Privacy policy

01

Two kinds of person, and why it decides everything

Almost every question anybody asks about privacy in SquawkShop is answered by working out which of two people is being talked about.

The maintenance shop — our customer

The shop subscribes, signs in and pays. Its people have accounts. We decided what to collect about them and why, so for that information we are the data controller and this page is our promise to them.

The aircraft owner — the shop’s customer

He never signs up, never pays us and has no account. He reaches a read-only page through a link the shop sends him. His name, his aircraft, the findings on it, the photographs, the invoice and his drawn signature are in our system because the shop put them there, and the shop decides what is recorded, what he is shown and when.

So for everything inside a job, the shop is the data controller and SquawkShop is its processor. We hold it, protect it and hand it back; we do not decide what goes in it and we do not use it for our own purposes.

If you own an aircraft and want to see, change or remove something, ask the shop that worked on it. They can act on it directly. If you write to us instead we will pass it to them and tell you we have, because acting on it ourselves would mean overruling the shop about its own records.

02

What is in there

About the shop and its people — we are the controller

• Account: name, work email, the role you hold (IA, A&P, tech, parts, office), whether you are an admin, and your certificate number and kind of certificate where you have given them.
• Shop: business name, address, telephone, website, logo, brand colours, labour rate and tax rate.
• Sign-in and devices: when you signed in, whether it was refused, which devices are registered to you, what they are called, when each last checked in and how far out its clock is. This is what makes “who did what” answerable, and it is why it is kept.
• Billing: your plan, your seat count, your status and the identifiers Paddle gives us, such as sub_01j2…. We never see, receive or store a card number. There is no code path in SquawkShop that could receive one. The card is entered on Paddle's own checkout and what comes back to us is an identifier and the word “active”.
• What you write to us: emails and their attachments.

Inside the jobs — the shop is the controller

• Aircraft: registration (N-number), make, model, serial number, engine and propeller serials, times in service, equipment fitted.
• Inspection: checklist answers, findings and squawks, airworthiness directive research and how each was answered, service bulletin references.
• Photographs: of the aircraft and its parts — walkaround, borescope, plugs, data plates, pre-existing damage. People are occasionally in frame. A photograph also carries whatever its file holds, which can include a time and a location.
• Paperwork: logbook entries with the signing mechanic's name, certificate number and kind of certificate; reports; invoices and what is on them; parts and purchase orders.
• The aircraft owner: his name and the contact details the shop entered; his approvals, deferrals and declines with the reasons he gave; questions he asked and answers he got; any not-to-exceed figure he set.
• His signature: covered on its own in section 05.

We ask for no more than the work needs. There is no advertising identifier anywhere in SquawkShop, no behavioural profile, and no location tracking of a person.

03

Cookies, and the one third party that sees you

Short section, because there is not much.

• No analytics. There is no Google Analytics, no tag manager, no advertising pixel and no behavioural tracking on this website, in the app or on the aircraft owner's page.
• No advertising cookies at all. The app stores a sign-in token on your own device so you are not asked to sign in every morning. That is strictly necessary to make it work and there is nothing to consent to.
• This marketing website loads its typefaces from Google Fonts, which means Google's servers see your IP address when the page opens. We would rather tell you than not. The app and the aircraft owner's page load nothing from any content delivery network at all — no fonts, no scripts, no third parties — because an owner on one bar of signal should get the whole page or none of it, and because there should be nobody watching.
• The web server keeps ordinary logs — IP address, time, page, browser — for a short period, to keep the site up and to spot abuse.

04

Who else touches it

Four companies, each doing one job. That is the whole list, and if it changes we will change this page and move the date at the top.

Otherwise: we do not sell your information, we do not rent it, we do not share it for advertising, and we do not use it to train machine-learning models. Not as a policy we could quietly change — there is no such arrangement to change.

We will hand something over to a government or a court only where we are legally required to, and we will tell the affected shop unless we are forbidden to. If the business is ever sold, your records go with it and you will be told before it happens.

05

Signatures — exactly what is kept, and what for

When an aircraft owner authorises work on his page, four things are recorded together, and they only mean anything together:

• The drawn mark — a small image, trimmed to the ink, about 12 KB.
• The name he typed and the moment he signed.
• A frozen, itemised list of exactly what he approved, deferred and declined at that instant, with the reasons he gave and any not-to-exceed figure.
• A SHA-256 hash over that list — a short fingerprint that changes if a single character of the list changes.

