Privacy policy

Who we are

Fickle Sports ("we", "us") is the controller of the personal data described here, under the UK GDPR, the Data Protection Act 2018 and, where it applies, the EU GDPR. For any privacy question or request, email privacy@ficklesports.com.

What we collect

• Account. Your name, email address and profile photo, received from our sign-in provider (Clerk) when you create an account. We give your account a random pilot ID, which appears in profile links. (Accounts created before September 2026 have an ID based on the start of their email address; a private profile keeps it out of public view.)
• Pilot profile. Anything you add: bio, certification, experience, timezone, units, gliders and other gear (including check dates), weather limits, home bases (with coordinates and postcode), holidays, alert settings, and Goose preferences.
• Location. With your browser's permission, your device location to centre the map, find nearby sites and work out drive times. We keep your last map view on your device. Bases, trips, ride offers and check-ins store the locations you choose. If you turn on Live sharing, your check-ins are shown to the audience you pick.
• Flying records. Logbook entries (site, times, glider, companions, notes, ratings and statistics from imported IGC files; we don't keep the raw track), favourites, sites you've viewed, flying intentions ("heading here"), trips, votes and availability.
• Social and messages. Friends, follows, blocks, direct and group messages, trip chat, and any reports you make.
• Content you publish. Site ratings and reviews, photos, site reports, proposed site changes, custom sites you share, and community posts. Photos are published as you upload them; remove location metadata first if you don't want it shared.
• Goose conversations. What you ask Goose and what it replies, the actions it takes for you, the notes you dictate, and the memories it keeps about your flying (for example skill level, goals or kit). See Goose and AI.
• Feedback. Messages you send through the feedback box, with the page you sent them from.
• Technical data. IP address, browser and device type, and request logs, used for security, rate limiting and troubleshooting.
• Analytics (only with your consent). Pages viewed, clicks, performance and errors, and session replays with all text and inputs masked. If you're signed in, analytics are linked to your account (ID, name, email, certification and experience). See the cookie policy.

Why we use it (lawful bases)

• To provide the service you asked for (contract). Your account, personalised scores for your gliders and limits, alerts, logbook, trips, messages, Goose, and the Telegram bot.
• Legitimate interests. Keeping the service secure and working (logs, rate limiting, abuse prevention and moderation), fixing faults, improving forecasts and scoring, and counting feature usage on our own servers against a pseudonymous ID. We weigh these against your interests and you can object at any time.
• Consent. Analytics cookies and session replay, device location, Live sharing, and proactive Goose messages on Telegram. Withdrawing consent doesn't affect processing that already happened.
• Legal obligation. Responding to lawful requests and keeping records the law requires.

We don't sell personal data, show advertising, or make decisions about you that have legal or similarly significant effects by automated means alone. Site scores are automated, but they are planning suggestions for you, not decisions about you.

What other pilots can see

• If you make your profile findable, your name, photo, bio, certification and pilot ID appear in pilot search, and your name shows on the reviews, photos, site reports and site edits you post.
• If your profile is private (the default for new accounts), you don't appear in pilot search, your profile page isn't shown to others, and your reviews, photos, site reports and site edits are shown without your name. Change it any time in Profile → Privacy & legal.
• Things you share by choice (public trips, flights you mark as community-visible, and community posts) are shown with your name whichever you pick.
• Live sharing is off by default. You choose friends only, public, or anonymous (counted, not named). Check-ins expire after 2 hours.
• Friends and trip members see what you share in those spaces, such as messages, availability and ride offers.

The Live layer also shows aircraft broadcast on the Open Glider Network and PureTrack. We honour the OGN device database: devices marked no-track are hidden, and devices marked not-identified are shown anonymously.

Goose and AI

Goose is an AI assistant. To answer you, it sends your message and relevant context (your location or bases, profile, gear, limits, memories and the forecast) to a large language model. Today that runs on Cloudflare Workers AI. If it is unavailable we may route to OpenRouter or Anthropic instead. Voice notes are transcribed with Cloudflare Workers AI. We don't use your conversations to train AI models.

