend: Transactional email delivery. Receives: recipient email address, first name, and email content (reservation details, billing summaries, alerts).
  • Anthropic (San Francisco, CA): Powers the automated features described in Section 5.4. For the flight-planning features — go/no-go assessment, logbook description suggestions, and alternate route analysis — Anthropic receives operational data only: airport identifiers, aircraft type, weather observations, NOTAM text, and flight times, with no name, email, or account identifier attached. Two other features send more than that, because the thing being read is a document you chose to upload: verifying proof of a prior subscription when you claim a switching discount, and reading an aircraft flight manual. Section 5.4 describes exactly what each one sends.
  • Cloudflare R2 (or other S3-compatible object storage): File storage for profile photos, aircraft photos, and documents. Files are stored under randomly generated keys — your original filename is never part of the stored path — and the storage bucket is private. Files are reachable only through short-lived signed links that we generate for an authorized viewer and that expire on their own.
  • aviationweather.gov (NOAA / National Weather Service): Source for current airport conditions and forecasts, winds aloft, pilot reports, and in-flight weather advisories. Receives: airport/station identifiers only. This service does not supply NOTAMs and is never queried for them.
  • FAA Notice to Air Missions service (the FAA's NOTAM system, operated on its behalf by CGI Federal): Source for NOTAMs — the FAA's official notices about runway closures, equipment outages, airspace restrictions, and similar hazards. Receives: airport/station identifiers only.
  • AVWX: Backup weather and NOTAM provider, used only if a primary source is unavailable. Receives: airport identifiers only.
  • CheckWX: Backup weather provider, used only if a primary source is unavailable. Receives: airport identifiers only.
  • Cloudflare Turnstile: Bot verification on authentication pages. Receives: challenge token only (no personal data).
  • Intuit (QuickBooks Online): Accounting sync, active only for organizations that choose to connect a QuickBooks company. Receives: member first and last name, email address, and invoice line items, amounts, and dates. If your organization has not connected QuickBooks, nothing is sent.
  • Expo (650 Industries), and through it Apple and Google: Delivery of push notifications to the Hobbstack iOS and Android apps. Receives: your device's push token and the notification's title, body, and destination link. Notification text often names a person, aircraft, or reservation. This applies to the mobile apps only — see Section 13 for how browser push differs.
  • PostHog: Web analytics for the marketing site (cookie-free configuration). Receives: anonymized usage events, device/browser metadata.
  • Railway: Backend infrastructure hosting.
  • Vercel: Frontend and landing site hosting. Serves static assets; no user data stored at rest.

4.3 Payment Processing

Hobbstack uses Stripe to process subscription payments. Your payment information is handled directly by Stripe and subject to Stripe's Privacy Policy.

4.4 Legal Requirements

We may disclose your information if required to do so by law, regulation, legal process, or enforceable governmental request, or if we believe in good faith that disclosure is necessary to protect the rights, property, or safety of Hobbstack, our users, or the public.

4.5 Business Transfers

In the event of a merger, acquisition, reorganization, or sale of assets, your personal information may be transferred. We will notify you via email and/or a prominent notice before your information is subject to a different privacy policy.

5. Cookies and Tracking Technologies

5.1 Essential Cookies

The Service uses three Secure cookies to maintain your session: an access token (30 minutes), a refresh token (7 days), and a cross-site request forgery token (7 days) — a value that proves a request came from our own pages rather than another website. The access and refresh tokens are httpOnly, meaning scripts running in the page cannot read them. The cross-site request forgery token is deliberately readable by our own pages, because the protection works by having our page echo it back in a header; on its own it grants no access to anything without the two session cookies. These cookies are essential for the Service to function and cannot be disabled. All three use SameSite=None with the Secure flag set, which is required because the marketing site (hobbstack.com) and the application (hobbstack.app) are served from different subdomains. Refresh tokens are rotated on every use. If a refresh token is presented again after it has been rotated — outside a 60-second grace window that exists so an ordinary double request does not log you out — we treat it as a possible theft and immediately revoke that entire login session.

5.2 Analytics

We use PostHog for web analytics on the marketing site (hobbstack.com) to understand traffic patterns. It runs in a cookie-free configuration: the anonymous visitor identifier is kept in your browser's localStorage and no analytics cookies are set. Session recording and surveys are switched off. The web application (hobbstack.app) runs no third-party analytics at all; if that changes, this policy will be updated first.

