1. Who is responsible for your information
Flyover is operated by Matthew Adams, an individual trading as Flyover in Scotland, United Kingdom. Matthew Adams is the controller of personal information processed to operate Flyover. For privacy enquiries or requests, contact [email protected].
Flyover is designed around data minimisation: activity files are processed on your device and saving to an account is optional. This policy explains the limits of that approach, including requests to map and weather providers.
A public business correspondence address has not yet been confirmed. This disclosure must be completed before public launch; the email above is available in the meantime.
2. Information Flyover processes
- Accounts: email address, optional display name, Supabase user identifier, authentication credentials handled by Supabase Auth, verification and recovery information, session tokens, account status and plan records. New registrations also record the acknowledged Terms version and server timestamp.
- Activities: GPS coordinates and route geometry, activity names, sports, dates, timestamps, distances, durations, elevation and gradient; pace, speed, heart rate, cadence and power where available. FIT imports can also contain movement dynamics, temperature, energy, session summaries and device make, product or name. Optional local analysis settings include resting/maximum heart rate, zones, a published coefficient variant, body mass and power thresholds. The saved route contains supported processed measurements and provenance, rather than the original file or its complete raw fields.
- Memories: titles, stories, captions, route-positioned Moments, notes, photographs, location labels, image paths and save/update metadata.
- Weather: the recorded start location and time, returned historical weather and its source, estimation status, retrieval time and station identifiers.
- Technical information: network addresses and request details handled by hosting and service providers, authentication and security events, and locally generated diagnostic information. Where enabled on the hosted site, Cloudflare Web Analytics provides page-view and performance statistics.
GPS routes can reveal your home, workplace, habits and other sensitive locations. Photographs, stories and filenames can also identify people. Review what you save and what appears in a film before sharing it. Only supply information about others where you have the necessary rights and a lawful basis.
Google Sign-In is not offered by this version of Flyover. It does not request Google profile information. If Google authentication is added, this policy must first explain the actual profile fields and Google’s role.
3. What stays on your device, and what leaves it
Original GPX and FIT files are read and parsed within your browser. Flyover’s application code does not upload or remotely persist those original files. Route analysis, cinematic rendering and video encoding run in the browser. Imported activity data stays in working memory while the activity is open; Flyover does not save a complete original activity file in browser storage.
Local processing is different from local persistence. Titles, Moments, stories, captions, editing drafts and preferences can remain in localStorage after the tab closes. Guest and uncommitted photographs are stored in IndexedDB. Local data is not protected by your Flyover password from someone using the same browser profile.
Choosing Save to Memories sends a processed route, including supported fitness measurements, selected photographs and Memory content to Supabase. Map requests leave your device when a map is displayed. Historical weather can send the activity’s exact start coordinates and recorded time through Supabase to Visual Crossing even for a guest, without a cloud save. Saving a new Memory can also trigger an approximate place-name lookup. “Processed locally” therefore does not mean that no information leaves your device.
4. Purposes and lawful bases
The following Article 6 UK GDPR bases apply to ordinary personal information. A separate Article 9 condition is also necessary wherever information reveals health or another special category.
- Providing the service you request — Article 6(1)(b), contract
- Creating and authenticating your account, verification and password recovery, processing activities, generating films, and saving, synchronising, retrieving and deleting Memories and photos. Requested map displays and historical weather lookups support these features.
- Operating and protecting Flyover — Article 6(1)(f), legitimate interests
- Preventing abuse, enforcing access controls and proportionate service limits, diagnosing failures, keeping a minimal deletion receipt, and understanding aggregate website performance. Our interests are a reliable, secure and usable service; processing must be necessary and balanced against your privacy. You may object.
- Complying with legal duties — Article 6(1)(c), legal obligation
- Responding to data protection requests and binding legal requirements, where a relevant legal duty applies. This is not a general permission to retain all content.
- Optional processing based on consent — Article 6(1)(a)
- Where a feature requires consent, it must be requested separately for that purpose, with a way to withdraw it. Agreeing to the Terms, importing a file or choosing a cloud save is not blanket GDPR consent.
