Privacy Policy (TOGA EFB)

• Account (only if you sign in): email address, nickname and member identifier, and your password if you register with email (stored encrypted). If you sign in with Apple, Google or Kakao, the identifier and email address (where provided) that the company gives us. If you use the App without signing in, we do not collect account information.

• Logbook and flight-prep data: flight records you enter (date, aircraft type, flight times and so on), your aircraft (registration, type, empty weight, centre of gravity, cruise speed, fuel), checklists, saved points, certificate expiry dates, performance tables and flight-plan routes. If you sign in, they are stored on our servers and synced with your other devices. If you do not sign in, they stay only on your device.

• Location: the App uses your device's location to show your position on the map and charts and to record flight tracks. Your location and tracks are stored only on your device and leave it only when you export a GPX file. However, while nearby traffic is on and the map is following your position, approximate coordinates are sent as described in the next item.

• Nearby traffic: when you turn this feature on, the App sends the centre coordinates of the map (rounded to about 10 km; near your own position when the map is following you) and the display range directly to public ADS-B data providers (adsb.lol, adsb.fi) to receive traffic information. Only if neither responds are the same coordinates sent to our server (toga.kr), which fetches the information instead. We use these coordinates only for that lookup and do not store them (server access records are handled as described for Vercel in section 5).

• Flight-plan routes: to show winds aloft (nav log), terrain profiles and NOTAMs along your route, the App sends the coordinates (latitude and longitude) of the points in your route and airport codes, and for winds aloft your cruise altitude and planned time, to our server (toga.kr). Our server uses them only to build the result from public data (NOAA forecasts, terrain data, NOTAMs) and send it back, and does not store them (server access records are handled as described for Vercel in section 5). Your device's current position is not sent.

• Japan ATIS: under the terms of use of Japan's SWIM service (Civil Aviation Bureau, MLIT), ATIS for Japanese airports is limited to air-traffic related personnel. The first time you open it, we ask signed-in members once to confirm their role (pilot, student pilot, instructor, dispatcher or other air-traffic related person), and we store the member identifier, the role selected and the time of confirmation. You can withdraw the confirmation under More › Account. When ATIS is shown, we record the member identifier, the airport and the viewing time (by the hour) to verify compliance with the terms of use.

• Public data downloaded directly: public data such as the base map (OpenFreeMap), terrain data (AWS public data) and U.S. charts (FAA) are downloaded by the App directly from each provider. The provider receives your IP address and the map area being downloaded (tile position). We do not receive this.

• App launch records: a random device identifier created for each installation, your member identifier if you are signed in, OS and App version, the region and language you selected, and how many times each feature was used per day. Screen content, location, search terms, chart names and routes are not sent.

• Error reports: when an error occurs in the App, the error message, where it occurred, the App version and the random device identifier are sent.

• App updates: when the App checks for and downloads updates, a random identifier created for each installation, your IP address, OS and App version are sent to Expo (USA), which delivers updates for us.

• In-app subscriptions: payments are processed by the Apple App Store or Google Play, and we never receive your card details. We use RevenueCat to check subscription status.

• Emails to us: your name (optional), email address and message.

• “Send feedback” in the App: what you write and the category, a reply email address (optional), your organisation name for partnership enquiries, the screen name, App version, OS, language, region, random device identifier, your member identifier if you are signed in, and an error summary if you send it from an error screen. Location, routes and logbook content are not sent.

• Stored only on your device: documents (PDFs, photos), scratchpad, flight tracks and the app-lock setting. They are deleted when you delete the App.

Identifying you and signing you in; syncing logbook and flight-prep data; providing subscription features; showing nearby traffic and winds aloft, terrain profiles and NOTAMs along your route; verifying the terms of use for Japan ATIS; delivering App updates; answering enquiries; understanding how the Service is running (number of devices in use, feature use) and fixing errors; and preventing misuse.

We do not use personal information for advertising. The App's screens use no third-party analytics tools and no ads. We do not sell personal information and do not track you across other companies' apps or websites.

Where the EU or UK GDPR applies, we rely on: performance of our contract with you (account, sync, subscriptions and the features you use); our legitimate interests in operating, securing and fixing the Service (launch records, error reports, feedback); your consent where we ask for it (location permission, an optional reply email); and compliance with legal obligations (purchase records).

• Account, logbook and flight-prep data: until you delete your account (then erased without undue delay; items you delete in the App are also erased from our servers)

• App launch records and error reports: automatically deleted after 90 days

• Japan ATIS view records: automatically deleted after 1 year

• Japan ATIS role confirmation: until you delete your account (deleted immediately if you withdraw it)

• Feedback sent from the App: deleted 1 year after it is handled (2 years after receipt if it was never handled)

• Subscription records: for the period required by law

• Emails to us: as long as needed to answer them

We do not provide personal information to third parties without your consent, except where required by law. We do not sell personal information.

When you sign in with Apple, Google or Kakao, or pay through the App Store or Google Play, those companies handle your information under their own privacy policies.

To provide the Service, we entrust the handling of information to the following providers. Information is sent over encrypted connections (HTTPS) when you use the relevant feature, and each provider handles it under its own privacy and data-processing terms. Because these providers are outside Korea, your information is processed in the countries listed. For users in the European Economic Area and the United Kingdom: the European Commission and the UK have recognised the Republic of Korea as providing an adequate level of data protection.

• Supabase Pte. Ltd. (servers: Tokyo, Japan; company: Singapore) — storage of accounts, logbooks and synced data; sign-in authentication

• Vercel Inc. (USA; servers in Seoul, Korea and a global network) — hosting of toga.kr and our servers (access records such as IP address and request details)

• RevenueCat, Inc. (USA) — checking in-app subscription status (user identifier, purchase records)

• Plus Five Five, Inc. (Resend, USA) — sending verification, support and notification emails

• 650 Industries, Inc. (Expo, USA) — delivering App updates (a random identifier created for each installation, IP address, OS, App version)

• Google LLC (USA) — our support mailbox (emails you send to support@toga.kr)

We protect personal information against leakage, loss and damage by encrypting communications, limiting access rights and storing passwords in encrypted form.

You may ask to access, correct, complete or delete your personal information, to restrict or object to its use, to receive a copy of it, or to withdraw your consent at any time, by emailing support@toga.kr. We will respond within the period required by the law that applies to you, and we may need to confirm your identity first.

You can delete your account in the App (More › Delete account) or as described at toga.kr/delete-account. Deleting the App or your account does not cancel an App Store or Google Play subscription. You can also use the App without signing in, and turn off location access in your device settings.

If you are in the EEA, the UK or Switzerland, you may complain to the data protection authority where you live. In Korea, you may contact the Personal Information Dispute Mediation Committee or the Korea Internet & Security Agency (privacy.kisa.or.kr).

For U.S. residents: we do not sell or share personal information for cross-context behavioural advertising. Because we do not track you across third-party websites or apps, we do not respond differently to Do Not Track signals.

The App is intended for pilots and student pilots and is not directed to children. We do not knowingly collect personal information from children under 13 (or under the minimum age set by law in your country). If you believe a child has given us personal information, please contact us and we will delete it.

Operator: Aviators (에비에이터스), a sole proprietorship in the Republic of Korea, operating the TOGA brand · Business registration no. 175-22-02662 · Representative and postal address: provided without delay on request · Contact: support@toga.kr (English, Korean, Japanese and Chinese)

Privacy officer: TOGA Customer Support (support@toga.kr)

If we change this policy, we will post the new version on this page with its effective date.