What Powers Us
Know exactly where your data is and how it is being used.
Current as of 4 August 2026
Subprocessors & services
Organizations we rely on to run Pilotflows— including subprocessors that process personal data when you use the product, and operational vendors (for example source hosting, secrets, or issue tracking).
| Name | Purpose | Location | Website |
|---|---|---|---|
| AirNav Radar | Flight and aircraft data enrichment for logbook and hangar features | United States | airnav.com |
| Amazon Web Services (AWS) | Object storage and related cloud services for files and application data | European Union and United States | aws.amazon.com |
| Apple | App Store distribution and authentication when you use Sign in with Apple | United States | apple.com |
| Apple In-App Purchase | In-app subscription and purchase processing on Apple platforms | United States | apple.com |
| Apple Push Notification service (APNs) | Delivery of push notifications to Apple devices | United States | developer.apple.com |
| AVWX | Aviation weather (METAR/TAF) data for tools and in-product weather | United States | avwx.rest |
| Better Stack | Centralized application logging and operational observability | European Union / United States | betterstack.com |
| Calendly | Scheduling and meeting booking | United States | calendly.com |
| Cloudflare | DNS, CDN, edge security, and bot protection (e.g. Turnstile) where you submit data | European Union | cloudflare.com |
| Expo Push | Push notification delivery for Expo / React Native mobile clients | United States | expo.dev |
| Firebase Analytics (iOS SDK) | Mobile app usage analytics on Pilotflows for iOS (Google Analytics for Firebase via firebase-ios-sdk) | United States / regional processing per Google | firebase.google.com |
| Google Ads | Advertising measurement: browser tags with Consent Mode (marketing consent) and server-side offline conversion uploads of SHA-256 hashed email plus click IDs (gclid / gbraid / wbraid) | United States / regional processing per Google | ads.google.com |
| Google Analytics | Website and product usage analytics (Google Analytics 4 via gtag), loaded only after analytics cookie consent; related Firebase Analytics streams power mobile measurement where configured | United States / regional processing per Google | analytics.google.com |
| Google Play Billing | In-app subscription and purchase processing on Google Play for the Pilotflows Android app | United States / regional processing per Google | play.google.com |
| Hetzner | Server hosting and compute where the service and your data are processed | Germany (EU data centers) | hetzner.com |
| Linear | Product and engineering issue tracking | United States | linear.app |
| Mapbox | Maps and location-related features in the product | United States | mapbox.com |
| Meta (Pixel and Conversions API) | Advertising measurement: Meta Pixel in the browser (marketing consent) and Conversions API server-side events with SHA-256 hashed email, external ID, IP address, and user agent | United States / regional processing per Meta | meta.com |
| Meta Facebook iOS SDK | Mobile advertising and attribution events on iOS (consent-gated) | United States / regional processing per Meta | developers.facebook.com |
| MongoDB | Primary database for accounts, organizations, logbooks, and related application data | European Union | mongodb.com |
| RevenueCat | In-app subscription management and receipt validation | United States | revenuecat.com |
| SendGrid | Transactional and notification email to your email address | United States / regional processing per Twilio SendGrid | sendgrid.com |
| Sentry | Error and performance monitoring, including Session Replay sampled at 10% of sessions with all text masked and all media blocked | United States / regional processing per Sentry | sentry.io |
| Stripe | Payment processing and billing | United States and European Union | stripe.com |
| Twilio | SMS delivery to you when we send text messages | United States / regional processing per Twilio | twilio.com |
| Upstash | Managed Redis for caching, job queues, and related application data | United States / EU (per Upstash region) | upstash.com |
| Web Push | Browser push notification delivery via the Web Push protocol | Varies by browser push service | w3.org |
| xAI | AI-assisted processing of logbook and import content you choose to submit (images/PDFs processed in-request and not retained on Pilotflows; temporary xAI Files API upload then deleted; in-memory extraction session ~15 minutes) | United States | x.ai |