Health-data review is outstanding. Heart-rate records and fitness analysis can reveal health and may be special-category data under UK GDPR. Flyover calculates personal fitness indicators; local computation does not automatically remove data protection obligations. This version has no separate explicit health-data consent flow and no established Article 9 condition. Article 9(2)(a) explicit consent is a candidate requiring legal assessment and implementation before such processing is offered at public launch. The Terms do not supply that consent. Until this is resolved, do not use this draft release to process health information.
Flyover does not use private activities or photographs for advertising, AI model training or AI processing. Fitness calculations evaluate aspects of physical performance and may constitute profiling, but are presented to you as analysis. Flyover does not make solely automated decisions producing legal or similarly significant effects about you.
5. Cloud storage and other service providers
Saved content is designed to be private to its account owner, rather than publicly listed or shared with other users. Service providers process information needed to operate their services, and authorised administration or legally required disclosure may still occur.
- Supabase provides authentication, account records, the database, private route and photo storage, server functions and weather caching. It receives account information, saved content and relevant requests. The linked project’s primary region was verified as London, UK (eu-west-2), on 17 October 2026. Storage and backup residency, Edge execution locations and subprocessor arrangements still require confirmation. We do not claim that all processing stays in the UK.
- Cloudflare provides website delivery through Pages and, according to the operator, Web Analytics. Delivery necessarily handles your IP address and HTTP request details. Web Analytics measures visits, browser/device characteristics, referring pages and page-load performance. Cloudflare describes Web Analytics as cookie-free, without localStorage identifiers or visitor fingerprinting. This does not mean Cloudflare never receives network information. Its live deployment and settings still require verification.
- OpenFreeMap supplies map styles and tiles using OpenMapTiles and OpenStreetMap data. Map requests disclose your IP address, browser request information and requested map areas/zoom levels. Tile areas can indicate the vicinity of a private route; the application does not send the original activity file to this provider.
- Mapzen/Tilezen terrain tiles hosted on AWS Open Data receive network requests for elevation tiles covering the viewed area.
- Esri’s World Imagery service supplies the default satellite layer and receives network and tile-area requests when imagery is loaded. Its imagery includes third-party contributors. A configured replacement imagery provider would require a corresponding policy update.
- Geoapify can receive a start location rounded to three decimal places through a Supabase server function to generate an approximate city/region label after saving. The function does not send your whole route, account name or photograph to Geoapify.
- Visual Crossing can receive exact recorded start coordinates and a time rounded to the nearest hour through Supabase for historical weather. Supabase also receives the original lookup time. Weather can be station-based estimation or modelled data, rather than a measurement taken at your location.
No dedicated external error-monitoring, advertising or session-replay service is integrated in this checkout. Hosting and authentication providers may maintain operational/security logs; their live settings and retention must be confirmed. Diagnostic reports you choose to share may contain activity details, so review them first.
6. Cookies and browser storage
The application does not set its own cookies. Supabase’s browser client persists authentication sessions in localStorage and refreshes tokens. Other localStorage entries preserve requested editing work, route titles, stories, Moments, film settings, units, heart-rate/power analysis settings and pending deletion state. IndexedDB stores local photographs. The browser may also cache downloaded resources normally.
Signing out does not erase every local draft, guest edit, preference or photograph. Use browser site-data controls to clear Flyover’s localStorage, IndexedDB and caches, particularly on shared devices. Clearing site data does not delete cloud content or revoke server sessions on other devices.
Cloudflare describes Web Analytics as using neither cookies nor localStorage for analytics. Cookie-free analytics and device storage are distinct. No advertising or cross-site tracking consent banner is installed. Essential session storage and storage needed to preserve work or settings you request are intended to serve those functions. A production storage and script check must confirm the applicable UK storage-access exemptions; any non-exempt storage or tracking will need consent before use. No exemption is assumed merely because a technology is cookie-free.
