Privacy Policy

Who we are

Vector is a training companion for pilots — question bank, ground school, radiotelephony practice, mock interviews and offline VOR / CRP-5 trainers — available on the web and as a native Android app. This policy explains what personal data we collect when you use Vector, why we collect it, and the choices you have. It applies to both individual pilot accounts and accounts that belong to a flight school (organization) on Vector.

What we collect

• Account data — your email address, display name and password. Your password is stored only as a bcrypt hash on our servers; we never store or see it in plain text.
• Training data — your training level (PPL / CPL / ATPL), progress, answer history, spaced-repetition review state, exam and practice results, and usage analytics events (for example which pages and lessons you open). This is the core of the product: it is what lets Vector aim your practice at your weak areas.
• Flight-school membership (optional) — if you join a flight school on Vector (by invitation or by registering a school), we store your membership and role in that organization. Your school's staff can see your training progress as part of running their training program.
• Technical data — a randomly generated device identifier (used to bind your login session to your browser), and standard server logs (IP address, user agent, timestamps) kept for security and troubleshooting, including an append-only audit log of authentication events.

We do not collect payment card details anywhere (see “Payments” below), and we do not build advertising profiles.

How we use your data

• To operate your account and sync your training progress across web and Android.
• To personalise your practice — the weakness map, review queue and readiness scores are computed from your own answer history.
• To send essential transactional email: account verification and password reset. We do not send marketing email without asking you first.
• To generate AI feedback on your mock-interview and radiotelephony answers (see the processor list below).
• To keep the service secure: login brute-force protection, session management and the security audit log.

Who processes your data

We use a small number of processors, each for one specific job:

• Brevo — delivers our transactional email (account verification and password reset). Brevo receives your email address and the content of those messages.
• DeepSeek — provides the AI feedback for mock interviews and radiotelephony practice. When you request feedback, the answer you gave (and the question or scenario it belongs to) is sent to DeepSeek via our backend proxy — never directly from your browser, and never with your email address or password attached.
• Hosting — Vector runs on a virtual private server in a commercial datacenter. All data is stored there; we do not replicate it to other providers.

We do not sell your data, and we do not share it with advertisers or data brokers.

Cookies and local storage

Vector uses exactly one cookie: an essential first-party authentication cookie named vec_token, which keeps you signed in. We also use your browser's local storage for your session refresh token, your device identifier and the state of the offline trainers (VOR and the CRP-5 flight computer), so they keep working without a connection.

We use no advertising cookies and no third-party tracking cookies of any kind. That is why Vector does not show a cookie-consent banner: consent requirements apply to non-essential cookies, and the single cookie we set is strictly necessary for the service to function.

Payments

Paid access to Vector is purchased through Google Play in the Android app. Google processes the payment and we never receive your card details — only the entitlement status of your account. Signing in on the web inherits that entitlement automatically; no payments are taken on the web.

Data retention

We keep your account and training data for as long as your account exists — that history is what powers your long-term progress tracking. Security and server logs are kept only as long as needed for security monitoring and troubleshooting, then discarded. If your account is deleted, your personal data is removed from the live systems; residual copies in short-lived backups expire on the normal backup rotation.

Your rights

You can, at any time:

• Access — ask for a copy of the personal data we hold about you.
• Correction — fix inaccurate account data (most of it you can edit yourself in Settings).
• Deletion — ask us to delete your account and its data. Send the request from your registered email address and we will action it and confirm.

To exercise any of these, email support@vector-aviation.example.

Security

Passwords are stored as bcrypt hashes only. Sessions use short-lived access tokens with rotated refresh tokens, repeated failed logins are locked out, and authentication events are recorded in an append-only audit log. All traffic between your browser and our servers is encrypted in transit.

Changes to this policy

If we change this policy in a way that matters — new data, new processors, new purposes — we will update this page and its “last updated” date, and flag significant changes in the app.

Contact

Questions about privacy at Vector: support@vector-aviation.example. See also our Terms of Service.