Privacy notice

Hangar Flying is run by Whiskey Victor LLC. This notice says what we collect, what we do with it, who else receives it, and how long we keep it. It covers all of hangarflying.com. We do not sell or rent personal information.

Your account. Your email address and your password, which is stored only as a one-way hash that nobody, including us, can read back. When you join we ask your name, phone, city, state, country, home airport and aircraft. Whatever else you choose to add: business name, address, mechanic certificate number, and whether you want our news. When you join we record which version of the terms and of this notice you agreed to, and when. With each sign-in we record your internet (IP) address, your browser, and whether you chose the shared-computer option. Accounts opened on the Panel Designer before September 25, 2026 may also hold a username, how you heard of us, and the IP address you registered from.

What you create.

• Panel Designer: panel designs, exported pictures, equipment lists, the equipment and templates you upload, and your requests and messages to our shop.
• Builders Log: your project and what you say about it, entries with their dates, hours, work and methods, the parts and serial numbers you record, the names and hours of people who helped, your photographs with their captions, and the manuals you upload. From a photograph’s own data we read the date and time it was taken, and nothing else; we do not read where it was taken.
• MRO: aircraft, installed equipment and serial numbers, maintenance records with the signer’s name and certificate number, discrepancies, inspections, times, notes, photographs, documents and logbook scans.
• Marketplace: your listings and everything in them, the history of their prices, your questions, answers and private messages, and your saved searches.

People somebody else enters. A maintenance shop using MRO may enter its customers’ names, email addresses, phone numbers and addresses. A builder may enter the names of people who helped. If somebody entered you, they are responsible for having told you; write to us and we will point you to them or help you directly.

Payments. Your card goes from your browser straight to Stripe; it never reaches our servers. We keep your Stripe customer number, the card type and last four digits, your billing name and address, your membership and your invoices.

What you write to us. What you send through Tell us what goes wrong, and our answers. When you press Report a problem in the designer we also receive a picture of your canvas, the page address, your browser and screen size, and the layout of the design, and it is emailed to our administrators.

Sponsor ads and short links. When a sponsor’s ad in the Panel Designer is shown to you or you click it, or you follow one of our short links, we record your account if you are signed in, your device type, language and the page you came from, to count views and clicks for the sponsor. We stopped recording IP addresses with these in September 2026. Sponsors receive counts, not your identity.

Visits. We count visits ourselves, on every page of the site but the administrators’ own, without Google Analytics and without a cookie of the count’s own. For each visitor and day we keep which pages were viewed (with record numbers taken out of their addresses), the page you arrived on and the last one, which site you came from, whether it was a computer, tablet or phone, how many visits, and for how many minutes you were active (a page notes once a minute that you moved, typed or scrolled; nothing about what you typed). To tell one visitor from another for a day we use a one-way code made from the date, your IP address and your browser; it changes every day, the IP address itself is not kept, and the code cannot be turned back into one. To count how many different visitors came over a week or a month, we also keep a second one-way code made from your IP address and browser alone, which stays the same from day to day while those do; it cannot be turned back into either. Robots are not counted. When you are signed in, your account is recorded with that day’s count.

Errors and logs. When something breaks, an error report is kept on our own server and also sent to Sentry, saying which page and which version of the site and what went wrong. We send no form contents, cookies or personal details with it. Our servers’ logs of requests, which include IP addresses, are kept for about two weeks to diagnose problems and block abuse.

A notice at the foot of the site tells you that it uses cookies, and using the site means you accept them. These are the cookies the site sets:

• one that keeps you signed in, and a short-lived one while you sign in;
• on the Panel Designer’s pages, its own sign-in cookie, a security cookie that protects its forms, a “keep me signed in” cookie if you choose it on its own sign-in form, and a cookie that notes whether an ad blocker is on;
• one that remembers the aircraft you last opened in MRO, for 30 days;
• one that remembers you have seen the cookie notice, for a year.

We set no analytics or advertising cookies. The Panel Designer’s older sign-up form, which still answers at its old address, is protected from robots by Google reCAPTCHA, which receives your IP address when it runs.

To provide the site and your account; to take payment; to answer you; to send you the emails below; to keep the site secure and prevent abuse; to count what is used so we can improve it; to compile the anonymous statistics described in the Terms; and to meet legal obligations.

We send account email: verification, password reset, sign-in links and codes, receipts, messages about your requests and records, reminders you set up in MRO, emails about your membership and your 14 days, and for the Marketplace a note that somebody has written to you or asked a question, that a saved search has a match, and that a listing is about to end. We also send occasional site news; turn it off with the one-click link in any announcement, or ask us. We do not use an outside mailing-list company.

