Racing Eagles LLC

Privacy

This page describes how Racing Eagles LLC handles information on its website, racingeagles.com, and in the Racing Eagles apps for iPhone and Android and the service behind them.

The short version

• You can use the apps without an account. Your flights, documents and settings then stay on your phone, and our service holds no copy of them. Your phone's own backup may include them (see "Phone backups").
• If you sign in, your flight record and profile are saved to your account, so they survive a lost phone and appear on your other phones.
• Location readings, calendar events, and the documents, photos, passports and numbers you keep in TravelKit stay on your phone. What becomes part of your flight record is the flight itself — such as its airports and times — whether your phone recognised it or you added it.
• Connecting a mailbox is optional. If you connect one, our service reads your new mail to find bookings, keeps the travel details it finds, and does not store the emails.
• We do not sell your information, use it for advertising, or track you across other companies' apps or websites.

Part 1 — This website

What this website collects

Nothing you type, because there is nothing here to type into. This website has no accounts, no sign-in, no forms, no newsletter and no shopping. It does not ask you for your name, your email address or any other personal detail.

Analytics, advertising and tracking

This website runs no analytics, no advertising and no third-party tracking scripts. It loads no fonts, scripts, images or other resources from other companies' servers: every file the page needs is served from this domain. It sets no cookies of its own.

Hosting and server logs

The website is served through Cloudflare, our hosting and network provider. As with any website, our provider processes ordinary technical request information — such as the IP address the request came from, the page requested, the time, and the browser's user-agent string — to serve pages, keep the site available and protect it from abuse. Cloudflare may also set its own security cookie for that purpose.

If you email us

If you write to contact@racingeagles.com, we receive your email address, your message and anything you choose to include in it. We use that only to reply to you and to keep a record of the correspondence. We do not sell it, and we do not use it for advertising.

Part 2 — The Racing Eagles apps

The Racing Eagles apps for iPhone and Android keep your flight record: the flights you have taken, the ones you have booked, and the travel documents you choose to keep. The apps are in development. Test versions reach testers through Apple's TestFlight and through Google Play's testing; Firebase App Distribution, Google's testing service, can also deliver Android test versions.

What leaves your phone before you sign in or choose anything

The app checks that it is a genuine copy of Racing Eagles by asking Google's Firebase App Check, which uses Apple's DeviceCheck on iPhone and Google Play Integrity on Android (some Android test versions use a test token instead). The iPhone app does this when it starts, before you sign in or switch anything on. The Android app does it no later than when it first contacts our service. These services may exchange more than one request to complete a check, and the check is repeated from time to time. Like any request on the internet, each carries your phone's IP address and basic technical details, such as software versions. They contain nothing from your flights, documents, calendar, location or email, and they are not linked to an account.

Crash reporting stays off until you switch Diagnostic sharing on. The apps contain no advertising software, and no analytics service such as Google Analytics.

On Android, when the app reads a document or an image — for example when you scan a boarding pass, import a photo, or save a document to TravelKit — the text and barcodes are read on your phone by Google's ML Kit. Google's documentation says ML Kit sends Google statistics about how the recognition ran — for example the phone model, the app's version, an identifier for the installation and how long it took. It does not send the image or its text. This can happen before you sign in.

Using the app without an account

You can use the app without signing in. Your flight record, your TravelKit and your settings then stay on your phone, and nothing from them is sent to us.

If you sign in later, the flights you added while signed out are saved to your account at that moment, and so is your profile if your account does not have one yet.

Documents, passports and numbers you saved in TravelKit while signed out stay on your phone and are never sent to us. When you sign in, the app asks whether to add them to your TravelKit on this phone. Nothing is uploaded either way, and "Not now" leaves them where they are.

While you are signed out, our service holds no copy of your flights. They are on your phone, and in your phone's own backup where your phone makes one (see "Phone backups"). Remove data from this device (under Privacy & Data) deletes them from the phone.

Your account

On iPhone you can sign in with your email address and a password, with Google, or with Apple. On Android you can sign in with your email address and a password, or with Google; Sign in with Apple is not yet available on Android.

What Google's Firebase Authentication keeps for us:

• your email address;
• the name your Google or Apple account shares with us;
• the identifier Google or Apple gives your account;
• when you created the account and last signed in;
• for an email account, your password in scrambled (hashed) form, which we cannot read.

If you use Sign in with Apple and choose to hide your email, Apple gives us a relay address instead of your own. For security, Firebase Authentication also records the IP address you sign in from, and Google keeps it for a few weeks.

Your phones. Each phone you sign in on creates its own device key. We keep the public half of that key, the kind of phone (iPhone or Android) and when it was added. This lets your account recognise its phones and check that a flight came from one of them.

Your profile. Your profile is saved to your account and kept in step across your phones. It can hold the name you like to be called, your full name, your home airport, your region and a preferred airline or frequent-flyer programme. Every field is optional.

Your flight record

While you are signed in, your flights are saved to your account. They are kept if you lose your phone, and they appear on your other phones.