The Hobbstack mobile apps carry no analytics product either, but two ordinary parts of how a mobile app is built and delivered do contact their vendors: on launch the app checks Expo's update service for a newer version, and on Android it initializes Google's notification service. Both see basic device and network information, including your IP address, as part of that check. Neither is used by us to profile you, and we receive no analytics from either.

5.3 No Third-Party Advertising Cookies

We do not use third-party advertising cookies or tracking pixels. We do not participate in ad networks or serve targeted advertisements.

One related disclosure: our student gear guide links to products on Amazon using affiliate links, and Hobbstack earns a small commission if you buy through one. Those links set no cookie on our site, but following one takes you to Amazon, which will track the visit under its own privacy policy. The gear guide states this on the page itself, and no other part of the Service uses affiliate links.

5.4 Automated Data Processing

Several features work by sending data to Anthropic's API for processing. What gets sent depends on the feature, so we list them separately rather than making one promise that cannot hold for all of them.

Flight-planning features — go/no-go assessments, logbook description suggestions, and alternate route suggestion and evaluation. These send operational data only: the activity type, flight duration, aircraft type, departure and destination airport identifiers, route, maneuvers you typed, weather observations and forecasts, and NOTAM text. Your name, email address, and account identifier are not included in these requests.

Document features — these send a file you chose to upload, and therefore send whatever that file contains. If you claim a discount for switching from another platform, we send the proof document you upload (for example an invoice or a screenshot of your prior account), together with your organization's name and the prior-account reference you type, which is usually an email address. If you upload an aircraft flight manual, we send that document. Please do not upload a document containing information you are not willing to have processed this way.

What happens to the results. Flight-planning results are returned to your screen and are not written to a long-term store by us. The switching-discount assessment is different: its result, including the model's written summary and any concerns it raised, is saved to your organization's record so the decision can be reviewed later, and it stays there until the organization is deleted. Extracted flight manual data is likewise saved so the aircraft's performance figures can be reused. Anthropic's handling of the data we send is governed by its own commercial terms.

6. Data Security

We implement the following security measures to protect your information:

  • Encryption in transit: All data transmitted between your browser and our servers is encrypted using TLS/SSL (HTTPS).
  • Password security: Passwords are hashed using bcrypt with automatic salting. We never store or log plaintext passwords.
  • Authentication: JWT tokens in httpOnly cookies with Redis-backed token blacklisting for logout and password change invalidation.
  • Access control: Capability-based permission system ensuring users only access data within their authorized scope.
  • Rate limiting: Redis-backed rate limiting on authentication endpoints to prevent brute-force attacks.
  • Input validation: All API inputs are validated through Pydantic schemas before processing.
  • Bot protection: Cloudflare Turnstile CAPTCHA on public authentication endpoints.
  • Infrastructure: Backend hosted on Railway with managed PostgreSQL and Redis. Automatic database backups. CORS restricted to explicit origin allowlist.
  • File security: Uploaded files are restricted by size and by an allowed list of file types, stored under randomly generated keys in a private bucket, and reachable only through short-lived signed links. On our primary upload paths we additionally verify that a file's actual contents match the type it claims to be.

While we implement reasonable security measures, no method of transmission over the Internet or method of electronic storage is 100% secure. We cannot guarantee absolute security.

7. Data Retention

7.1 Active Accounts

We retain your personal information for as long as your account is active or as needed to provide the Service.

7.2 Flight and Billing Records

Hobbstack does not automatically delete flight logbook entries, endorsements, or billing records. There is no scheduled job that removes them and none is planned, so they remain for the life of your account and stay in your organization's records after an account is closed — your organization's operating and financial history is not broken when one member leaves.

We do not enforce a retention period on your behalf, and we do not promise to hold records for any particular number of years. If your operation is required to keep records for a set period, export them and keep your own copy — Section 8 explains how.

7.3 Deleted Accounts

When you delete your account we anonymize it straight away, not after a waiting period. Your name is replaced with “Deleted User”, your email address is replaced with a randomly generated placeholder, and your phone number, profile photo, certificate numbers, medical details, and emergency contact details are erased. At the same time we permanently erase free text you wrote: logbook remarks and route notes, endorsement wording, reservation notes, and any feedback you submitted. This step cannot be undone, so export anything you want to keep before you delete (see Section 8).