• Amazon Web Services hosts the site, stores files and backups, and sends our email.
• Cloudflare carries every page between your browser and our servers, and so receives your IP address and the addresses you ask for, and checks requests for robots and abuse.
• Stripe processes payments.
• Anthropic provides the artificial-intelligence reading we use. What is sent, and when:
  • in MRO, photographs of data plates and appliance tags, and the logbook and manual pages you ask to have read, with the text read from logbook entries to list the parts they name; logbook pages can show names, signatures and certificate numbers;
  • in MRO, to look for an aircraft’s manuals and a manufacturer’s service documents on the web, the manufacturer and model names, and the part names recorded under a manufacturer;
  • in the Builders Log, only when you press the button, with the price shown first: small copies of a draft entry’s photographs, with the kit, the day, the log’s sections and what you told us about the build, and the pages of a manual you ask to have read through; and a photograph of a part’s label you ask to have read;
  • in the Marketplace, a small copy of a listing’s main photograph, once, to frame it;
  • public Federal Register notices, to read what each one is.

  We do not send your name, email address or account with any of these; what is in the pages and photographs themselves goes as it is. We keep the result you see; for a manual read through, we keep its text so that you can search it.

• Sentry receives error reports.
• Meta (Facebook and Instagram) receives what we post to our own pages: a live Marketplace listing’s title, price and main photograph, and shared panel pictures labeled with the aircraft model.
• Google receives reCAPTCHA checks on the form that uses it, and your IP address when your browser loads the Panel Designer’s pages, which take fonts from Google Fonts and an address-lookup script from Google Maps.
• Public script libraries. The Panel Designer’s pages also take scripts from cdnjs, jsDelivr, jQuery’s and Bootstrap’s servers, which receive your IP address when your browser asks for them. The rest of the site uses fonts and scripts kept on our own servers.
• Video hosts. A Marketplace listing may show a video from YouTube or Vimeo; your browser fetches it from them when you open that listing.
• Our shop receives your CAD, Cut, Paint & Label request, with your name and contact details, when you send one.
• A default avatar service (ui-avatars.com) receives your name to draw your initials on the Panel Designer if you have not uploaded a picture.
• Public sources. To look things up, the site sends aircraft, engine and propeller identifiers, such as a registration or a model, to the FAA, the Federal Register, regulations.gov and manufacturers’ public websites, and keeps a dated copy of what comes back.
• We disclose information when the law requires it, or to protect rights, safety and security, and would transfer it with the business if Hangar Flying were ever sold.

• A Panel Designer picture you export or share (see the Terms).
• A Marketplace listing while it is live, with what you entered in it (see the Terms).
• Nothing else. Your maintenance records, your build log, your files and your messages are served only to your own account, and to a shop or customer you share an aircraft with.

The site keeps a copy of public FAA data, including the aircraft registry, which lists each registered owner’s name and address. It is shown to signed-in people looking up an aircraft, as the FAA publishes it.

Our administrators can see account details and what you create, to give support, to fix problems and to understand how the site is used. In the Panel Designer an administrator can sign in as you. In MRO an administrator can read an aircraft’s records but cannot change them, and each such reading is recorded. A shop you share an aircraft or a design with sees what you shared. A shop’s customer sees only their own aircraft.

• We keep your account and what you create while your account is open. Deleting a design in the Panel Designer erases it; pictures already exported, and statistics and other works already made, are kept.
• Closing your account hides your aircraft and records, your build logs and your Marketplace listings, and holds them for 30 days, during which you can reopen it. After that it can be removed for good, which blanks it as described below; it leaves our backups as they expire (about 90 days). Closing does not yet remove your Panel Designer designs; to have those removed, write to us.
• Signed maintenance records are permanent. The regulations require maintenance records to be kept (14 CFR 91.417) and to go with the aircraft when it is sold (14 CFR 91.419), so a signed entry cannot be changed or deleted by anyone. When an account that signed entries is removed, the account is blanked, and the signer’s name and certificate number on those entries remain.
• Marketplace listings are kept after they end, with their prices, as a record of what was offered. When an account that ever placed a listing is closed for good, the account is blanked (its name, email address, phone, address and business name cleared) so that the listings no longer point to a person. A photograph, document or video you take off a listing is removed.
• Records of ad views, clicks and short-link visits, and financial records, are kept as long as we need them for reporting, tax and disputes.
• A sign-in lasts 90 days, or 12 hours on a shared computer.

In the United States. If you use the site from elsewhere, your information is transferred to and processed in the United States, whose data-protection law may differ from yours.

Depending on where you live (for example under the GDPR, UK GDPR or the California privacy laws) you may have the right to see the personal information we hold about you, have it corrected or deleted, restrict or object to our use of it, receive a copy, withdraw consent, and complain to your data-protection authority. We do not sell personal information. To use any of these rights, write to us; we will confirm it is you before acting.

The site is not directed at children under 13 (or under 16 where local law sets that age), and we do not knowingly collect personal information from them. If we learn that we have, we delete it. A parent or guardian who believes a child has opened an account can write to us.

Whiskey Victor LLC. Ask a question through Tell us what goes wrong. See also the terms of service.