Soma Flight Privacy Policy

Soma Flight needs an account, because your flights, alerts and history are kept on our servers so they reach every device you sign in on. We collect only what the app needs to work.

Your account

You sign in with Apple, with an email link or, where we offer it, with Google. We keep your email address and the user id our sign-in system gives your account. If you choose Apple’s Hide My Email, we receive a private relay address that forwards to you, and we never see your real address.

Your profile

After your first sign-in, the app asks for a first name, a last name and a photo. All three are optional. Apple shares your name the first time you sign in with it, if you let it, and never shares a photo. Google may share your name and profile picture; the app offers that picture as a starting point and uploads it only if you keep it. You can also choose a photo from your library, take one with the front camera on iPhone, or use your initials. Before a photo leaves your device, the app resizes it and removes its metadata, such as the location, camera and date. We keep it in private storage. You can also add an emoji. We also keep a few account settings, such as your units and your plan.

Your flights

• The flights you follow, whether each one sends you alerts, and the details you choose to add: cabin class, seat, booking code, notes and whether the trip is personal or for business.
• Your flight history (Passport): flights you followed move there on their own once they land, and you can add, edit and delete past flights by hand.
• Flights you import. The app can read an export file from another flight tracker such as Flighty, a CSV file, your calendar or a confirmation email you share with it. It reads them on your device, shows you what it found and sends us only the flights you tick. Upcoming flights too far ahead to look up yet wait on your device until they come within reach.

When you search for a flight, we do not keep your search against your account. Answers are cached for everyone, with no record of who asked.

Friends and shared flights

If you use Friends, we keep your friend code, the invitations you send and receive, the people you are friends with and the choices you make about each of them. We also keep a record of each flight you share by link: which flight, when you shared it and whether you stopped. We store only a scrambled form of each link, so our copy cannot be used to open it.

Notifications

To send you flight alerts and keep Live Activities current on iPhone, we store the push tokens Apple gives your device, linked to your account. The Mac app does not register a push token. We also keep which kinds of alerts you have turned on or off.

Text message alerts

Soma Flight has an optional feature that texts you alerts. It is switched off today and sends no texts. Once we turn it on, if you choose to use it, we will keep your mobile number, a scrambled copy of the six-digit code that confirms it, the text alert switches you choose (for your account and for each flight), whether you replied STOP, and a log of the alerts we texted you (which flight, which alert and when, without the words). To limit how many codes can be sent, we also keep a short log of code requests in which your number is stored only in scrambled form, for one day.

Usage limits

To protect the service from abuse, we record which of our server functions your account called and when. We use these records only to apply usage limits and delete them within a day.

Soma Flight contains no advertising, no analytics and no tracking. It does not read your contacts, and nobody can find you by your phone number or email address.

Some features use information that never reaches our servers:

• Location. The “Leave by” time can use where you are, only while the app is open and only if you allow it. The app asks Apple Maps for the drive time to the airport. We never receive or store your location.
• Calendar. If you turn on Settings > Calendar, the app adds an event for each flight you follow and keeps it up to date. Calendar imports are read on your device too.
• Camera and boarding passes. The boarding pass scanner on iPhone reads the camera on your device. Your boarding passes, which hold your name, booking reference and barcode, are stored in the app on your device, can be shown on your Apple Watch and are never sent to us.
• Travel documents. Loyalty numbers, passport details and Known Traveler and Redress numbers are kept in your device’s Keychain. They leave your device only if you turn on iCloud Keychain sync for them, which is off by default.
• Settings and lists. Favourite airports, recent searches, your clock setting, your TSA PreCheck switch and the reminders the app schedules for you.
• Offline copy. The app keeps a copy of your flights so it works without a connection. It is excluded from device backups.
• Exports. When you export your flight history, the file is built on your device and handed to you through the share sheet.

When you sign out or delete your account, the app clears the offline copy, your recent searches and your boarding passes from the device. Calendar events it added are removed when nobody is signed in.

We use the information described above to:

• sign you in and keep your flights, history and settings in step across your devices;
• look up your flights and send you the alerts you asked for;
• show your name, photo and flights to the friends you choose;
• keep the service secure and within its usage limits;
• answer you when you write to us.

We do not use your information for advertising, we do not build profiles of you for anyone else and we do not sell or rent it.

Flight times, gates, positions and status come from FlightAware’s AeroAPI. Airport delays and notices come from the Federal Aviation Administration, weather from the National Weather Service’s aviationweather.gov, and security wait estimates from checkpoint figures the TSA publishes. Airport and airline reference data comes from public sources such as OurAirports, Natural Earth and Wikidata, and some airline logos come from Wikimedia Commons.