Operational records that no longer identify you — flight times, dates, aircraft, and billing amounts — are kept, so your organization's history and its financial records stay intact. Your past entries may still be visible to other members of your organization, shown as a deleted user rather than under your name.

A second automatic sweep runs 90 days after any account is marked deleted and re-applies the same anonymization. It is a backstop for accounts closed by other means.

7.4 Temporary Data

  • Email verification tokens: 24 hours
  • Password reset tokens: 1 hour
  • Weather and NOTAM cache: 15 minutes to 1 hour, depending on the type of data (NOTAMs and pilot reports 15 minutes; current airport conditions and in-flight advisories 30 minutes; forecasts and winds aloft 1 hour). This cache holds airport data, not anything about you.
  • Rate limiting counters: varies by endpoint (1 minute to 1 hour)
  • Revoked session tokens: retained until the token would have expired anyway — 30 minutes for an access token, 7 days for a refresh token

8. Your Rights

Depending on your jurisdiction, you may have the following rights:

  • Access: Access the personal information we hold about you. Most data is accessible directly through the Service.
  • Correction: Correct inaccurate personal information through the Service at any time.
  • Deletion: Request deletion of your personal information, subject to our legal retention obligations.
  • Data Portability: Download your account data as a structured, machine-readable JSON file covering your profile, logbook entries, reservations, currency items, billing entries, and endorsements. Your logbook and your invoices can also be downloaded as PDFs. Organization-wide reports can be exported as CSV by members whose permissions include reporting access.
  • Objection/Restriction: Object to or request restriction of certain processing.
  • Notification Preferences: Manage email and push notification preferences by category — reservations, currency, maintenance, members, billing, notices, endorsements, delay notifications, aircraft, flight sessions, dispatch, and check-out reminders. Preferences are set separately for each organization you belong to, and every category starts switched on until you turn it off. Transactional emails cannot be disabled.

To exercise these rights, contact privacy@hobbstack.com.

9. California Residents (CCPA/CPRA)

If you are a California resident, you have additional rights under the CCPA as amended by the CPRA:

  • Right to Know: Request disclosure of what personal information we collect, the sources, the purposes, and the third parties we share it with.
  • Right to Delete: Request deletion of your personal information, subject to certain exceptions.
  • Right to Correct: Request correction of inaccurate personal information.
  • Right to Opt-Out of Sale/Sharing: We do not sell personal information or share it for cross-context behavioral advertising.
  • Right to Non-Discrimination: We will not discriminate against you for exercising your rights.

To exercise these rights, contact privacy@hobbstack.com. We will respond within 45 days as required by law.

9.1 Categories of Personal Information (CCPA)

  • Identifiers: Name, email address, phone number, IP address, account ID
  • Customer records: Billing records, subscription information, payment history
  • Commercial information: Flight reservation records, aircraft usage, service purchases
  • Internet/electronic activity: Browsing history on our Service, search history, interaction data
  • Professional information: Pilot certificate type, CFI certificate number, flight qualifications
  • Geolocation: Approximate city and region, derived by our analytics provider from the IP addresses of marketing-site visitors; airport identifiers provided by you

10. Arizona Residents

Arizona does not currently have a comprehensive consumer data privacy statute equivalent to the CCPA. However, Arizona residents are entitled to the same rights described in Section 8. Hobbstack L.L.C. is organized under the laws of the State of Arizona and voluntarily extends data access, correction, and deletion rights to all users regardless of jurisdiction.

11. International Users

The Service is hosted in the United States and is primarily intended for use within the United States. If you access the Service from outside the United States, you consent to the transfer of your personal information to the United States, which may have different data protection laws than your country of residence.

For users subject to the EU/UK GDPR, we process your personal information on the legal bases of: (a) contract performance; (b) legitimate interests; and (c) consent (where applicable). You may exercise your GDPR rights by contacting privacy@hobbstack.com.

12. Children's Privacy

The Service is not directed to children under 13 years of age. We do not knowingly collect personal information from children under 13. If we become aware that we have collected personal information from a child under 13 without parental consent, we will delete that information promptly. Users between 13 and 18 may use the Service with parental or guardian consent, consistent with the minimum age requirements for student pilot certificates under 14 CFR § 61.83.

13. Push Notifications

The Service delivers push notifications two different ways, and they do not have the same privacy properties.

