Privacy notice

1. Controller

2. Scope and core principle

AIRWATCH does not require a user account. A random browser identifier and a local secret are created to associate monitoring rules, push subscriptions and confirmed email subscriptions with the current browser. AIRWATCH does not use advertising trackers, does not create cross-site profiles and does not sell personal data.

3. Hosting and technical server logs

When the website is requested, the hosting infrastructure may process technically necessary connection data such as IP address, date and time, requested resource, response status, transferred volume, referrer, browser and operating system. This is necessary to deliver the website, maintain security, diagnose faults and prevent abuse. The legal basis is Article 6(1)(f) GDPR; where the request is made to use a service, Article 6(1)(b) GDPR may additionally apply. Log scope and retention are determined by the hosting configuration.

4. Aggregate visitor statistics

AIRWATCH keeps a separate, aggregate page-view statistic. It stores the date, a two-letter country or region code and the number of requests. No IP address, full user agent, browser identifier, fingerprint or cross-device identifier is written to this statistics file. Obvious bots are excluded. Country information is taken, where available, from a country header supplied by the host or CDN; otherwise only a region contained in the browser-language header may be used. If neither is available, the visit is counted as unknown.

The purpose is basic reach and operational analysis. The legal basis is Article 6(1)(f) GDPR. The legitimate interest is understanding general use without individual tracking. Daily aggregates are retained for up to 400 days. Technical hosting logs remain separate.

5. Local storage, PWA and cache

AIRWATCH does not use marketing cookies. Local storage may contain the random device ID, the local authentication secret, selected language, theme and unit system, the last region and radius, map filters, collapsed-panel states and a compact last air-picture snapshot. A service worker caches application files and enables installation as a Progressive Web App and web push.

Storage and access are necessary to provide the user-requested, accountless functions. Where Section 25 of the German Telecommunications Digital Services Data Protection Act (TDDDG) applies, Section 25(2) no. 2 TDDDG is relied upon. Subsequent processing is based on Article 6(1)(b) GDPR for requested functions and Article 6(1)(f) GDPR for secure operation. Local data can be erased through the browser's website-data controls; AIRWATCH will then treat that browser as a new device.

6. Monitoring regions and rules

When a region or rule is created, AIRWATCH processes coordinates, radius, label, filter, altitude range, cooldown, notification channels and activation status together with the pseudonymous device identifier. Recently selected regions may be stored server-side for up to seven days so that a recent air picture is available on the next visit.

7. Device location

“My location” uses the browser's geolocation interface only after permission is granted. Coordinates are used as the map centre, stored locally and transmitted as the selected AIRWATCH region. The legal basis is consent under Article 6(1)(a) GDPR. Permission can be withdrawn in the browser or operating-system settings.

8. Web push

When push is activated, AIRWATCH stores the browser-generated push subscription, including the push-service endpoint and cryptographic keys. Notifications are delivered through the push service used by the browser or operating system. Depending on the device, that provider may process technical delivery data. The legal basis is consent under Article 6(1)(a) GDPR. Push can be disabled in AIRWATCH and in browser or system settings.

9. Email subscriptions and area-scan type subscriptions

For email notifications AIRWATCH processes the email address, subscription status, confirmation and unsubscribe tokens, timestamps, associated browser devices, assigned monitoring rules and delivery status. New addresses are activated through double opt-in. A previously confirmed address can be linked to another AIRWATCH browser without sending another confirmation email after the address has been checked live.

An area-scan type subscription additionally stores the selected aircraft type and the north, south, east and west boundaries of the visible map area. A technical per-flight state prevents repeated email messages for the same detected aircraft during one continuous flight. Administrative assignment without double opt-in is permitted only where the recipient has validly requested or authorised the notifications.

The legal basis is consent under Article 6(1)(a) GDPR and, where notifications are expressly requested as a service, Article 6(1)(b) GDPR. Consent can be withdrawn through the unsubscribe link, AIRWATCH settings or by contacting the controller.

9a. Military user photos

When the optional user-photo function is enabled, visitors may upload one image at a time only for an aircraft that AIRWATCH verifies server-side as military. AIRWATCH processes the image, aircraft and sighting identifiers, approximate aircraft position, upload time, the pseudonymous browser-device identifier and, if voluntarily entered, a photographer name, capture date/time and location label. The sighting date and time are prefilled automatically but can be edited before publication.

The uploaded file is used only as a temporary input for image processing. AIRWATCH validates and decodes it, removes embedded metadata, reduces its dimensions and re-encodes it as JPEG. After successful processing, the temporary original upload is deleted and is not retained permanently; only one reduced JPEG version is stored. The new upload initially remains unpublished and is visible only from the uploading browser and to the administrator. Only after the uploader selects PUBLISH are the AIRWATCH field and the selected optional labels permanently burned into that reduced JPEG and the image released to the public sighting gallery.

