CVFR Nav — Privacy Policy

Effective: 27 October 2026

CVFR Nav is a moving-map assistant for VFR pilots in Israel. This policy covers the version of the app on the App Store.

What the app collects

The developer receives no data from the App Store version of CVFR Nav: no account, no analytics, no advertising, no tracking. (The developer's own services are hosted by Vercel, which keeps short-lived request logs — see Services the app contacts.) The one thing that leaves the device on its own is an approximate position for the weather forecast, sent to Open-Meteo and not linked to you (see Weather below).

What stays on your device

• Your position, from the device's location services, is used on the device to draw the map and raise alerts. It is not sent to the developer.
• Recorded flights (track, altitude, the device's motion and barometer readings, events, a line about the device's health once a minute — the app's processor use, battery level, how warm the device is, whether Low Power Mode is on — and what the map showed during the flight: the active flight plan's route and aircraft — callsign, type, persons on board, not your filed plan's text with your name, licence and phone, and not the weight-and-balance load (the weights of pilot and passengers), which stays with the saved plan — the NOTAMs in force, the radio reports and the aerodrome weather reports) and, if you switch it on, cockpit audio are saved in the app's own storage on your device. They leave it when you share or export a flight yourself, to the destination you choose, and — with Sync flights and plans with iCloud on (Settings → Data and about; on unless you switch it off) — in your own iCloud Drive, so your other devices signed in to the same Apple Account have the same flights — and the flight videos you make, which leave the device a week after they reached iCloud and stay there until you delete them. That copy is stored by Apple under your account (Apple's privacy policy); the developer cannot read it. It is also shown in the Files app (iCloud Drive → CVFR Nav). Each flight goes with its signature, made with a key that never leaves this device, and that key's public half — the same for every flight from the device — so your other devices can tell when a flight was changed after it was signed. Deleting a flight in the app deletes it on all your devices. Beside each flight the app keeps its approach debrief (<flight>.approaches.json: each approach's runway, heights, speeds and track as the flight page judges them, worked out from the flight itself) — on the device and, with that sync on, in the same iCloud folder, for your own video tool on your PC; it goes and is deleted with its flight, and holds nothing the flight does not. Each flight file also names the device it was recorded on: the fingerprint of that device's signing key (a short code, the same on every flight from the device), the exact device model and the system version. It travels with the flight wherever the flight goes — a flight you share or export, the iCloud sync and a test build's upload (below). CVFR Nav assumes your Apple Account is yours alone and that every device signed in to it is your own: an account or a device shared between several people (a club iPad, say) shares their flights and cockpit audio too, at the account holder's own choice and responsibility — switch sync off on such a device.
• Flight videos you make are kept on the device until you delete them (or, with sync on, a week after they reached iCloud, as above). Save to Photos adds a video to your photo library when you tap it; the app asks only to add photos, never to read them.
• Saved plans and planning details — each plan (with its weight-and-balance load: the weights of pilot and passengers), your pilot details (name, licence, phone), each aircraft's record with its free-flight weight-and-balance load (the weights you entered for a flight without a plan) and the flight-planning settings — are kept in the app's storage and, with Sync flights and plans with iCloud on and the device signed in to iCloud with iCloud Drive on, in your own iCloud Drive (Files → iCloud Drive → CVFR Nav → Planning), so your other devices on the same Apple Account have the same plans (since 2026-10-18). That copy is stored by Apple under your account; the developer cannot read it. Deleting a plan deletes it on all your devices.
• The flight plan email: when you tap to send a plan, the app hands the email — the plan's ICAO text, a short note, and your name, licence number and phone from your pilot details — to your own default mail app as a link, addressed to the briefing office (ais@iaa.gov.il). Nothing is sent by the app itself, and nothing goes to the developer: you send it, or not, from your mail app, under that app's own terms.
• Flight briefs (PDF) hold the plan with your name, licence and phone. The app keeps them only until you have shared or saved them; they are cleared at the next launch.
• Weather: for the forecast, the app sends Open-Meteo (open-meteo.com) points rounded to about a kilometre — along a flight plan's route, the aircraft's position for the wind shown on the map (when it has moved 10 NM, or every 30 minutes), a spot you tap — with the hours wanted; nothing else about you. Open-Meteo keeps its request logs (which include those points and your internet address) for up to 90 days to run its service, and shares them with no one (its terms). The aerodrome reports come from the Israel Meteorological Service (ims.gov.il) and NOAA's Aviation Weather Center (aviationweather.gov) and need nothing from you. Nothing goes to the developer.
• The barometer offset the app learns for your phone is kept on the device.
• Photos of the sky for the cloud-cover estimate are analysed on the device and not stored or sent anywhere.
• Your GoPro, if you pair one (Settings → Recording and audio → GoPro): the app talks to that camera over Bluetooth, and only to it — to set its date, time and time zone from your phone and to start and stop its recording with yours. iOS asks for Bluetooth only when you tap "Pair a GoPro". The app keeps the camera's name and the identifier iOS gives it on this phone; nothing about the camera or its footage is sent anywhere, and the app never reads the camera's media. What happened (clock set, recording started or stopped, the HiLight tags sent while recording) is written into the recorded flight. With auto record on, the app may start and stop the camera while it runs in the background — iOS's Bluetooth background mode, used only to reach the paired camera by its identifier, never to look for other devices.
• Auto record (off unless you choose a headset in Settings → Recording and audio → Auto record): when that headset connects, the app starts an ordinary recording, and stops it a few minutes after it disconnects. To hear the headset connect, iOS must keep the app running, so while auto record is on the app keeps a coarse location (about 3 km, from cell towers and Wi-Fi, no GPS; iOS shows the location arrow) — in the background on the ground with nothing recording the GPS, the alerts and the weather requests stop. (In the air the app keeps running in the background with its GPS, so the alerts go on whether or not you record; on the ground it stops.) That coarse location is used only to keep the app running; it is not stored and not sent anywhere. To offer the headsets to choose from, the app remembers the headsets it has seen as an audio route (at most eight: the name iOS gives each and its Bluetooth device address, or a wired port's identifier) — only while auto record is on; they stay on the device and are never synced.
• Settings other than the flight-planning ones stay on the device (the map, alerts, audio and recording settings are never synced); a recording keeps a copy of the plan it was flown with, as above.
• The diagnostic log — a rolling log of what the app did (screens opened, flights saved and replayed, memory use, problems), kept with iOS's crash reports in the app's own storage on the device so a problem can be found afterwards. It holds no names, no audio and no NOTAM text; positions in it are rounded to about a kilometre. It keeps about two days and at most 1 MB, the oldest deleted first. It never leaves the device on its own: only when you share it yourself (Settings → Data and about → Share diagnostics), to the destination you choose.