What it is for

One thing: proving what was authorised, and when. It settles the argument at collection about whether a job was approved. It is used for nothing else. It is never shown to another shop, never used to identify anybody anywhere else, and never handed to a third party.

The signature image never goes back to the portal

Reading that page needs only the share link, and links get forwarded. Handing everyone who holds the link a clean image of somebody's signature would be handing them a forgery kit. So the owner's own page shows him the receipt — who, when, how many items, the total, the ceiling, the reference — and the drawing itself stays where only the shop can read it.

How long

A signature is part of the work authorisation it belongs to, so it is kept as long as that record is kept — see section 06 — and is deleted with it. It is not kept separately and it does not outlive the job.

06

How long things are kept

A trial that never became a subscription is deleted 60 days after it ends.

07

Deletion, and the part the FAA decides

This is the section that matters most, and the one where a comfortable answer would be a false one. There are two limits on deletion in SquawkShop. Neither is us being difficult.

A maintenance record is not ours to erase, and often not the shop’s either

Federal law puts real obligations on maintenance records:

• § 91.417(a)(1) and (b)(1) — the record of maintenance, preventive maintenance, alteration and inspection, including the description of the work, the date and the signature and certificate number of the person approving return to service, must be kept until that work is repeated or superseded, or for one year.
• § 91.417(a)(2) and (b)(2) — the permanent set (total time in service, life-limited parts, time since overhaul, current inspection status, airworthiness directive compliance with method, number and revision date, and the § 43.9(d) forms for major alterations) must be retained and transferred with the aircraft when it is sold.
• § 91.417(b)(3) — a list of defects given to an owner under § 43.11 is kept until they are repaired.
• § 91.417(c) — all of it has to be available for inspection by the FAA or the NTSB.
• § 43.9(a) — the entry must carry the name, signature, certificate number and kind of certificate of the person who approved the work. That is personal information, and it is required to be there. Take it out and the entry stops being a valid record.

So we will not erase a completed maintenance record on request, and a shop cannot ask us to erase one on behalf of an aircraft owner either. Doing it could put the aircraft's owner out of compliance and destroy the evidential value of the record for everyone who relies on it — the next buyer, the next IA, an accident investigator.

What we will do instead

• Correct an error. A wrong name, a wrong serial, a misattributed finding — fixed, and the correction is recorded rather than the original being quietly overwritten.
• Remove a photograph that should not be there — a bystander in frame, something that was never part of the job.
• Delete a person's account and contact details when they leave a shop. Their sign-in, their email and their devices go. Their name and certificate number stay on the entries they signed, because § 43.9 requires them to and because an entry with the signature removed is worth nothing.
• Delete an aircraft owner's contact details — his phone number and email — on the shop's instruction, without touching the maintenance record itself.
• Delete a whole shop when it leaves, 60 days after the subscription ends, once it has taken its export. Everything goes, subject only to the backup window and the billing records above.

Where an aircraft owner asks for erasure and the record must be kept, we will say so plainly and say which rule requires it, rather than going quiet.

The second limit: the tablet in the hangar

SquawkShop is offline-first. That is the point of it — the job is written to the mechanic's tablet the moment he enters it, and works with no signal for thirty days. The consequence is unavoidable and we are not going to pretend otherwise:

Deleting something on our servers does not reach a copy already on a tablet. If a mechanic has a job on his iPad and that job is deleted here, the copy on his iPad is on a device we do not hold. Withdrawing him stops him pulling anything further down and stops him publishing or syncing. It does not reach into his device and remove what is there. Nobody's software can, and any privacy policy that implies otherwise is describing a product that does not work in a hangar.

Exports are the same. Once a shop has taken a job out as a file, that file is theirs and out of our reach by design — which is exactly why we encourage it.

What deletion here does do: it removes the record from the live system and from every device that syncs afterwards, and it stops it being served to anybody, including through a share link.

08

Your rights, and which of them actually apply

Rather than list every right in every statute and let you work out which is yours, here is the honest position.

