Privacy Policy

Effective 3 November 2026

Flightline is a free waterfowl hunting map at flightlinemap.pages.dev. It is made and run by one independent developer in New Hampshire, USA ("we", "us"). This policy says what the website collects, why, who else handles it, how long it is kept and how to delete it.

1. Using the map without an account

The map, its layers and its rules work without signing in for a couple of minutes of use, after which it asks you to sign in or create a free account. Your settings (theme, layers, states shown, date) and any spots or hunt log entries you save while signed out are kept in your own browser's storage on your device, and are not sent to us while you stay signed out. If you later sign in on that browser, the spots and log entries saved there become part of that account and are stored with it like anything else you save (section 3).

2. Your account

Accounts are free. You can create one or sign in with Google, with Facebook, or with a one-time link sent to your email address (no password). Sign in with Apple is planned and is not available yet.

• Email address. Every account has one. It identifies your account, receives sign-in links, and lets the developer reply to feedback you send.
• From Google or Facebook: your email address, your name and your profile picture link, as that service shares them, plus the account identifier it gives us so the same login finds the same account. From Facebook we ask only for "email" and "public_profile" (name and picture). We never see your Google or Facebook password and never post anything for you.
• Display name, if you set one on the account page.
• Your agreement to the Terms. Before you use the map signed in, you are asked to agree to the Terms of Use and this policy. Until you agree, nothing saved in your browser is sent to your account. When you press Agree, we store with your account the date and time you agreed (by our server's clock) and which version of the Terms you agreed to (for example "2026-11-03"). If the Terms change, you are asked again and the new agreement is stored next to the old one.
• Account records kept by our sign-in provider, Supabase: when the account was created and last signed in, the sign-in method, and for each signed-in session the IP address and browser information (user agent) it came from. Supabase also keeps a security log of sign-in events that holds the email address and IP address.
• Your profile picture is shown by loading it from Google's or Facebook's servers.

3. What you save

• Saved spots (name, position, note) and your hunt log (date, place, position, zone, birds, notes). When you are signed in they are stored with your account so they appear on every device you use. When you delete an item, its content is erased and only an empty marker stays, so the delete reaches your other devices.
• Feedback you send with the Feedback button: the kind (bug, idea, other), your message and up to three screenshots. Screenshots are shrunk on your device before they are sent, which also removes their location and camera data. If you leave "Include my map view and device info" ticked, it also carries the states and layers shown, the map centre rounded to about 1 km, the zoom and the map date, and your device type (phone, tablet or desktop), screen and window size, browser name and version and operating system, whether you were online, and the app version. Feedback is stored with your account and email address. Only you and the developer can read it.
• To enforce daily screenshot limits, the server also notes your account and the time each time you upload a screenshot. Notes more than 2 days old are cleared out the next time anyone uploads a screenshot, so when uploads are rare a note can stay longer. When you delete your account, the notes that remain lose the link to it.

4. Usage counts

To learn which parts of the map are used, the website counts a short list of events: the app was opened (with the kind of site you came from, such as a search engine, and whether it runs as an installed app), a state was turned on, a flyway was opened, a search was made (only its kind: place, coordinates or address, never the words), a spot was saved, a hunt was logged, the map was shared, a map app was opened from a point, a layer was turned on or off, the account page was opened, a sign-in or new account (only the method: Google, Facebook or email), and the owner's statistics page was opened. Each count carries your device type and whether someone was signed in (yes or no).

• Counts are tied to a random identifier stored in your browser, which is replaced when you sign out. They are not stored with your account (the stored count says only whether someone was signed in), never include a location or anything you typed, and are not part of your account's data download. While you are signed in, the request that sends them carries your sign-in token, as every request to the account service does, so Supabase's own request logs can show the two together under Supabase's retention.
• Nothing is counted when your browser sends Do Not Track or Global Privacy Control.
• To stop abuse, the server keeps daily counters per browser (by the random identifier) and per network (only a scrambled form of the network address, salted with a value that changes every day). The day's salt is deleted the next day. The counters last through the following day and are deleted when the first usage count of a later day arrives.

5. Location

• The "my location" button uses your device's location in your browser to show where you are on the map. It is not sent to us.
• Weather, wind and marine forecasts are fetched for the point you pick or tap, and, while the wind layer is on, for a grid of points across the map area. When the point is your own location, it is rounded to about 250 metres before it is sent to the weather service.
• Locations reach us only inside what you choose to save or send: spots and hunt log entries stored with your account (section 1 says when signed-out ones join it), and the rounded map centre in feedback.

6. Services that handle data for Flightline

• Supabase: sign-in, the account database (spots, hunt log, feedback, usage counts) and private storage for feedback screenshots.
• Resend: delivers the sign-in emails (your email address and the link).
• Google, Facebook (Meta) and, when it is available, Apple: only if you choose them to sign in. They learn that you signed in to Flightline, under their own privacy policies.
• GitHub Pages (GitHub): hosts the website.
• cdnjs (Cloudflare) and jsDelivr: deliver the map library and the sign-in library your browser downloads.
• Esri and the U.S. Geological Survey: satellite, label and topographic map tiles for the area you view.
• Open-Meteo and the U.S. National Weather Service (api.weather.gov): weather, wind, marine forecasts and alerts for the points described in section 5.
• OpenStreetMap Nominatim: street address search, only when you choose to look an address up online. It receives what you typed and the map area.