What is saved for each flight:

• the airline and flight number;
• the airports;
• the dates and times;
• how the flight was added: by hand, from a file, from a photo, from a calendar, from your mailbox, or recognised by your phone;
• whether it was a plan, whether it was cancelled, and whether you confirmed it;
• which flights you said are the same flight, or belong to separate trips.

When you add flights from a file, a photo or a screenshot, the app reads it on your phone. On Android you can also scan a boarding pass with the camera or add one from a pass file. The flights you keep are saved like any other; the file or image itself is not uploaded. (TravelKit is different: see "TravelKit".)

We also keep the changes you make, such as edits, corrections and flights you remove, so that all your phones agree. For a flight your phone recognised, we also keep the distance your phone measured, the official distance, and a signature your phone made for that flight.

Location and flight recognition

Recognising your flights automatically is optional and off until you set it up. With your permission, including location access while the app is closed, the app watches your phone's location in a low-power way. It uses that to notice when you are at an airport and when you have flown.

The location readings themselves stay on your phone. They are not sent to us.

What is saved to your record is what the phone concluded:

• the airports;
• the times;
• the distance flown;
• where it applies, the airport where your phone was later seen, and when.

On Android, the app asks Google Play services on your phone to alert it when you reach an airport or leave your usual area. This happens on the phone. On Android, while a flight is being recognised the app shows a notification, because Android requires one whenever an app uses location in the background for a while.

Turning recognition off stops it. What it already recorded stays. Remove data from this device deletes the phone's copy. Flights already saved to your account stay there until you delete them or your account.

Calendars

Reading calendars is optional. If you choose calendars, the app reads events on your phone from the calendars you selected, and from no others, to find flights. If you switch on hotel and car bookings in TravelKit, it also looks for hotel stays and car rentals.

The calendar events themselves are not sent to us.

• Flights found this way are added to your record, and saved to your account if you are signed in.
• Hotel stays and car rentals found this way stay on your phone, in TravelKit.

The app only reads. It never creates, changes or deletes an event.

TravelKit

Original documents and photos you save in TravelKit are not uploaded to Racing Eagles, and neither are the details the app reads from them, with one exception, which you choose:

• On Android, when you save a document such as a boarding pass, you can add its flight to your record, or mark a booked flight as flown. The flight details you confirm (the airline and flight number, the airports and the dates) then become part of your flight record, noted as coming from a document. While you are signed in, your flight record is saved to your account.
• On iPhone, TravelKit does not read documents, and saving one never creates or changes a flight.

Passports and numbers. A passport you keep in TravelKit — its number, issuing country, dates and any field you add — and the numbers you save there, such as a Known Traveler, redress or membership number, stay on your phone. They are not uploaded to Racing Eagles, not included in your phone's backup, not part of an export of your record, and never in a diagnostic report. When you copy one of their values, on iPhone the copy is not shared with your other Apple devices and is cleared after two minutes; on Android it is marked as sensitive, so Android 13 and later hide it in the copy preview.

Bookings from your mailbox. If you connect a mailbox and choose to have its hotel and car bookings in TravelKit, our service finds those bookings in your mail and sends their details to your phone: the company, the dates and the booking reference. The service keeps them for up to 7 days after they last change, and never more than 21 days, so that each of your phones can collect them. Email attachments are not delivered or kept.

What TravelKit's files and list are included in your phone's backup is described under "Phone backups".

Connecting a mailbox

Connecting a mailbox is optional. It is off unless you connect one yourself, and nothing in your email is read until you do. Its purpose is narrow: to find the flights you have booked, and your hotel and car bookings if you choose, so that you do not have to type them in.

Reading is done by our service, not by the app on your phone. It continues while the app is closed, about every 15 minutes, until you disconnect.

What the app asks Google and Microsoft for.

• Gmail: gmail.readonly (read-only access to your Gmail; no permission to send, change or delete mail) and openid (a stable identifier for the Google account, so the same mailbox is recognised when you reconnect it).
• Outlook and Microsoft mailboxes: Mail.Read (read-only access to your mail), User.Read (your account's basic profile, of which we use only its identifier) and offline_access (so the service can keep reading while you are not using the app).

What is read.

• Gmail, first connection: the service searches your Gmail for messages that have a calendar attachment (an .ics file) or contain one of these travel phrases: booking reference, booking confirmation, record locator, e-ticket, eticket, electronic ticket, boarding pass, flight confirmation, trip confirmation, schedule change, flight change, itinerary, your reservation, your booking, confirmation number, confirmation code, reservation code, reservation number, booking details, ticket number, cancellation confirmation, "your flight has been" and "your flight was".
• Gmail, after that first search: the service reads each new message that arrives to decide whether it is a booking.
• Outlook: the service reads each new message in your Inbox and Archive folders the same way.
• Hotel and car bookings: if you switch these on, the service also searches the last 90 days of your mail for messages about hotels, car rentals, reservations, bookings, check-ins and confirmations.

A message that is not a booking is discarded as soon as it has been read. Nothing from it is kept.

