Privacy & Data Collection Policy
Last updated: 8 June 2026
The short version:
- Skyvex Software collects only a small subset of your flight data — enough to show your airline's activity, meter usage, and bill accurately.
- For pilot data, your virtual airline is the controller. Skyvex Software processes it on the airline's behalf.
- We do not collect your IP address, email, or device identifiers through the relay. Your last name is stored as an initial only.
- Your full flight data goes from the Stratos client straight to your airline's own backend — not through us.
- Your data is stored in Australia. We do not sell it.
This summary is for convenience only. It does not replace the full policy below, which governs if there is any inconsistency.
This Privacy & Data Collection Policy (the policy) explains what data Skyvex Software collects through Stratos, why we collect it, who controls it, where it is stored, and what rights you have over it. It applies to the Stratos client, the relay, the Skyvex Software service, and the marketing site at skyvexsoftware.com. Stratos is built by Skyvex Software Pty Ltd (ABN 21 693 871 019, ACN 693 871 019), a company based in Queensland, Australia (Skyvex Software, we, us, our).
Who we are
Skyvex Software Pty Ltd is an Australian company based in Queensland. We build Stratos, a multi-simulator ACARS client for virtual airlines. A virtual airline owner or administrator signs up to Skyvex Software, creates an airline, and connects the airline's own backend (a phpVMS installation or a custom system). Skyvex Software does not host a virtual airline's backend.
How the relay works
A pilot does not sign in to Skyvex Software directly. A pilot signs in through their virtual airline, which authenticates them against the airline's own backend. Skyvex Software then mints a short-lived relay token and creates a pilot record so the airline can see its activity and so we can meter usage and bill accurately.
Each relay token expires after 30 days. We store only a hash of each token, never the token itself; plain-text tokens are never stored. A stored hash cannot be used to reconstruct the token it was derived from.
Who controls your data
Stratos uses a hybrid model. For some data Skyvex Software is the controller, and for other data Skyvex Software is a processor acting on behalf of a virtual airline. The distinction matters, because it determines who you contact to exercise your rights.
Skyvex Software is the controller of airline account and billing data, waitlist and website data, and aggregate platform data. We decide how that data is collected and used, and you contact us directly about it.
Skyvex Software is a processor of pilot identity, flight, and support data. We process that data on behalf of the virtual airline that authenticates the pilot. For that data, the airline is the controller. A pilot's name and last initial are managed by the airline: to change them, a pilot contacts their airline, and the next sign-in to Stratos updates them automatically. A pilot's first point of contact for access to or deletion of their data is their airline. We assist the airline as its processor.
Because a pilot authenticates through their virtual airline rather than through Skyvex Software, the airline — as the controller of pilot data — is responsible for telling its pilots what is collected and why at the point of collection. As a processor, Skyvex Software does not issue separate collection notices to a pilot.
The data we collect
The table below sets out each category of data Skyvex Software collects, what it contains, why we collect it, whether we are the controller or a processor, and how long we keep it.
| Category | What we collect | Why | Our role | Retention |
|---|---|---|---|---|
| Pilot identity (via relay) | First name, last-name initial only, the airline's pilot ID, and airline; no email, IP, or device ID | Attribute activity to a pilot within their airline | Processor (the airline is the controller) | While the airline's account is active |
| Flight position and summary | Latitude, longitude, altitude, heading, ground speed, and flight phase; aircraft type and livery; simulator and version; flight number, route, and departure/arrival; and, when a flight ends, the landing rate, a short landing report, fuel used, flight time, and distance flown | Live tracking, usage metering, and billing | Processor | While the account is active, then anonymised |
| Support | Messages you send, and the Stratos client's internal database — operational data about the client only, which does not contain personal data | Diagnose issues you raise | Processor | While the account is active |
| Plugin installs | Which plugins a pilot has installed | Deliver the plugins the pilot or airline enabled | Processor | While installed |
| Airline account | Name, email, airline details, billing | Operate the account and billing | Controller | While the account is active |
| Waitlist / website | Name, email, airline name and website, current ACARS, and your IP address and user-agent (for security) | Manage the waitlist and prevent abuse | Controller | Until you ask us to remove it, or 24 months of inactivity — whichever is first |
On a narrow screen the table stacks into one block per category, each headed by its category name.
Your airline can configure the Stratos client to send additional flight data — such as engine, fuel, weather, and other telemetry — to the airline's own backend. That additional data goes from the Stratos client to your airline directly. It is never sent to, seen by, or stored by Skyvex Software.
What we do not collect through the relay
The relay is built to carry a small amount of flight data, not to identify the person flying. Through the relay we do not collect your IP address, your email address, or any device, operating-system, or hardware identifier. We do not capture screenshots, and we do not capture audio. An email is associated with you only if you separately hold a Skyvex Software account and link it.
Why we store only your initial
We store only the first initial of a pilot's last name, not the full name. This is a deliberate choice to reduce how identifiable the data is while still letting an airline tell its pilots apart.
