Privacy

Last updated 13 November 2026

flytag holds licences, type ratings, training certificates and the other documents that say what you are qualified to do. This page says plainly what is kept, who else ever sees it, and how to get rid of it.

What is stored

Your account: email address, password (hashed, never in readable form), name, the country if you give it, and a contact email and phone number if you add them. If you turn on two-step sign-in, the key your authenticator app counts its codes from, kept encrypted, and your recovery codes, kept only as one-way hashes. The codes are worked out on your phone and checked here; nothing about them is sent to Google or to anybody else. Your account’s own encryption key, kept only locked — under your password, under each device signed in, under Face ID or your fingerprint if you turn it on, and under a key kept in Supabase Vault, a store for secrets kept apart from the database. That last copy is why a forgotten password never costs you your documents, on any device; it also means that we, who run flytag, could open them, as Dropbox or OneDrive could theirs. A copy of the database alone, or of the file storage alone, opens nothing. If you use the flytag app, one more locked copy is kept here whose key only your phone holds, in your iCloud Keychain or Google’s backup of the app.

Your work: what you do — your trades and what you do in each, when you last worked in it and for how many years — the licence categories and type ratings you state, and the work you would take: the lowest rate, the hours, the shortest contract, the rotations, and whether accommodation and flights have to be covered.

Your credentials: for each one, its category and type, title, issuer, the name printed on it, issue and expiry dates, aircraft type, licence category and type ratings, certificate and licence numbers, training provider, course name, and any notes you add. For a document that was read by AI, what was read off it is kept beside what you confirmed; the check a locked tool asks for reads the name on a certificate from there.

Your documents: the files you upload, every earlier version kept when you replace one, and the individual pages a multi-page upload was split into. They are stored on Supabase's object storage. Each file is encrypted with a key of its own, locked to your account’s key, before it is stored; files stored before encryption was switched on are encrypted in place within a day or so. A fingerprint of each file is kept with it, and a file that is already in another account cannot be added to yours — nothing about that other account is said.

Your messages: your conversations with the recruiters you answered and with flytag support, any report you make about a recruiter’s terms, and the recruiters you have silenced.

Your use of the app: sign-in sessions, with the browser or app each came from and a one-way hash of its IP address; push subscriptions if you turn them on, and whether reminders also come by email; your notifications; a record of each read spent on having a document read; and — where you have created share links — a log of each time one was opened or refused. That log keeps the visitor’s browser and a one-way hash of their IP address, not the address itself, the recruiter’s name when it was a recruiter that opened it, and the email address a visitor gave where your link asked for one.

How you use the app, on the web and in the Android and iPhone apps: which of its screens you open, when, for how long and in what order, which of its buttons and links you press, with the app, its version and the kind of device it runs on — a model and a system version, never a name you gave your phone. A screen is recorded by what it is, never by what is on it: that you opened a credential, not which one. A press is recorded by what the button does — Edit, Share, the Wallet tab — and the screen it was on; never the words on it, never where on the screen it was, and nothing you type or that is read off a document. It is how we see what is used and what is not, and nobody outside flytag sees it. What the app records before you sign in stays on your device, and is sent only if you then sign in. It is kept for 180 days and then deleted.

The tools work on your device: what you type into one is never sent to us.

Who else sees it

Your data is not sold. Outside flytag it reaches the companies that run part of the service, the recruiters you answer, and the people you send a link to — each described below, and nobody else.

Companies that run part of the service.

• Vercel, which hosts the application and collects page views and loading speed. Addresses are stripped before they are sent: a share link’s address, which is a secret, never leaves as anything but /share/[token].
• Supabase, which runs the database and holds your documents, and keeps in its Vault the key your account’s key is locked under.
• Anthropic, which reads a document when you ask for it to be read. It is sent the document and nothing else about you. Your documents are not used to train anyone’s models.
• Resend, which delivers the email flytag sends you — the links to confirm your address or reset your password, reminders if you asked for them by email, and notices.
• A push service — Apple’s, Google’s or Mozilla’s, depending on your browser — if you turn notifications on. It receives what a notification says: a credential and its expiry date, a contract and the recruiter offering it, or that someone replied — never the text of a message and never anything from inside a document. The iPhone app schedules its expiry reminders on the phone itself.

Recruiters you answer. A contract reaches you without the recruiter learning who you are: it is told roughly how many people a contract reached, never who. When you answer one, the recruiter receives the documents you picked, as a share link you can withdraw at any time, together with your name, your email address (your contact email, if you set one), your phone number if you added one, and what you said about your work — your trades, what you do in them and your years in the trade. Until it chooses to open your answer, it sees only how much of what it asked for your answer holds. What it has read cannot be taken back. A recruiter is never told who reported its terms. It may read your answer in the flytag app as well as in a browser: the app downloads each of your documents only to show it, deletes it when it is closed, and keeps no copy — and every look is in your access log either way.

Training providers see how many people opened their course listings, never who: a visit is counted without your account.

Inside flytag, administrators see your account — your name and email address, and how much your wallet holds — the record of how you used the app described above, and what you write to support. The console they use has no way to open a stored document or to show what one says.

If you sign in as a recruiter or a training provider

Your account: your email address, your password as a one-way hash, and your organisation as you registered it — a recruiter’s name and the domain engineers are shown, a training provider’s name, website and contact address. If you turn on two-step sign-in, the key your authenticator app counts its codes from, kept encrypted, and your recovery codes, kept only as one-way hashes. If you turn on Face ID, each passkey’s public half, and — for a recruiter — the recruiter’s key locked under it, which only your device can open. Your sign-in sessions, and what you write to support. A recruiter’s requests, the answers it received and opened, and its conversations with the engineers who answered; a training provider’s listings.

In the Android and iPhone apps a console keeps its sign-in on the phone — in the keychain on an iPhone, in encrypted storage on Android — and nothing else: no copy of anything for use without a signal, and an engineer’s documents only for as long as they are open. What a console is used for is not recorded; the record of how the app is used, described above, is the wallet’s.

Sharing is something you do

A document leaves flytag when you create a share link or answer a recruiter, and only then. A link is a long random secret, expires on the date you set, can carry a password, and can be revoked at any time from your Shared links screen. We store only a hash of it, so nobody here can reconstruct a link you created.

Your copy on your device

A readable copy of your wallet is kept on each device you sign in on — in the browser, or in the Android or iPhone app — so it opens with no signal, together with the documents you have opened on it unless you switch that off. It is on that device only. Remove it from Profile, or by signing out.

Uploads you never finished

An upload that is never confirmed into a credential and never discarded is cleared away after 30 days, along with the file behind it. Discarding one removes its file straight away. Nothing you have actually filed is touched by this.

Deleting everything

Profile → Delete account erases your account, your credentials, every version of every document, your packs, your share links, your work profile, your answers to recruiters and the conversations behind them, your support conversation, your reminders and the record of how you used the app. It is immediate, there is no archive, and it cannot be reversed. Anyone holding a link you shared stops being able to open it, and a recruiter you answered loses your answer — though what it has already read, it has read.

Counts of anonymous events — that a credential was saved, that a document was uploaded — survive with no link to you. They carry no name, no email address and nothing from any document.

A report you made about a recruiter’s terms stays too, as a record about that recruiter rather than about you: the recruiter, the request’s title, the term you said was not true and the date, and nothing that leads back to you. Deleting the request does not remove it either.

Getting in touch

Write to support@flytag.app for a copy of your data, a correction, or anything else about it.