7. Retention and deletion
Saved activities and Memories are intended to remain until you remove them or close your account. You can delete a Memory or use Account → Delete Account. Account deletion requires your current password and typing DELETE. It removes cloud route objects and photographs, then associated Memories, Moments, profile, plan and image lifecycle records, followed by the authentication account. The browser clears account-associated drafts and owned local photos on the device completing deletion and signs out locally.
If deletion is interrupted, the account is closed to new saves and the interface offers a retry. Some data may already have been removed. Contact [email protected] if you cannot complete deletion. Previously issued signed photo links expire after up to one hour and should be treated as private access links. Copies already downloaded, shared or cached by a browser or another person cannot be recalled.
A minimal deletion receipt (account identifier and progress/completion times) remains for safe retries. Shared historical-weather cache entries can retain exact start coordinates and times independently of a Memory or account. Neither currently has an automatic expiry; retention limits and a reliable purge must be established before launch. Account-linked weather rate-limit records are removed on account deletion; other rate-limit entries, including hashed guest IP addresses, are pruned after 24 hours when a further lookup runs, rather than by a guaranteed timed job.
Guest drafts and preferences generally remain until cleared. Unreferenced local photographs become eligible for pruning after 30 days since last use, in bounded batches on later visits; referenced photos can remain longer. Deleting a cloud account does not clear unrelated guest work, other browser profiles or other devices.
Provider backups and operational/security records may persist separately. Backup and log retention periods are not yet verified, so we do not promise immediate erasure from every backup. Any legal retention must be limited to what is necessary for the specific obligation or claim. The operator must confirm a retention schedule and ensure deleted content is not reintroduced from a backup.
8. Hosting and international transfers
A UK database region alone does not keep every request within the UK. Cloudflare’s network, Supabase’s ancillary services and subprocessors, AWS terrain hosting, map services, Geoapify and Visual Crossing may process requests in other countries. Provider contracts, recipient locations and applicable safeguards have not all been verified.
Before launch, the operator must confirm which transfers rely on UK adequacy regulations and which require an appropriate safeguard, such as the UK International Data Transfer Agreement or UK Addendum to EU standard contractual clauses, together with any required transfer risk assessment. We do not claim those arrangements are already in place. Contact [email protected] for information about the arrangements once confirmed.
9. Security
Configured production provider endpoints use HTTPS. The database migrations implement owner-based Row Level Security, restrict privileged operations to server functions, and use private route and photograph buckets. Photographs use time-limited signed access URLs; uploaded photos are resized and re-encoded in the browser to drop original EXIF/GPS metadata. The visible image itself may still reveal a location or identity.
Privileged Supabase credentials belong only in the server runtime. These controls reduce risk but do not guarantee absolute security. Deployment configuration, applied migrations and provider access must be verified separately. Protect your password, email account, devices and any downloaded films or signed links.
10. Your data protection rights
Subject to the relevant legal conditions, you can request access to your personal information, correction, erasure, restriction, portability of information you supplied where applicable, and object to processing based on legitimate interests. Where consent is relied upon, you can withdraw it without affecting the lawfulness of processing before withdrawal. You can also raise concerns about automated processing.
Use account deletion for self-service closure, or contact [email protected] for these or other privacy requests, including a copy of saved data. We may need proportionate evidence of identity. We normally respond within one month; lawful extensions and exemptions may apply, and we will explain them.
You can complain to the UK Information Commissioner’s Office (ICO), or another competent supervisory authority where applicable. You do not have to contact us first.
11. Age and children’s information
Flyover is intended for people aged 16 and over. Do not create an account or use the service if you are under 16. We do not routinely request a date of birth. If you believe a child’s information has been supplied, contact [email protected]. The age restriction does not remove our responsibilities towards children whose information we may process; appropriate safeguards and any required children’s-design assessment must still be considered.
12. Changes and contact
Updated policies will carry a new effective date on this page. Material changes will be highlighted in the application or communicated to affected account holders by an appropriate notice, such as email, before new processing begins where required. New consent will be sought where legally necessary. A policy edit alone does not authorise a new purpose.
For questions, contact Matthew Adams at [email protected].