Privacy Policy
NIMBLE AERO SARLAU • Casablanca, Morocco
NIMBLE AERO SARLAU ("we," "us," or "our") operates the Nimble Preflight mobile application (the "App"). This Privacy Policy explains what information we collect, how we use it, and your rights regarding your data.
1. Who We Are
We are NIMBLE AERO SARLAU, a company registered under Moroccan law (Société à Responsabilité Limitée à Associé Unique — single-member LLC), headquartered in Casablanca, Morocco.
For questions about this Privacy Policy, contact us at: [email protected]
2. Information We Collect
We do not create user accounts, and we collect only the minimum data necessary to operate the App.
The App is designed with a data-minimalist philosophy. Here is exactly what we process:
2.1 Information Automatically Processed
When you use the App, your device communicates with our servers to retrieve aviation weather and NOTAM data. In this process:
- IP Address: Your IP address is transmitted as part of standard internet communication. We use it solely for rate limiting (to prevent abuse) and routing your request. We do not log, store, or share your IP address. It exists only transiently in server memory for the duration of your request.
2.2 Device Identifier — Offered Access and Live Flight Tracking
The App uses an identifier that your device's operating system provides to the App: on Android, the app-specific Android ID; on iOS, the identifier for vendor (IDFV). If neither is available, the App generates a random identifier instead. This identifier is specific to Nimble Preflight: it is not your advertising identifier, and it is not a hardware identifier such as an IMEI or serial number. It is sent to our servers over an encrypted connection, for two purposes only:
- Offered access period: Each time the App starts, it sends the identifier to our servers to check whether a period of offered full access applies to your device. When an offer is active, we use the identifier to grant that period once per device and to prevent it from being granted again. We store it only in hashed form (a keyed cryptographic hash, from which the identifier cannot be read back), together with the platform, the start and end dates of the period, the app version at first launch, the date of the last check, and a count of checks. When no offer is active, nothing is stored. On iOS, the App keeps the identifier in the device's secure keychain, which iOS may preserve if the App is uninstalled.
- Live flight tracking: The App includes an optional live flight tracking feature powered by Flightradar24. When you use it, we store the identifier as received, together with the number of lookups used and the dates of first and last use, to manage your monthly allowance (10 lookups per month). When you search for a flight, the flight number you searched for is logged alongside your identifier for credit accounting purposes.
The identifier is used solely for these two purposes. It is not used for profiling, advertising, or any other purpose, and it is not linked to your name, email address, or any account.
2.3 Information Stored on Your Device
The App stores the following data locally on your device (never transmitted to us):
- Your airport watchlist (ICAO codes you select)
- Cached weather data (METAR, TAF, SIGMET) for offline access
- Cached NOTAM data for offline access
- Your app settings and preferences
- Decoded SNOWTAM and GRF results
- Pilot notes (ATIS, clearances, free text)
This data is stored using standard Android/iOS local storage and is deleted if you uninstall the App.
2.4 Analytics & Crash Reporting
The App uses Google Firebase Analytics and Google Firebase Crashlytics to help us understand how the App is used and to identify and fix crashes.
- Firebase Analytics collects usage data such as screen views, feature usage frequency, and session duration. Some events include the airport code or flight number you looked up. This data is pseudonymous: it is linked to the installation identifier described below, never to your name, email address, or phone number.
- Firebase Crashlytics collects crash reports including device model, operating system version, stack traces, and app state at the time of a crash, which may include the airport code you were viewing. This helps us fix bugs and improve stability. Crashlytics does not collect personal data such as names, emails, or location.
- Installation identifier: Each installation of the App generates a random identifier on your device. It is attached to analytics events and crash reports so that we can count "5 pilots affected by an issue" versus "1 pilot affected 5 times" without identifying you. It is different from the device identifier described in section 2.2, and a new one is generated if you reinstall the App.
- Advertising identifier (Android): On Android, Firebase Analytics may access your device's advertising ID for measurement purposes only — to understand how the App is used and to measure performance. We do not use it to serve or target advertising, we do not track you across other apps or websites, and we never sell your data. On iOS, the App does not request tracking and does not use the iOS advertising identifier (IDFA).
Both services are provided by Google LLC and process data according to Google's Firebase privacy documentation.
2.5 Information We Do NOT Collect
We do not collect: names, email addresses, phone numbers, GPS location data, or hardware device identifiers (IMEI, serial number). As described in section 2.4, Firebase Analytics may access your device's advertising ID on Android for measurement only — we do not use it for advertising or to track you across other apps.
3. How We Use Information
| Data | Purpose | Legal Basis (GDPR) |
|---|---|---|
| IP address (transient) | Rate limiting and request routing | Legitimate interest — service delivery and abuse prevention (Art. 6(1)(f)) |
| Device identifier (hashed) | Granting one offered access period per device and preventing repeat offers | Legitimate interest — fair provision of the offered access period (Art. 6(1)(f)) |
| Device identifier | Flight tracking credit management | Legitimate interest — preventing service abuse (Art. 6(1)(f)) |
| Flight number searched | Credit transaction logging | Legitimate interest — service accounting (Art. 6(1)(f)) |
| Installation identifier | Crash and analytics user-grouping (severity counting) | Legitimate interest — product improvement (Art. 6(1)(f)) |
| Analytics data (pseudonymous) | App improvement and feature usage analysis | Legitimate interest — product improvement (Art. 6(1)(f)) |
| Advertising ID (Android) | Analytics measurement only — usage and performance (never advertising) | Legitimate interest — product improvement (Art. 6(1)(f)) |
| Crash reports | Bug identification and stability improvement | Legitimate interest — service reliability (Art. 6(1)(f)) |
We do not use your data for advertising, profiling, marketing, or any purpose other than delivering and improving the App's core functionality.