We keep a record of each Goose conversation turn for 180 days, so we can investigate problems and improve answers. You can view and delete Goose's memories in your profile. Please don't share health, financial or other sensitive information with Goose.

Goose on Telegram

If you use Goose through Telegram, we receive your Telegram user ID, username, display name and language, the messages, voice notes and locations you send the bot, and the name of any group you add it to. We keep the conversation and your latest shared location so Goose can remember context, until you send /forget. /forget deletes Goose's memories and conversation records and unlinks Telegram from your account; for a Telegram-only profile it deletes the profile too. Telegram's own privacy policy covers how Telegram handles your messages.

Who we share it with

These providers process data on our behalf under contract, only for the purposes above:

• Cloudflare hosts the whole service (servers, database, file storage, caching, logs) and runs Goose's AI models.
• Clerk provides sign-in and account security.
• PostHog (EU hosting) runs product analytics, error reporting and session replay. Browser analytics run only with your consent, and are routed through our own domain.
• OpenRouter and Anthropic are fallback AI model providers for Goose.
• Telegram delivers Goose messages if you use the Telegram bot.
• Weather, mapping and routing services (Open-Meteo, Windy, OpenStreetMap Nominatim, OSRM, wind-station networks and webcam providers) receive coordinates from our servers to fetch forecasts, place names, drive times, live wind and webcams. They don't receive your name or account details.
• Services your browser loads directly see your IP address: map tiles (OpenFreeMap, OpenTopoMap, Esri, AWS, OpenStreetMap), rain radar (RainViewer), fonts (Google Fonts) and Clerk's sign-in scripts.
• Linear receives feedback you send when we turn it into a work item.

We may also disclose data if the law requires it, to protect people's safety, or as part of a sale or reorganisation of the service (in which case this policy continues to apply).

International transfers

Cloudflare serves requests from the data centre nearest to you, and some providers (Clerk, OpenRouter, Anthropic) are based in the United States. Where data leaves the UK or EEA, we rely on adequacy regulations (including the UK–US data bridge) or the UK International Data Transfer Addendum and EU Standard Contractual Clauses.

How long we keep it

• Account, profile, logbook, gear, trips and messages: while your account is open. When you ask us to close it, we delete it within 30 days, apart from anything we must keep by law.
• Goose conversation records: 180 days.
• Goose memories: until you delete them, /forget, or close your account.
• Live positions: 2 hours for check-ins, 90 seconds for GPS positions.
• Content you published: until you delete it or close your account. Site information you contributed may be kept without your name where other pilots rely on it.
• Server logs and rate-limit records: a short period, typically days, unless needed to investigate abuse.
• Analytics: up to the retention period set in PostHog (no longer than 12 months for session replays).

Your rights and choices

You can ask us to access, correct, delete or export your personal data, to restrict or object to how we use it, and to withdraw consent at any time. Email privacy@ficklesports.com from the address on your account and we will respond within one month. Self-service account deletion and export aren't in the app yet, so for now please ask by email.

• In the app: edit or delete profile details, gear, logbook entries, favourites, alerts, photos, friends and Goose memories. Profile → Privacy & legal controls analytics.
• Location: deny or revoke location permission in your browser at any time.
• Telegram: send /forget to the bot.
• Complaints: you can complain to the UK Information Commissioner's Office (ico.org.uk) or your local data protection authority. We'd appreciate the chance to put things right first.

If you live somewhere with other privacy laws (for example California), you have the rights those laws give you, and you can use the same address. We don't sell or "share" personal information for cross-context advertising.

Security

Data is encrypted in transit, access is restricted to the people who run the service, and sign-in is handled by a dedicated provider, so we never see your password. No system is perfectly secure. If we become aware of a breach that affects you, we'll tell you and the regulator as the law requires.

Children

You must be at least 16 to create an account. Fickle Sports isn't directed at children. If you believe a child has given us personal data, contact us and we'll delete it.

Changes to this policy

We'll update this page when what we collect or how we use it changes, and change the date at the top. For significant changes we'll tell you in the app before they take effect.