Legal

Privacy notice

Effective: 19 August 2026

FlyPath is operated by Dronnix Inc., 3608 33 St NW, Calgary, Alberta T2L 2A6, Canada, which is the controller of the personal data described here. This notice explains how we handle personal data when you visit FlyPath, join the beta, create an account, plan missions, or contact us. Questions and privacy requests can be sent through our contact form or to info@dronnix.com.

Data we collect

  • Account data: email address, optional name, authentication information, email-verification state, and Google profile details when you choose Google sign-in.
  • Mission data: mission names, survey boundaries, route waypoints, aircraft settings, estimates, and saved export settings.
  • Messages: contact-form messages and other information you submit.
  • Service and security data: session information, sign-in or request timestamps, and technical information needed to protect and operate the service.
  • Analytics data: page and device information collected by Google Analytics only after you select “Allow analytics.”

We also process your IP address transiently to apply rate limits and block abusive traffic. FlyPath is not intended for anyone under 16.

Why we use it

We process data to provide and secure your account, save and export missions, respond to requests, improve the beta, prevent abuse, and meet legal obligations. Depending on the activity, the legal basis is performance of our agreement with you, our legitimate interests in running and protecting the service, your consent, or compliance with law.

Cookies and analytics choices

Necessary cookies support sign-in, sessions, form security, and account features. They cannot be disabled through our preference panel. Google Analytics is optional and does not load until you allow it. You can change that choice at any time using “Cookie settings” in the footer. Refusing analytics does not limit the planner.

  • sessionid — keeps you signed in. Necessary. Expires after two weeks or at sign-out.
  • csrftoken — protects forms against cross-site request forgery. Necessary. Expires after one year.
  • _ga, _ga_* — Google Analytics measurement. Set only with your consent. Expire after two years.
  • flypath_analytics_consent — stores your analytics choice in your browser’s local storage, not as a cookie. Stays until you clear site data.

Who receives data

We do not sell personal data. We share it only with the providers needed to run FlyPath:

  • Google — sign-in when you choose it, Google Analytics after you consent, and Google Fonts, which receives your IP address when a page loads a font.
  • Esri and OpenStreetMap contributors — basemap and satellite tiles. Loading the map sends your IP address and the map area you are viewing, which reflects where you are planning.
  • OpenStreetMap Nominatim and Komoot Photon — place search and reverse geocoding. These receive the coordinates you search or click.
  • unpkg — delivers the Leaflet map library and receives your IP address on page load.
  • Postmark — sends account, verification, and notification email.
  • Hosting and infrastructure providers — operate the servers and database that store your account and mission data.

Saved mission boundaries are stored on our own infrastructure and are not sent to map or geocoding providers; only the area you view or search is visible to them.

Some providers are located outside the European Economic Area. Where we transfer personal data to them, we rely on an adequacy decision for that country or on the European Commission’s Standard Contractual Clauses, together with the provider’s own safeguards. You can ask us for details through the contact form.

Retention and security

We keep account and mission data while your beta account is active, and delete it within 30 days of account closure or a deletion request, except where we must keep records to meet a legal obligation. Contact messages are kept for 24 months. Newsletter subscriptions are kept until you unsubscribe or ask us to remove you. Google Analytics data expires after 14 months. Security and rate-limit records are kept for 30 days. We use access controls, secure transport, rate limits, and other safeguards, but no online service can guarantee absolute security.

Your choices and rights

Depending on where you live, you may have rights to access, correct, delete, restrict, or export your personal data, object to certain processing, withdraw consent, and complain to a supervisory authority. As a Canadian company we handle personal data under PIPEDA and Alberta’s Personal Information Protection Act; complaints can go to the Office of the Privacy Commissioner of Canada or the Office of the Information and Privacy Commissioner of Alberta. If you are in the EEA or the UK, you may also complain to your local data protection authority. Use our contact form or email info@dronnix.com to reach us; we respond within one month. Withdrawing consent does not affect processing that occurred before withdrawal.

Changes

We may update this notice as the beta develops. We will update the effective date and provide additional notice when a material change requires it.