Privacy Policy
Last updated 2026-08-19. Written in plain language, structured around the Personal Data Protection Act 2010 (Malaysia). This is a description of what the site actually does, not a substitute for legal advice.
What we collect
If you create an account: your email address, a display name, and your password - stored only as a one-way Argon2id hash, never in readable form. If you sign in with Google instead, we receive your email and name from Google and link them to your account; we never see your Google password.
If you save a flight plan: the plan's title, coordinates, drone class, planned dates, and any notes you write. This is only stored if you are signed in and choose to save it.
A session cookie to keep you signed in, and - only during a password reset - a temporary token that expires in 1 hour and is deleted the moment it is used or expires.
Saved locations and your drone-class preference (when not signed in, or as a browsing convenience) live entirely in your browser's local storage. They are never sent to our server.
Locations you search for are sent to OpenStreetMap's Nominatim to resolve into coordinates. Coordinates you view a forecast for are sent to the weather providers listed on /about/ to fetch data for that point. Neither is linked to your account - it is just the coordinate, the same request anyone would make.
Google Analytics measures aggregate traffic (which pages get used, roughly where visitors come from) via its own cookies, entirely separate from anything above. See Google's privacy policy.
Why we collect it
Account and flight-plan data exist so you can sign in from any device and keep your saved plans. Location and coordinate lookups exist to answer the question you asked - "what's the weather/airspace here". Analytics exists so we know which parts of the site are actually useful. Nothing here is sold, and nothing is used for advertising.
Who we share it with
Only the third parties named above (Google Analytics, Nominatim, and the weather providers on /about/), and only the specific request each one needs to do its job - never your account details. If you reset your password, the reset link is sent through our transactional email provider (Brevo) solely to deliver that one email.
How long we keep it
Account and flight-plan data is kept until you delete it or close your account. Deleted flight plans are soft-deleted immediately and are not shown or used again. Password reset tokens live for at most 1 hour. Session cookies expire when you sign out or after a period of inactivity.
Security
The site is served over HTTPS. Passwords are hashed with Argon2id and are never stored or logged in plain text. Database queries use parameterised statements throughout. No system is perfectly secure, but this is the standard we hold the code to.
Your rights under the PDPA
Under Malaysia's Personal Data Protection Act 2010, you can ask to access, correct, or delete the personal data we hold about you. You can delete your own flight plans and saved data directly from your dashboard at any time. For anything else - including deleting your account entirely - email contact@aiv10.my and we will act on it.
Children
This site is not directed at children and does not knowingly collect data from them.
Changes to this policy
If what we collect or why changes, this page will be updated and the "last updated" date above will change with it.
Questions about your data, or a request under the PDPA? contact@aiv10.my. See also Terms of Use and About & data sources.