Privacy & Data Collection Policy
Last updated: 8 July 2026
- Skyvex Software collects only a small subset of your flight data, enough to show your airline's activity, meter usage, and bill accurately.
- For pilot data, your virtual airline is the controller. Skyvex Software processes it on the airline's behalf.
- We do not collect your IP address, email, or device identifiers through the relay. Your last name is stored as an initial only.
- Your full flight data goes from the Stratos client straight to your airline's own backend, not through us.
- Your data is stored in Australia. We do not sell it.
This Privacy & Data Collection Policy (the policy) explains what data Skyvex Software collects through Stratos, why we collect it, who controls it, where it is stored, and what rights you have over it. It applies to the Stratos client, the Stratos mobile companion app, the relay, the Skyvex Software service, and the marketing site at skyvexsoftware.com. Stratos is built by Skyvex Software Pty Ltd (ABN 21 693 871 019, ACN 693 871 019), a company based in Queensland, Australia (Skyvex Software, we, us, our).
Who we are
Skyvex Software Pty Ltd is an Australian company based in Queensland. We build Stratos, a multi-simulator ACARS client for virtual airlines. A virtual airline owner or administrator signs up to Skyvex Software, creates an airline, and connects the airline's own backend (a phpVMS installation or a custom system). Skyvex Software does not host a virtual airline's backend.
How the relay works
A pilot does not sign in to Skyvex Software directly. A pilot signs in through their virtual airline, which authenticates them against the airline's own backend. Skyvex Software then mints a short-lived relay token and creates a pilot record so the airline can see its activity and so we can meter usage and bill accurately.
Each relay token expires after 30 days. We store only a hash of each token, never the token itself; plain-text tokens are never stored. A stored hash cannot be used to reconstruct the token it was derived from.
Who controls your data
Stratos uses a hybrid model. For some data Skyvex Software is the controller, and for other data Skyvex Software is a processor acting on behalf of a virtual airline. The distinction matters, because it determines who you contact to exercise your rights.
Skyvex Software is the controller of airline account and billing data, waitlist and website data, and aggregate platform data. We decide how that data is collected and used, and you contact us directly about it.
Skyvex Software is a processor of pilot identity, flight, and support data. We process that data on behalf of the virtual airline that authenticates the pilot. For that data, the airline is the controller. A pilot's name and last initial are managed by the airline: to change them, a pilot contacts their airline, and the next sign-in to Stratos updates them automatically. A pilot's first point of contact for access to or deletion of their data is their airline. We assist the airline as its processor.
Because a pilot authenticates through their virtual airline rather than through Skyvex Software, the airline, as the controller of pilot data, is responsible for telling its pilots what is collected and why at the point of collection. As a processor, Skyvex Software does not issue separate collection notices to a pilot.
The data we collect
The table below sets out each category of data Skyvex Software collects, what it contains, why we collect it, whether we are the controller or a processor, and how long we keep it.
| Category | What we collect | Why | Our role | Retention |
|---|---|---|---|---|
| Pilot identity (via relay) | First name, last-name initial only, the airline's pilot ID, and airline; no email, IP, or device ID | Attribute activity to a pilot within their airline | Processor (the airline is the controller) | While the airline's account is active |
| Flight position and summary | Latitude, longitude, altitude, heading, ground speed, and flight phase; aircraft type and livery; simulator and version; flight number, route, and departure/arrival; and, when a flight ends, the landing rate, a short landing report, fuel used, flight time, and distance flown | Live tracking, usage metering, and billing | Processor | While the account is active, then anonymised |
| Support | Messages you send, and the Stratos client's internal database, operational data about the client only, which does not contain personal data | Diagnose issues you raise | Processor | While the account is active |
| Plugin installs | Which plugins a pilot has installed | Deliver the plugins the pilot or airline enabled | Processor | While installed |
| Airline account | Name, email, airline details, billing | Operate the account and billing | Controller | While the account is active |
| Waitlist / website | Name, email, airline name and website, current ACARS, and your IP address and user-agent (for security) | Manage the waitlist and prevent abuse | Controller | Until you ask us to remove it, or 24 months of inactivity, whichever is first |
On a narrow screen the table stacks into one block per category, each headed by its category name.
Your airline can configure the Stratos client to send additional flight data (such as engine, fuel, weather, and other telemetry) to the airline's own backend. That additional data goes from the Stratos client to your airline directly. It is never sent to, seen by, or stored by Skyvex Software.