Like any website, these services receive your IP address and basic browser information when your browser contacts them, and keep their own logs under their own policies. Tide predictions and eBird bird sightings are downloaded by us ahead of time and served from our own site, so your browser does not contact NOAA tides or eBird for them. Links to Google Maps, Apple Maps, eBird or onX open those sites only when you tap them.

7. Cookies and browser storage

Flightline sets no advertising or tracking cookies. It uses your browser's own storage on your device for:

• your settings (theme, layers, states shown, date and a few display choices);
• your spots and hunt log, and changes not yet synced to your account;
• your sign-in session, and while a sign-in is under way, the sign-in method and the map view to come back to;
• changes an account made in this browser but had not synced when it signed out, kept for that account's next sign-in here for up to 90 days and then removed (My account can discard them sooner);
• an unsent feedback draft (its kind and message) for each account that started one here;
• how many seconds of free use have passed without an account;
• for each account signed in on this browser, the version of the Terms it agreed to, so the agreement screen does not flash up on every visit (the server's record is still checked);
• the random usage identifier from section 4, and a note that it has been used while signed in (the note holds the identifier only, not the account);
• a cache of map data so the map keeps working with a weak signal.

This stays on your device. Clearing the site's data in your browser removes all of it.

8. How we use data, and what we never do

• We use it to sign you in, keep your spots and log in sync, answer your feedback, protect the service from abuse, and decide what to improve.
• We do not sell or rent personal data, do not share it for advertising, do not show ads and do not build advertising profiles.

9. Your choices and rights

• See and download your data: My account, then "Download my data" gives a file with your account profile (account id, email address, display name, sign-in method, and when the account was created and last signed in), your spots, your hunt log, your feedback messages with their kind, status and context, and when you agreed to which version of the Terms. Feedback screenshots are listed by file name but not included; email us for copies of them, or of anything else we hold about you.
• Correct your display name on the account page; spots and log entries can be deleted in the app.
• Delete your account and its data at any time (section 11).
• Opt out of usage counts by turning on Do Not Track or Global Privacy Control in your browser.
• For any other request, or a question, email vikqazi@gmail.com. We reply within 30 days.

10. How long data is kept

• Account, spots, hunt log and feedback: until you delete them or delete your account. The developer may also delete feedback once it has been dealt with.
• The record of your agreements to the Terms (date, time and version): until you delete your account.
• Screenshot upload notes: at least 2 days, until the next screenshot upload after that clears them out (section 3).
• Usage counts: once they are more than 13 months old, counted from the start of a month, a monthly clean-up merges them into monthly totals with no identifiers, so a single count is kept for up to about 14 months. The clean-up runs on a monthly schedule; where the database cannot schedule it, it runs when the owner opens the statistics page, and counts are kept until then.
• Abuse-limit counters: through the following day, until the first usage count of a later day arrives; the daily salt: until the next day.
• Unsynced changes from an account that signed out: in that browser, for up to 90 days (section 7).
• Supabase's session records and security log of sign-in events: the session records go with your account; the security log entries are kept for the period Supabase sets.

11. Deleting your data

Open My account (the account button, top right), go to Danger zone and use Delete my account. It removes your login, profile, sign-in sessions, synced spots, hunt log, feedback and its screenshots, and the record of your agreements to the Terms, right away and cannot be undone. It also clears the account's spots, log entries, unsynced changes and feedback draft from the browser you use. In any other browser where the account signed out with changes not yet synced, those changes stay in that browser until they expire after 90 days, or until you clear the site's data there. Spots and log entries saved while signed out in a browser where you never signed in stay on that device; your browser's "clear site data" removes them. Or email vikqazi@gmail.com from your account's address and we will delete it for you. Full steps: Delete your data.

Usage counts are not stored with your account, so they stay as counts tied only to a random identifier. Supabase's security log of sign-in events (with your email address and IP address) is not removed by Delete my account; it is kept for the period Supabase sets.

12. Children

Flightline is not meant for children under 13, and we do not knowingly collect data from them. If you think a child has made an account, email us and we will delete it.

13. Security, location and changes

Data travels over encrypted connections. Each account can read only its own rows in the database, feedback screenshots sit in private storage, and only the developer can read feedback. No system is perfectly secure, so please use a strong password on your Google, Facebook or email account. Flightline is run from the United States, and the services in section 6 may store and process data in the United States and other countries. If this policy changes, the date at the top changes too, and significant changes will be announced in the app.

14. The copy inside Claude

A copy of the map also runs inside Claude (claude.ai). That copy has no Flightline sign-in and sends no usage counts; anything it saves is stored by Claude under Anthropic's policies.

15. Contact

Email vikqazi@gmail.com.