Publication also triggers a formatted administrator email in which the published image is displayed within the message rather than sent as a separate attachment. Subscribers receive photo notifications only where they have activated the corresponding option for a matching monitoring radius. The uploader can delete the image from the same browser; the administrator can view and delete every image and can disable the entire function. Public image links use long random access tokens.

The purpose is to document military aircraft sightings, operate the requested gallery and notification functions, and prevent abuse. Depending on the use, the legal basis is Article 6(1)(b) GDPR and the legitimate interests in operating and securing the voluntary community function under Article 6(1)(f) GDPR. Users must upload only images they are entitled to publish and should avoid recognisable persons, private homes, vehicle plates or other unnecessary personal data. Storage is set by the administrator to the duration of the flight, 1, 3, 5 or 7 days, or indefinitely; earlier deletion by the uploader or administrator remains possible.

10. Aircraft, track and shared-link data

AIRWATCH retrieves publicly available ADS-B data server-side from ADSB.lol and, as a fallback, Airplanes.live. Those providers receive the AIRWATCH server IP and the requested coordinates and radii, but not the local AIRWATCH browser identifier. General positions and tracks are retained for up to one hour; aircraft classified as military are additionally retained for up to 24 hours. Aircraft data generally does not relate to website visitors.

When an aircraft short link is created, AIRWATCH stores a random share token, the aircraft identifier, a snapshot of the displayed aircraft data and the creation time. When the link is opened, AIRWATCH uses the newest available stored track point while the contact is current. Once it is no longer current, the same link opens the available one-hour or military 24-hour history; if that history has already been cleaned up, the original snapshot remains as a fallback. Share records are normally removed after 30 days.

11. Maps, search and external resources

These requests are necessary for the functions actively requested by the user. The legal basis is Article 6(1)(b) GDPR and Article 6(1)(f) GDPR. The legitimate interest is an efficient, functional map service.

12. External links

Google Search, PayPal, Buy Me a Coffee and 13delusions.com are opened only after an active click. Data is then processed under the privacy terms of the selected provider. Depending on that provider, processing may take place outside the European Economic Area.

13. Recipients and international transfers

Recipients may include the web host, email-transport infrastructure, the browser or operating-system push provider, OpenStreetMap, CARTO, unpkg, Photon and the ADS-B data providers. Some providers may use infrastructure outside the European Economic Area. Where the controller is responsible for such a transfer, it relies on the applicable GDPR transfer mechanism, such as an adequacy decision or appropriate safeguards, where required. Details can depend on the provider and route used at the time of the request.

14. Retention

• Aggregate visitor daily values: up to 400 days
• General air picture and tracks: up to 1 hour
• Military tracks: up to 24 hours
• Cron diagnostics: up to 3 hours
• Alert log: normally up to 30 days, configurable by the administrator
• Inactive browser devices: normally up to 180 days, configurable by the administrator
• Recently selected browser regions: up to 7 days
• Pending email confirmation: confirmation link valid for 24 hours; technical cleanup may follow later
• Confirmed email and type subscriptions: until withdrawal, unsubscribe or administrative deletion
• Military user photos: flight duration, 1, 3, 5 or 7 days, or indefinitely, as configured; earlier deletion remains possible
• Aircraft short-link records and their fallback snapshots: normally up to 30 days
• Local browser data: until erased by the user or browser

15. Security

The local device secret is stored on the server only as a hash. Database, administrator credentials and private keys are located outside the public web directory. The website is delivered over HTTPS. No internet service can guarantee absolute security.

16. Your rights

Subject to the applicable legal requirements, data subjects have rights of access, rectification, erasure, restriction, data portability and objection. Consent may be withdrawn at any time with future effect. A complaint may be lodged with a competent data-protection supervisory authority. Because AIRWATCH operates without accounts and largely pseudonymously, proof that a browser identifier or email address belongs to the requester may be necessary.

17. Objection to legitimate-interest processing

Where processing is based on Article 6(1)(f) GDPR, you may object on grounds relating to your particular situation. For direct marketing—which AIRWATCH currently does not perform—an objection would apply without the need to state reasons.

18. Automated decisions and children

AIRWATCH does not make automated decisions about visitors within the meaning of Article 22 GDPR and does not profile them. Automated type and military classifications concern displayed aircraft. The service is not specifically directed at children and does not knowingly request special-category data.

19. International users

This notice is designed around the GDPR and German data-protection law. Mandatory privacy rights under other applicable laws remain unaffected. International availability does not by itself determine which law applies to an individual case.

20. Changes and contact

This notice may be updated when functions, providers or legal requirements change. Privacy requests can be sent to contact@13delusions.com.

Last updated: 30.07.2026 · AIRWATCH Version 2.40.0