If you are in the United States

The comprehensive state privacy laws are written with thresholds, and SquawkShop is well under all of them. California's CCPA/CPRA applies to a business with more than $26,625,000 of annual gross revenue, or that buys, sells or shares the personal information of 100,000 or more California consumers or households a year, or that gets half its revenue from selling or sharing personal information. We are a one-person business that sells software to maintenance shops and sells no personal information at all, so none of the three is close. The states that set no revenue threshold, such as Texas and Nebraska, exempt small businesses and turn on selling sensitive data, which we do not do.

We are going to honour the requests anyway. It costs one person a morning and arguing about a threshold is a poor answer to give a customer. So whoever you are and wherever you are in the US, you can ask us to:

• tell you what we hold about you and why;
• give you a copy in a form you can use;
• correct something wrong;
• delete it, subject to section 07;
• stop it being sold or shared — already true, and it will stay true.

We will not treat you worse for asking. There is no charge, and we answer within 45 days.

Aircraft owners in the US: ask the shop. The shop holds the records and can act on them directly; we would be overruling it. Section 01 explains why.

Breach: Texas's Identity Theft Enforcement and Protection Act (Tex. Bus. & Com. Code § 521.053) requires notice without unreasonable delay and no later than the 60th day after a breach is determined to have occurred, and notice to the Texas Attorney General within 30 days where 250 or more Texas residents are affected. We commit to something faster and more checkable: if records held for a shop are exposed, we will tell that shop within 72 hours of becoming aware, with what we know at the time, and update as we learn more. The shop then decides what its own customers are told, because it is the controller.

If you are in the EU or the UK

Be straight about this before you subscribe rather than after.

If an EU or UK maintenance shop uses SquawkShop, the shop is the controller and we are its processor under Article 28, and the shop keeps the duties to its own customers — telling them, having a lawful basis, answering their requests. Our duties are to it: to process only on its instructions, to keep it secure, to tell it about a breach without undue delay, to help it answer requests, and to delete or return everything at the end subject to section 07.

Three things are true today and you should know them:

• A data processing agreement is available and we will sign it — including the European Commission's standard contractual clauses, which is what makes the transfer to our US servers lawful. Ask before you subscribe, not after.
• Everything is stored in the United States. Supabase in a US region, Cloudflare in front of it. There is no EU region option today.
• We have not appointed an Article 27 representative in the EU or the UK, because we have no EU or UK customers. If we take one, we will appoint one and name them here.

If you are an EU or UK shop and you want SquawkShop, write to us before you subscribe and we will get the paperwork done first. It is a short job and it is better done in the right order.

09

How it is kept safe, and what we are not

What is true:

• The wall is the database, not the app. The app on a tablet is a public file — anyone can download it and edit it. It is not what decides anything. Every rule about who may read or write a record is enforced by the server, which refuses no matter what the tablet is running. Somebody who downloads SquawkShop and cuts every check out of it gets an empty app and none of your aircraft.
• Isolation between shops is proved, not assumed. The checks that one shop cannot read another's records are run as tests before anything ships — 49 of them on sign-in and roles alone, plus the earlier tenant-isolation sets.
• Every person has their own sign-in, and a person or a single device can be withdrawn from anywhere, in seconds.
• Everything travels over HTTPS and is encrypted at rest by Supabase.
• No card numbers, anywhere, ever. See section 02.

What is not true, and it would be easy to imply:

• We hold no SOC 2 report, no ISO 27001 certificate and no third-party security audit.
• There is no 24-hour security team. There is one mechanic in Texas who reads his email.
• No system is perfectly secure, and we are not going to claim this one is.

If you find a way in, write to support@squawkshop.aero. You will get a person, a thank-you, and no lawyers.

10

Children

SquawkShop is a tool for certificated mechanics. It is not directed at children, we do not knowingly collect anything from anyone under 18, and there is no reason for a child's information to be in it. If you think there is some, tell us and it will be removed.

11

Changes to this policy

The date at the top always moves when anything changes. If we change something that materially affects how your information is handled — a new subprocessor, a new purpose, a longer retention — we email every subscriber at least 30 days beforehand.

12

Asking us something

There is no privacy department. There is a mechanic, and he answers his own email.