What we do not collect through the relay
The relay is built to carry a small amount of flight data, not to identify the person flying. Through the relay we do not collect your IP address, your email address, or any device, operating-system, or hardware identifier. We do not capture screenshots, and we do not capture audio. An email is associated with you only if you separately hold a Skyvex Software account and link it.
The Stratos mobile companion app
Skyvex Software also publishes the Stratos mobile companion app for iOS and Android. It is a companion to the Stratos desktop client: it lets a pilot watch their own live flight on a map, follow that flight's events, and pause or resume the flight remotely. The app never connects to a simulator itself, and it does not request or use your device's location.
To use the app you sign in with your Skyvex Software account using OAuth. This is our own first-party sign-in. There is no other third-party or social sign-in, and we do not share your sign-in with any external service. Signing in associates the app with your account so it can show you your own flight. The app collects only what it needs to work:
- Account identifier. The identifier for your Skyvex Software account, used only to sign you in and show you your own flight.
- Push-notification token. If you turn on notifications, your device's operating system issues a token that we use to send you notifications about your flight. It is handled by your device's push service and used only to deliver those notifications.
- Camera (device linking). To link your phone to your desktop flight, the app scans a QR code shown in the Stratos desktop client. The camera is used only to read that code; the image is processed on your device and is never stored or transmitted. You can also link without the camera by entering the code by hand.
The app contains no advertising, no third-party analytics or tracking, and no in-app purchases. It does not collect your location, your contacts, or your photos.
Why we store only your initial
We store only the first initial of a pilot's last name, not the full name. This is a deliberate choice to reduce how identifiable the data is while still letting an airline tell its pilots apart.
How we use the data
- show a virtual airline its activity and live flights;
- meter usage and bill an account accurately;
- diagnose and resolve the support issues you raise;
- keep the service reliable and secure, including detecting and preventing abuse.
We do not use individual pilot flight data for advertising, and we do not profile individual pilots. We do publish aggregate, de-identified statistics about Stratos as a whole, such as the total number of pilots, flights, and hours flown across the platform, which appear on our website. These aggregates cannot identify an individual pilot or flight.
Where your data is stored
Your data is stored in Australia, on infrastructure provided by DigitalOcean and Vultr. We use a small number of sub-processors to operate the service:
- Cloudflare. Content delivery and DNS. This is an international service, so some requests and archived flight records are served through Cloudflare's global network.
- Postmark. Transactional email, operated in the United States. We use Postmark to send account and service emails, such as verification and password-reset messages.
Cloudflare and Postmark operate internationally, so a limited amount of data is handled outside Australia. Before we engage an overseas sub-processor, we assess it and put contractual arrangements in place that require it to handle personal data consistently with the Australian Privacy Principles. We keep this list current, and where we make a material change to our sub-processors we take reasonable steps to make it known. We do not add a sub-processor that handles personal data without a lawful basis to do so.
Sharing
We do not sell personal data, and we never have. We do not trade, rent, or otherwise make personal data available for anyone else's marketing.
Your full flight and PIREP data is sent by the Stratos client directly to your airline's own backend. Skyvex Software is not in that path and does not receive it. We do not share the limited data we do hold with anyone beyond the sub-processors listed above.
How we protect your data
We take reasonable technical and organisational steps to protect personal data from loss, misuse, and unauthorised access:
- all data in transit is encrypted with TLS (SSL), and data at rest is encrypted;
- we back up the database twice daily and keep point-in-time recovery for the past 30 days, so we can restore data after an incident;
- relay tokens are stored only as hashes, never in plain text;
- we minimise what we collect, storing only a last-name initial, so that less is ever at risk;
- access to production data is limited to the people who need it to operate the service.
No method of storage or transmission is ever completely secure, but these measures are designed to keep the risk low.
Your rights
You can ask to access, correct, export, or delete the personal data we hold. For data where Skyvex Software is the controller (your airline account and website data), contact us directly and we will handle it. We can produce an export of a user's flights and the data we hold on request.
For pilot data, your virtual airline is the controller. A pilot should contact their airline to access, correct, or delete that data, and Skyvex Software will assist the airline as its processor. A pilot's name and last initial are corrected on the airline's side and update automatically at the next Stratos sign-in.