Services the app contacts

• NOTAM feed — the app downloads the public NOTAM list from arielf-idra.github.io (GitHub Pages). The request carries no information about you or your position; like any web request it reaches GitHub with your device's IP address (GitHub's privacy statement).
• Edition file — the app reads which edition of the CAA chart is currently published from arielf-idra.github.io/cvfr-nav/edition.json (GitHub Pages), to tell you when its data is out of date. The request carries nothing about you or your position.
• Version file — at launch the app reads arielf-idra.github.io/cvfr-nav/version.json (GitHub Pages) to tell you when a newer version is available: the App Store's line for the App Store version, the TestFlight lines (internal or external testers) for a test build. The comparison is made on the device; the request carries nothing about you, your version or your position.
• Radio reports — while the app is open or recording a flight, it asks once a minute for the runway, wind and QNH read from public air traffic radio, from the developer's isr-atc service (llhz-now.vercel.app and isr-atc.idra-tech.io, hosted by Vercel). The request names only the airfield or unit; it carries nothing about you or your position. Like any web request it reaches the host with your device's IP address; Vercel keeps short-lived request logs (IP address, time, path), which the developer does not use to identify anyone (Vercel's privacy policy).
• Aerodrome weather — every 10 minutes while the app is open or recording, the app reads the aerodrome reports and forecasts from the Israel Meteorological Service (ims.gov.il) and NOAA's Aviation Weather Center (aviationweather.gov). The requests carry nothing about you or your position; like any web request they reach those hosts with your device's IP address.
• CVFR Nav's weather service — every 10 minutes while the app is open or recording, the app asks the developer's own service (on Vercel) for the Israel Meteorological Service's station readings. The request carries the app's key and nothing about you or your position; like any web request it reaches the host with your device's IP address. The developer's hosting provider, Vercel, keeps short-lived request logs (IP address, time, path), which the developer does not use to identify anyone (Vercel's privacy policy). The same service gives Megiddo aerodrome's runway wind, read from the aerodrome operator's own wind station (with the operator's agreement): the app asks for it at most once a minute, only while Megiddo is in the plan on screen, tapped on the map, or within about 25 NM. That request names only the aerodrome and carries nothing about you or your position — the app's distance to Megiddo is worked out on the phone; the service, not your phone, contacts the operator's station.
• The app's identification in web requests — every request above carries iOS's standard User-Agent header, which names the app, its build number and the iOS networking version (for example "CVFRNav/1193 CFNetwork/… Darwin/…"); nothing that identifies you or the device.
• Apple Maps — the map background and the place name shown when you tap the map come from Apple's map services, under Apple's privacy policy.