Our servers ask these sources about flights and airports. They receive the flight or airport we ask about and never your name, email address or anything else about you.

Your friends

You become friends with someone only when one of you hands the other an invitation link or friend code on purpose and it is accepted. Your friends see your name, emoji and photo. Nobody else does. For each friend you choose:

• whether they see your upcoming flights (on by default);
• whether they see your Passport totals (off by default);
• whether you get alerts about their flights (off by default).

You can also pause all sharing at once. A friend who sees your Passport may also see how many times you have flown through an airport and the month of your latest visit. Friends see flight details only and never your seat, booking code, notes or boarding pass.

Shared flight links

When you share a flight, anyone with the link can see that flight’s details, without an account, until 24 hours after it arrives or until you stop sharing. The page shows flight data only. It never shows your name, seat, booking code or notes.

Service providers

We use a small number of companies to run Soma Flight. They handle your information only to provide their service to us:

• Supabase hosts our database, sign-in, file storage (profile photos) and server functions. Sign-in emails are sent through it.
• Apple provides Sign in with Apple, delivers push notifications and Live Activity updates, and works out drive times in Apple Maps.
• Google provides Google sign-in, if you use it once we offer it.
• Linq will send text message alerts, only if you turn them on once the feature is available. It receives your number and the alert.

Other cases

We may disclose information if the law requires it, to protect the rights and safety of our users or others, or as part of a merger or sale of our business, in which case this policy continues to apply to it. We do not sell your information and we do not share it for advertising.

You can delete your account at any time in Settings > Account > Delete Account, on iPhone or Mac. Once you confirm, your account is removed from the app and its sign-in right away. The account stops working, your friends no longer see you, your shared flight links stop working and we stop sending you alerts and texts.

What we keep: the account archive

Before we remove the account, we keep an archived copy of it. The archive holds:

• your email address;
• your profile, including your name, emoji and photo;
• your followed and past flights, with the seats, booking codes and notes you added;
• your friends and your sharing choices about each of them;
• your shared flight links;
• your notification preferences and push tokens;
• your text alert settings and the log of texts sent to you.

The archive is kept in a restricted store that only Soma Labs staff systems can reach. It is not shown in the app and it is not visible to other users. We also keep a stripped record of your profile, with its id, the fact that it was deleted and settings such as your units, but without your name or photo.

How long we keep it

We keep the archive until you ask us to erase it. To do that, email privacy@somalabs.me from the address of the account, or tell us which account it was. We then erase the archive within 30 days.

Your choices about the archive

You can ask us for access to your archive, for a copy of it or for its erasure, at privacy@somalabs.me.

On your device, deleting your account clears the app’s offline copy, recent searches and boarding passes. Your travel documents stay in your Keychain and your favourite airports stay in the app until you remove them or delete the app. If you used Sign in with Apple, you can also stop using it with Soma Flight in your Apple Account settings.

• Your account, profile, flights, history, friends and settings: while your account is open, then in the account archive described above until you ask us to erase it.
• Usage limit records: deleted within a day.
• Shared flight link records: deleted about 30 days after the flight, or 30 days after you stop sharing if that comes first.
• Text alert number: until you tap Forget My Number or delete your account. Replying STOP turns texts off at once and keeps the number so we know not to text it. The log of texts sent is trimmed to the last 30 days as new texts go out, and code requests are kept for one day.
• Push tokens: until Apple reports they no longer work or you delete your account.

• Export. You can export your flight history as a JSON or CSV file from the app at any time.
• Edit. You can change your name, photo, flights, history and sharing choices in the app.
• Permissions. Location, calendar, camera and notifications are each asked for separately and can be turned off in your device’s settings.
• Alerts. You can turn alerts off per flight or per kind, and text alerts off by replying STOP or in the app.
• Delete. You can delete your account in the app, and ask us to erase the account archive as described above.

You can also ask us to access, correct, copy or delete your information by emailing privacy@somalabs.me. We may need to confirm the request comes from you before we act on it. We will not treat you differently for exercising these rights.

Soma Flight is not directed to children under 13, and we do not knowingly collect personal information from them. If we learn that we have, we will erase it.

We may update this policy from time to time; the date at the top always reflects the latest version. If a change is material, we will tell you in the app or by email before it takes effect.

If you have a question about this policy, or want to exercise any of the rights described above, email privacy@somalabs.me.