How we use the data
- show a virtual airline its activity and live flights;
- meter usage and bill an account accurately;
- diagnose and resolve the support issues you raise;
- keep the service reliable and secure, including detecting and preventing abuse.
We do not use individual pilot flight data for advertising, and we do not profile individual pilots. We do publish aggregate, de-identified statistics about Stratos as a whole — for example, the total number of pilots, flights, and hours flown across the platform, which appear on our website. These aggregates cannot identify an individual pilot or flight.
Where your data is stored
Your data is stored in Australia, on infrastructure provided by DigitalOcean and Vultr. We use a small number of sub-processors to operate the service:
- Cloudflare — content delivery and DNS. This is an international service, so some requests and archived flight records are served through Cloudflare's global network.
- Postmark — transactional email, operated in the United States. We use Postmark to send account and service emails, such as verification and password-reset messages.
Cloudflare and Postmark operate internationally, so a limited amount of data is handled outside Australia. Before we engage an overseas sub-processor, we assess it and put contractual arrangements in place that require it to handle personal data consistently with the Australian Privacy Principles. We keep this list current, and where we make a material change to our sub-processors we take reasonable steps to make it known. We do not add a sub-processor that handles personal data without a lawful basis to do so.
Sharing
We do not sell personal data, and we never have. We do not trade, rent, or otherwise make personal data available for anyone else's marketing.
Your full flight and PIREP data is sent by the Stratos client directly to your airline's own backend. Skyvex Software is not in that path and does not receive it. We do not share the limited data we do hold with anyone beyond the sub-processors listed above.
How we protect your data
We take reasonable technical and organisational steps to protect personal data from loss, misuse, and unauthorised access:
- all data in transit is encrypted with TLS (SSL), and data at rest is encrypted;
- we back up the database twice daily and keep point-in-time recovery for the past 30 days, so we can restore data after an incident;
- relay tokens are stored only as hashes, never in plain text;
- we minimise what we collect — for example, storing only a last-name initial — so that less is ever at risk;
- access to production data is limited to the people who need it to operate the service.
No method of storage or transmission is ever completely secure, but these measures are designed to keep the risk low.
Your rights
You can ask to access, correct, export, or delete the personal data we hold. For data where Skyvex Software is the controller — your airline account and website data — contact us directly and we will handle it. We can produce an export of a user's flights and the data we hold on request.
For pilot data, your virtual airline is the controller. A pilot should contact their airline to access, correct, or delete that data, and Skyvex Software will assist the airline as its processor. A pilot's name and last initial are corrected on the airline's side and update automatically at the next Stratos sign-in.
Data retention
We keep data while your account is active. When an account is deleted, we retain data only for as long as the law requires, and then we destroy it. Some records must be kept longer to meet a legal obligation — for example, we may retain billing and transaction records for up to seven years to meet Australian tax and corporate record-keeping requirements. When an account is deactivated, we anonymise the data we hold so that aggregate statistics are preserved without identifying anyone.
Waitlist entries are kept until you ask us to remove them, or for up to 24 months from your last activity, whichever comes first, after which we delete them.
Compliance
We are an Australian company, and we handle personal data in line with the Australian Privacy Principles (the APPs). Stratos is not specifically directed at or marketed to residents of the European Union, and we do not monitor the behaviour of people in the EU, so we do not hold ourselves out as compliant with the EU General Data Protection Regulation. We do, however, honour reasonable requests to access, export, or delete personal data from every user, wherever they are.
If you are not satisfied with how we handle a privacy concern, you can lodge a complaint with the Office of the Australian Information Commissioner (the OAIC) at oaic.gov.au or by calling 1300 363 992.
If we ever suffer a data breach that is likely to put you at risk, we will disclose it within 72 hours. Transparency matters more to us than the minimum a given law requires.
Cookies and analytics
The marketing site at skyvexsoftware.com uses no advertising cookies and no cross-site tracking cookies. To measure traffic we use Cloudflare Web Analytics, a privacy-focused, cookieless analytics tool: it does not set cookies, does not fingerprint your device, and does not track you across other sites.
The dashboard uses a single session cookie, and only for authentication. That cookie keeps you signed in to your account; it is not used to track you across other sites.
Children
The service is not directed at children. You must be at least 18, or otherwise old enough to enter a binding contract in your jurisdiction, to hold an account. We do not knowingly collect personal data from a child. If you believe a child has provided us with personal data, contact us and we will take reasonable steps to delete it. Where the data relates to a pilot, we will also let the relevant airline know, as the controller of pilot data, so it can act on its side.
Changes to this policy
We may update this policy from time to time. When we do, we post the updated policy on this page and revise the "Last updated" date at the top. Where a change is material, we take reasonable steps to make it known. Your continued use of the service after a change takes effect means you accept the updated policy.
Contact
This policy is provided by Skyvex Software Pty Ltd (ABN 21 693 871 019), Queensland, Australia. If you have a question about this policy, or you want to exercise a right over data for which we are the controller, contact us at [email protected].