The US region (test builds only, for now)

Test builds can be switched to a basic US region (Settings → Region; not offered in the App Store version, which always runs in Israel). There the app asks NOAA's Aviation Weather Center (aviationweather.gov, the US government's public data service) for the METARs of the stations round the aircraft, for the altimeter setting: the request names a box of about 100 NM round the aircraft with its corners rounded to two decimals (about a kilometre), at most every 10 minutes or 25 NM, only while the app is on screen or recording. Nothing else about you is sent; like any web request it reaches the host with your device's IP address.

The Android app

The Android app (Google Play) works the same way and keeps the same data on the device, with these differences:

• Map — the map background comes from Google Maps (the Maps SDK for Android), under Google's privacy policy; the app sends it no position of yours beyond what drawing the map in view requires, and shows your position on it from the phone's GPS itself.
• Sync through your own Google Drive, if you turn it on — "Sync plans with Google Drive" (Settings → Data and about → Your devices) copies your plans (with their weight and balance and navigation map), your pilot details, aircraft and flight-planning settings between your Android devices through a hidden folder of your own Google Drive that only CVFR Nav reads (Google's "app data" folder, scope drive.appdata); nothing of the map, alerts, audio or recording settings, and not the flights. You sign in with your Google account on the phone; the app keeps the sign-in token encrypted on the phone and your account's address, nothing else, and "Sign out" revokes the token at Google. The developer sees none of it: there is no server of ours in the path. Off, flights and plans stay on the phone. A flight leaves the phone only when you share its file — or, in a test build given to invited test pilots, as the TestFlight section below describes: those builds send recorded flights to the developer through CVFR Nav's own service while "Send recordings to the developer" is on in Settings (on by default there; off, nothing is sent). A store build sends nothing.
• Permissions — location is asked for once per launch when missing (refused, the map says so with the way to Settings); notifications are asked for at the first Record, for the recording's own notification and for alerts while the app is not on screen; the microphone only when you switch cockpit audio on; Bluetooth ("Nearby devices") only when you pair a GoPro, and only for that camera; the camera or the photo picker only when you ask for cloud cover from a photo — the photo is read on the phone and never leaves it.
• Services — the same services as above (the NOTAM feed, the edition file, the version file — its Google Play line — the radio reports, the aerodrome weather, CVFR Nav's weather service for the Israel Meteorological Service's station readings — the request carries the app's key and nothing about you or your position, and Vercel keeps short-lived request logs as above — and Open-Meteo for the forecast with coordinates rounded to two decimals); nothing is asked for without a network.
• Recording device — each flight records the phone it was recorded on, as on iOS: the model, the Android version and the fingerprint of the signing key the app made on this phone (an opaque id, not the phone's own identifiers); the flight is signed with that key. A flight shared or sent carries it.
• Auto record — as on iOS, headset only and off by default; while it is on, a foreground service (its notification shown) keeps the app running with no GPS until the headset connects, and the headsets seen are remembered by device address and name, only while it is on, on the phone.
• Diagnostic log — kept on the phone as on iOS (no names, positions to about a kilometre, about two days, at most 1 MB), and leaves it only when you share it yourself.
• Crash and usage data — none is collected by the app. Google Play may report crashes to the developer under its own terms.

Test builds (TestFlight)

Pre-release builds given to invited test pilots send recorded flights to the developer while "Send recordings to the developer" is on in Settings — on by default in those builds, and the tester can switch it off: the track, the sensor log, the settings the flight was recorded with, the plan flown (route, callsign, aircraft, persons on board — not the filed plan's text nor the weight-and-balance load), the device-health lines (processor use, battery, how warm, Low Power Mode), the NOTAMs and radio reports seen during the flight, crash reports, the name the tester enters, the flight's signature with this device's public signing key (the same on every flight from the device, so it identifies the device; the developer's check notes a signing key not seen before for that tester), and the cockpit audio only if its own switch (off by default) is on too. Test builds also turn a Lightspeed Delta Zulu headset's Flight Recorder on and off at Record and Stop over the headset's own data channel, and write what was exchanged into the flight (the commands and the headset's replies — for a reply that may carry the headset's serial number, only its command and length). The App Store version cannot send anything. They are stored in Apple's CloudKit for the developer to find problems, and deleted on request.

Children

The app is not directed at children and collects nothing from anyone.

Changes and contact

Changes to this policy are published at this address with a new effective date. Questions: cvfr.support@idra-tech.io.