Privacy notice
Last updated 13 November 2026
ATPL Buddy (“we”) is a study planner for UK ATPL(A) theory students. This notice explains what personal information we hold about you, why, who else handles it, and what you can do about it.
Who we are
ATPL Buddy is run by William Tunna, a sole trader trading as ATPL Buddy, based in the United Kingdom. William Tunna is the controller of your personal data. For anything about your data, or to make a complaint, email privacy@will.aero.
What we collect
| Information | Where it comes from |
|---|---|
| Your email address | You, when you sign in |
| Your name and profile picture link | Google, only if you choose “Continue with Google” |
| The name you choose to show in the app, your daily study time and study days, your readiness setting | You |
| Your 13 subjects: status, booked exam dates, attempts and results | You |
| Study sessions (subject, time, length, questions answered, notes) and mock scores | You |
| From a CAA Result Slip: subject, exam date, mark, attempt number and the learning objective codes you were marked down on | You, when you upload a slip |
| Your training route, school and question bank, and (if you tell us) how you heard about ATPL Buddy | You, in Settings |
| Exam feedback you post: subject, how banky it felt, your description, study methods, and (if you add them) result, exam date and attempt | You. Other signed-in students can read it, shown as “Anonymous” unless you choose to show your first name. They never see your email |
| Feedback you send with the “Send feedback” button, with the page you were on and your device type, screen size and browser | You |
| Usage events: which pages you open and which features you use (for example “logged a session” or “used a calculator”), with the time. Before you have an account, these are linked to a random ID stored on your device instead of to you. They never include your scores, notes or Result Slip contents | The app, unless you turn it off |
| Sign-in times, your plan, which announcements you've dismissed, which terms you accepted and when | The app |
| Technical logs: IP address, browser type, pages requested, errors | Your browser, through our hosting providers |
Result Slips stay on your device. When you upload a CAA Result Slip, it is read inside your browser. The file is never sent to us. Your name, address, date of birth and candidate number on the slip are not stored; only the items listed above are saved.
We don't ask for or hold payment card details. When paid plans start, payments will be handled by a payment provider, and this notice will be updated to name it before then.
Why we use it, and our lawful basis
| Purpose | Lawful basis (UK GDPR) |
|---|---|
| Creating your account, signing you in, and providing the planner, readiness lights, formula vault and KDR decoder | Contract: we need it to provide the service you asked for |
| Keeping the service secure, preventing misuse, fixing faults, and suspending accounts that break the terms | Legitimate interests: running a safe and working service |
| Working out overall usage numbers (for example, how many people use the KDR decoder, or which syllabus areas students find hardest) to improve the app and its content | Legitimate interests: improving the service. We look at totals, not at individuals, for this |
| Showing your exam feedback to other students, and moderating posts | Contract: it's the feature you chose to use. Moderation is a legitimate interest and a legal duty under the Online Safety Act |
| Usage events: seeing which features help, where people get stuck in setup, and who is an active beta tester (for founding-member access) | Legitimate interests: improving a service in beta. You can turn this off at any time (see below) |
| Reading and replying to feedback you send | Legitimate interests: improving the service and answering you |
| Answering your emails, requests and complaints | Legitimate interests, or legal obligation for data protection requests |
| Keeping payment and tax records, once paid plans start | Legal obligation |
We don't send marketing emails. If that changes, we'll only send them if you opt in, and every email will have an unsubscribe link. We don't sell your data, use it for advertising, or make automated decisions about you that have legal or similarly significant effects. The readiness lights and study plan are suggestions for you; nobody else sees them.
The site isn't aimed at children, and you need to be 16 or over to use it.
Who else handles your data
We use these providers (“processors”) to run ATPL Buddy. Each has a data processing agreement with us and may only use your data to provide its service to us.
| Provider | What for | Where |
|---|---|---|
| Supabase Inc. | Database and sign-in | Data stored in London, UK |
| Vercel Inc. | Hosting the website and running the app | Runs in London, UK; served from the nearest location to you |
| Resend Inc. | Sending your sign-in code emails | United States |
| Google LLC | Only if you choose “Continue with Google” | United States and elsewhere |
These companies are based in the United States, so some of your data may be accessed from or sent there. Where that happens, it is protected by the UK–US data bridge for certified companies, or by the UK International Data Transfer Addendum to the standard contractual clauses. Email privacy@will.aero for more detail.
We may also share information if the law requires it, or to protect someone's safety.
Cookies and storage on your device
ATPL Buddy only uses what it needs to work, plus its own usage statistics. There are no advertising cookies and no third-party trackers or analytics services.
- Sign-in cookies (names starting
sb-) keep you signed in. Without them you couldn't use your account. studyos_returningremembers that you've signed in on this device before, so opening ATPL Buddy takes you to sign in rather than to set-up. It holds no personal information.- Browser storage remembers a running study timer and your dashboard layout on that device, so they survive the screen locking or the page reloading. While you set up before creating an account, it also keeps your answers so you don't lose them. It stays on your device and the setup answers are removed once your account is created.
- Usage statistics use a random ID kept in browser storage (
studyos.aid) and record the events described above on our own servers. The law allows this kind of statistics to improve a service without asking first, as long as you can say no. To turn it off, use Usage data in Settings, or the switch below on any device (you don't need an account). We also respect your browser's Global Privacy Control signal, which turns it off automatically.
If you add something new that needs your consent, we'll ask first and update this notice.
How long we keep it
- Your account and study data: until you delete your account, or until you haven't used ATPL Buddy for 2 years, whichever comes first. You can delete it yourself at any time in Settings, and it takes effect straight away. Opening the app while signed in counts as using it.
- Exam feedback: until you delete it or your account, or we remove it for breaking the rules. Reports about posts are deleted with the post.
- Backups: deleted data may remain in our providers' encrypted backups, and in our own daily encrypted backup copies, for up to 30 days before they are overwritten. Backups are only used to restore the service after a fault.
- Admin activity log: a record of admin actions (for example, exporting or deleting an account) is kept for 2 years to keep the service secure. When you delete your account, your email address is removed from it.
- Usage events: 12 months, then deleted automatically.
- Feedback you send: until you delete your account, or sooner once we no longer need it.
- Technical logs: kept by our hosting providers for a short time, normally no more than 7 days.
- Emails with us: up to 2 years after the conversation ends, unless we need them longer for a legal claim.
- Payment and tax records (once paid plans start): 6 years, as the law requires.
Your rights
You have the right to:
- Get a copy of your data. Settings → Your data downloads everything you've logged, or email us for a full copy.
- Correct anything that's wrong. Most of it you can edit in the app.
- Delete your account and data (Settings → Delete account).
- Take your data elsewhere in a machine-readable format (the JSON and CSV downloads).
- Object to our use of your data where we rely on legitimate interests, or ask us to restrict it.
Email privacy@will.aero to use any of these. We'll reply within one month, and we may ask you to confirm your identity first.
Complaints
If you're unhappy with how we've handled your data, email privacy@will.aero with “Data protection complaint” in the subject. We'll acknowledge it within 30 days and tell you what we're doing about it.
You can also complain to the Information Commissioner's Office (ICO), the UK data protection regulator, at ico.org.uk/make-a-complaint or on 0303 123 1113. We'd appreciate the chance to put things right first.
Security
Your data is encrypted in transit and at rest. Each account can only read its own data, enforced in the database itself. Admin access is limited to named people, and every admin action is logged. If a breach puts your rights at risk, we'll tell you and the ICO as the law requires.
Changes to this notice
If we make important changes, we'll tell you in the app before they take effect. The date at the top shows when it last changed.