In a web browser. Browser notifications use the Web Push standard. When you opt in we store your push subscription address (provided by your browser's own push service), the two encryption keys used to protect the message contents, and your browser's user-agent string. The message is encrypted so that only your browser can read it, and we send it directly to your browser's push service. No separate notification vendor is involved on this path.

In the Hobbstack mobile apps. Notifications to the iOS and Android apps are sent through Expo's push service, which passes them to Apple's and Google's notification networks for delivery to your device. For these we store your device's push token and a short device label made up of the platform and the device name you have given it. The notification title and body travel through Expo, Apple, and Google, and that text often names a person, an aircraft, or a reservation. See Section 4.2.

You may revoke push notification permissions at any time through your browser or device settings, or through the Service's notification preferences.

14. Calendar Subscription (iCal) Feeds

The Service offers optional iCal subscription feeds for syncing your flight schedule with external calendar applications. When enabled:

  • Your feed address contains a long, unguessable token that is the only thing protecting it. Anyone who has the address can read the feed without signing in, so treat it like a password.
  • The feed carries more than your own schedule. Each entry includes the flight's start and end times, the aircraft type and tail number, departure and destination airports, a shortened reservation reference, your organization's name, and the full names of the pilot and the instructor on the booking, plus any free-text notes on the reservation — which means it can contain other members' names and notes, not only yours.
  • If you subscribe from Google Calendar, Outlook, or a similar service, that provider's servers fetch the feed on a schedule and will hold a copy of its contents.
  • Your feed address is created the first time you open the calendar sync screen, and the same address is returned every time after that. No feed is created for you unless you visit that screen, and none is published anywhere by us.
  • You may regenerate your token at any time, which immediately invalidates the previous address. A feed also stops working if you leave the organization, and each address expires after a year of use.

14a. Roadmap Interest Notifications

The public roadmap page (hobbstack.com/roadmap) offers a per-item “Email me when this ships” affordance. When you click it, we collect:

  • Your email address — lowercased and stored against the single roadmap item you subscribed to.
  • Your IP address — captured for spam triage; NULLed after 90 days by an automated retention sweep.
  • Your browser's user-agent string — truncated to 500 characters, used for spam triage.
  • A small browser cookie (hobbstack_roadmap_interest) — holds the short name of the roadmap item you most recently confirmed, so the page can show the “you're subscribed” state without asking the server. It holds that one item name only — never your email. 90-day expiry, Secure, SameSite=Lax.

Purpose: to email you exactly once when that specific roadmap item ships. We do NOT aggregate this list for general marketing — each subscription is scoped to one item and one notification.

Confirmation: you must click the confirmation link in the email we send before we’ll add you to the notification list. If you never confirm, the request is marked expired after 7 days and we will not email you about that item again. Note that expiring is not deletion — the row, including your email address, stays in our records. To have it removed, contact us at the address in Section 17.

Unsubscribe: every email includes an unsubscribe link. Clicking it removes you from that item's notification list immediately — no login and no reply required.

Retention: subscription rows are kept until you unsubscribe. IP addresses are erased after 90 days regardless of status, by an automated sweep. Email addresses are retained until you click the per-item unsubscribe link — including on rows that were never confirmed and have since expired. Nothing on this list is deleted automatically; use the unsubscribe link, or write to us, to have your address removed.

15. Data Breach Notification

In the event of a data breach that compromises your personal information, we will:

  • Notify affected users via email within 72 hours of becoming aware of the breach, where feasible.
  • Provide details about the nature of the breach, types of information affected, and steps we are taking.
  • Notify applicable regulatory authorities as required by law (including the Arizona Attorney General's Office as required by A.R.S. § 18-552).
  • Provide guidance on steps you can take to protect yourself.

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by: (a) updating the Effective Date; (b) displaying a prominent notice in the Service; and (c) where appropriate, by email. Your continued use of the Service after the effective date constitutes acceptance of the changes.

17. Contact Us

If you have questions about this Privacy Policy, please contact us:
Hobbstack L.L.C.
Email: privacy@hobbstack.com
General support: support@hobbstack.com
Website: hobbstack.com

For data access, correction, or deletion requests, please include your registered email address and a description of the data you are requesting. We will respond within 30 days (45 days for CCPA requests).

This Privacy Policy is effective as of August 5, 2026 and supersedes all prior versions.