Data retention
We keep data while your account is active. When an account is deleted, we retain data only for as long as the law requires, and then we destroy it. Some records must be kept longer to meet a legal obligation. For example, we may retain billing and transaction records for up to seven years to meet Australian tax and corporate record-keeping requirements. When an account is deactivated, we anonymise the data we hold so that aggregate statistics are preserved without identifying anyone.
Waitlist entries are kept until you ask us to remove them, or for up to 24 months from your last activity, whichever comes first, after which we delete them.
Compliance
We are an Australian company, and we handle personal data in line with the Australian Privacy Principles (the APPs). We also offer Stratos to users and airlines in the European Economic Area and the United Kingdom; how the GDPR and the equivalent UK and Swiss laws apply to that is set out in the section below.
If you are not satisfied with how we handle a privacy concern, you can lodge a complaint with the Office of the Australian Information Commissioner (the OAIC) at oaic.gov.au or by calling 1300 363 992.
If we ever suffer a data breach that is likely to put you at risk, we will disclose it within 72 hours. Transparency matters more to us than the minimum a given law requires.
Users in the EEA, the UK, and Switzerland
Because we offer Stratos to people in the European Economic Area (EEA), the United Kingdom, and Switzerland, the EU General Data Protection Regulation (GDPR) and the equivalent UK and Swiss laws apply to our processing of personal data about users in those regions. Where Skyvex Software is a processor acting for a virtual airline, the airline is the controller and these obligations fall to it; we assist the airline to meet them.
The legal bases we rely on. We process personal data only where Article 6 of the GDPR allows it: performance of a contract, to operate your account, run the relay, meter usage, and provide the Stratos client, mobile app, and service; legitimate interests, to keep the service reliable and secure, prevent abuse, diagnose the support issues you raise, and produce de-identified aggregate statistics, relied on only where your rights do not override them; legal obligation, to keep billing and tax records for the periods the law requires; and consent, where we ask for it, such as for push notifications in the mobile app, which you can withdraw at any time by turning notifications off.
Your rights. If you are in the EEA, the UK, or Switzerland you have the right to access, rectify, erase, restrict, or object to our processing of your personal data, and the right to data portability. Where we rely on consent you can withdraw it at any time, without affecting processing that already took place. To exercise a right over data for which Skyvex Software is the controller, contact us at [email protected]. For pilot data your virtual airline is the controller, so contact your airline, and we will assist it as its processor. You also have the right to lodge a complaint with your local supervisory authority; in the UK that is the Information Commissioner's Office (ICO).
International transfers. We store personal data in Australia, and some sub-processors operate elsewhere. Australia is not the subject of a European Commission adequacy decision, so when we transfer personal data about EEA, UK, or Swiss users out of those regions we rely on appropriate safeguards, principally the European Commission's Standard Contractual Clauses and their UK and Swiss equivalents, alongside measures such as encryption in transit and at rest. Ask us if you would like detail about the safeguards that apply to a particular transfer.
Contacting us. If you are in the EEA, the UK, or Switzerland and have a question or concern about how we handle your personal data, you can reach us at [email protected], and we will respond.
Cookies and analytics
The marketing site at skyvexsoftware.com uses no advertising cookies and no cross-site tracking cookies. To measure traffic we use Cloudflare Web Analytics, a privacy-focused, cookieless analytics tool: it does not set cookies, does not fingerprint your device, and does not track you across other sites.
The dashboard uses a single session cookie, and only for authentication. That cookie keeps you signed in to your account; it is not used to track you across other sites.
Children
The service is not directed at children. You must be at least 18, or otherwise old enough to enter a binding contract in your jurisdiction, to hold an account. We do not knowingly collect personal data from a child. If you believe a child has provided us with personal data, contact us and we will take reasonable steps to delete it. Where the data relates to a pilot, we will also let the relevant airline know, as the controller of pilot data, so it can act on its side.
Changes to this policy
We may update this policy from time to time. When we do, we post the updated policy on this page and revise the "Last updated" date at the top. Where a change is material, we take reasonable steps to make it known. Your continued use of the service after a change takes effect means you accept the updated policy.
Contact
This policy is provided by Skyvex Software Pty Ltd (ABN 21 693 871 019), Queensland, Australia. If you have a question about this policy, or you want to exercise a right over data for which we are the controller, contact us at [email protected].