4. Data Sharing
We do not sell, rent, trade, or share any personal data with third parties.
The App retrieves aviation data from the following sources on your behalf:
- NOAA Aviation Weather Center (US federal government) — for METAR, TAF, and SIGMET data
- FAA Notice to Air Missions System (US federal government) — for NOTAM data
- Deutscher Wetterdienst (DWD) (Germany) — Germany's national meteorological service — for METAR, TAF, SIGMET, AIRMET, AIREP (pilot reports), and aviation weather chart data
- ECMWF (European Centre for Medium-Range Weather Forecasts) (international organisation) — for precipitation forecast charts
- Flightradar24 AB (Sweden) — for live flight tracking data (situational awareness only)
Our servers retrieve aviation data from these sources on your behalf. Your device communicates only with our servers — it does not connect directly to NOAA, FAA, DWD, ECMWF, or Flightradar24 servers. No personal data is transmitted to these data providers.
When you use the live flight tracking feature, a request containing the flight number is sent from our servers to Flightradar24. Flightradar24 may process this request according to their own privacy policy.
Analytics & Crash Reporting: Pseudonymous analytics data and crash reports are processed by Google Firebase (Google LLC, USA). Google processes this data according to their Firebase privacy documentation. We do not share your name, email address, or phone number with Google — we do not collect them.
Subscriptions: If you subscribe to the App, Google Play or the Apple App Store processes your payment. We use RevenueCat, Inc. (USA) to manage subscriptions: the RevenueCat software in the App identifies your installation with an anonymous identifier generated by RevenueCat, and receives your subscription status from Google or Apple. We never receive your payment details, name, or email address, and we do not provide them to RevenueCat. Google, Apple, and RevenueCat process data according to their own privacy policies — see RevenueCat's privacy policy.
5. International Data Transfer
Our servers are hosted in the United States (Oregon) via Render, Inc. When you use the App, your request (including your IP address) is routed to these servers. This constitutes a transfer of data to the United States. We rely on the necessity of the transfer for the performance of the service (Art. 49(1)(b) GDPR) as the legal basis for this transfer.
Aviation meteorological data served by the App may originate from the Deutscher Wetterdienst (DWD) in Germany, the NOAA Aviation Weather Center in the United States, the FAA in the United States, and the European Centre for Medium-Range Weather Forecasts (ECMWF), an intergovernmental organisation. This data is retrieved server-to-server by our backend — your device does not connect to these sources directly, and no personal data is transmitted to them.
Pseudonymous analytics and crash report data is processed by Google Firebase, which may transfer data to Google's servers in the United States. This transfer is governed by Google's data processing terms and standard contractual clauses. Subscription status information is processed by RevenueCat in the United States.
6. Data Retention
- IP addresses: Not retained. Processed transiently during your request only.
- Device identifier, offered access (hashed): Retained on our server for up to 12 months after the App last checked the offered access period. After 12 months without such a check, the record is automatically deleted.
- Device identifier (flight tracking): Retained on our server for up to 90 days from your last use of the flight tracking feature. After 90 days of inactivity, your record is automatically deleted.
- Installation identifier: Kept on your device until you uninstall the App. Copies attached to analytics events and crash reports follow the analytics and crash-report retention periods below.
- Flight tracking transaction logs: Retained for up to 180 days, then automatically deleted.
- Analytics data: Retained by Google Firebase for up to 14 months, then automatically deleted. This data is pseudonymous.
- Crash reports: Retained by Google Firebase Crashlytics for up to 90 days.
- Local device data: Retained on your device until you clear the App's data or uninstall the App.
- Server-side aviation data: METAR, TAF, NOTAM, and SIGMET data is retained on our servers for the purpose of serving it to all users. This is not personal data.
7. Your Rights
Under GDPR (for EU/EEA users), Morocco's Law 09-08, and other applicable data protection laws, you have the right to:
- Access any personal data we hold about you
- Rectification of inaccurate data
- Erasure ("right to be forgotten")
- Object to processing based on legitimate interest
- Data portability — receive your data in a structured format
- Withdraw consent for crash and analytics reporting at any time via Settings → Privacy → Send crash reports in the App
To exercise any of these rights, contact us at [email protected] and we will respond within 30 days. The App does not display the identifiers described above, and we do not hold your name or contact details, so we may not always be able to link a request to your records; if so, we will tell you. Records on our server are in any case deleted automatically after the periods set out in section 6.
For EU/EEA users: You have the right to lodge a complaint with your local data protection supervisory authority.
For Moroccan users: You may exercise your rights through the CNDP (Commission Nationale de Contrôle de la Protection des Données à Caractère Personnel) at www.cndp.ma.
8. Children's Privacy
The App is designed for professional and student pilots. It is not directed at children under the age of 16 (or under 13 in the United States under COPPA). We do not knowingly collect data from children. If you believe a child has provided us with data, contact us at [email protected] and we will promptly delete it.
9. Security
We protect your data through encrypted connections (HTTPS/TLS), database access restrictions, API authentication, and regular security reviews. While no system is perfectly secure, we take reasonable measures to protect the limited data we process.
10. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by updating the "Last updated" date at the top of this document. The current version is always available within the App and at nimbleaero.com/privacy. Continued use of the App after changes constitutes acceptance of the updated policy.
11. Contact
NIMBLE AERO SARLAU
Casablanca, Morocco