What we keep:

• The travel details found. For a flight: the airline, the flight number, the airports, and the dates and times. For a hotel or car: the company, the dates and the booking reference. These become part of your record or your TravelKit.
• The identifier your mail provider gives your mailbox account — not your email address.
• The connection's credential (see below).
• Bookkeeping, so the same email is not applied twice and a booking we could not place can be shown to you as a question: a reference to each message that produced something; a one-way code made from each flight's booking reference, used only to recognise the same booking again (it is not anonymous: anyone who knows the reference could match it); and, for questions waiting for your answer, the details we found.

What we do not keep: the email itself — its text, its attachments, its subject and who sent it.

How the connection is protected. The refresh token your mail provider issues is encrypted with AES-256-GCM before it is stored, and it is never written to logs, analytics or diagnostics. Google user data is never sold, never used for advertising, and never used to train any machine-learning or AI model. It is not read by a person, except where you explicitly ask us for help with a specific problem, or where the law requires it.

Disconnecting a mailbox stops all reading, deletes the stored credential and asks Google to withdraw the authorisation. Microsoft gives an app no way to withdraw its own authorisation to an Outlook mailbox, so also remove Racing Eagles from the apps that have access to your Microsoft account. Flights that were already added stay in your record. The bookkeeping that goes with them stays until you delete your account: the message references, the travel details found, the one-way booking codes, and the questions, including ones you dismissed. Hotel and car bookings still waiting for your phones are deleted when you disconnect. You can also withdraw Gmail access at any time from your Google Account, at myaccount.google.com/permissions.

Google API Services User Data Policy. Racing Eagles' use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Identifying a flight

Identify detected flights is off until you turn it on, and it is available only while you are signed in. When it is on and your phone recognises a flight, our service asks a flight-data provider, AeroDataBox (reached through RapidAPI), which flights left your departure airport around the time your phone observed — and gives the recognised flight its airline and flight number when one flight matches. What is sent is the departure airport and a time window around the observed departure — not your name, email address, account identifier or booking reference. What the provider returns is deleted from our service and from your phone 7 days after we received it. If you picked your flight from the provider's choices, your record keeps that you confirmed it ("Confirmed by you"), not the provider's details; an airline or flight number you type yourself is never removed. Turning identification off (on Android: Flights › Add › Flight detection; on iPhone: Account › Automatic flight recognition) stops the lookups and deletes, at once, the provider's answers we hold for you.

Live flight updates

Live flight updates are off until you turn them on. You need to be signed in: the choice belongs to your account, so without an account nothing is ever checked. You choose once, after the app explains what happens, and the choice covers every flight you book. You can turn it off at any time under Privacy & Data.

While they are on, our service follows each booked flight on its travel day. It starts 24 hours before departure and checks more often as departure approaches, then while the flight is in the air. Each time it asks the same provider, AeroDataBox through RapidAPI, which flights leave your departure airport during a window of a few hours, and picks your flight from the answer on our own service. What is sent is your departure airport and a time window around your booked departure — not your name, email address, account identifier, flight number or booking reference. These are still details of your travel. If three answers in a row name no flight that matches yours, it stops asking until you change the booking.

The service stops checking a flight once a landing time or a confirmed cancellation is reported for it; otherwise it stops when the flight's travel window ends. A reported landing does not mark your flight as flown and does not add it to your record or your miles.

What the provider reports is deleted from our service 7 days after we received it. On your phone, a status is kept for the same 7 days, counted from when our service received it. When they end, the app stops showing the status and deletes it from its own storage, without needing our service or a network — at that moment if the app is running, otherwise as soon as it runs again.

The rest of what we hold about following a flight — its route, date and our notes on the checks — is deleted 7 days after the checking ends. Turning live updates off stops the checks and deletes, at once, everything our service holds about following your flights, and clears the copy on the phone you used. Another phone signed in to your account clears its copy the next time it gets an update from our service. A phone running the current version also clears it when its 7 days end, even offline.

We keep a record of your current choice — on or off, when you made it, which explanation you saw and in which app — until you delete your account.

Rankings (beta)

Rankings is optional and off until you join. When you join, other signed-in members can see in Rankings the name and mark you choose, your eligible miles and your number of eligible flights, and your home airport only if you also choose to show it. Your routes, your dates and your account details are not shown. Leaving Rankings removes your row at once.

Sharing your flights (Flight reports)

A Flight report is created only when you make one. When you open the preview, what you chose is sent to our service, so that the report you approve is exactly the one that is published. A preview you do not approve is deleted after 24 hours.

What it shows. Some parts are always included: the name the report shows (see below), the period it covers, when it was issued and when its link expires, and an integrity check — a signature and secure link that confirm the report has not changed since it was issued. The integrity check does not independently verify your flights. The rest is your choice: miles recorded; how many flights, airports, countries and airlines; a flight-by-flight history, in which each flight shows its date and route, and its airline and distance only if you include those; and source and confidence information. Anything you leave out is removed from every part of the report, not just hidden, although a reader may still infer some of it from what you include.

• iPhone: the report names you "Racing Eagles member".
• Android: the report shows the full name in your profile, or else the name you like to be called; with neither, "Racing Eagles member".

If you email a report to an airline from the app, the email is written and sent by your own mail app; we receive nothing about it.

Who can see it: anyone who has the link, until the date you chose (7, 30 or 90 days) or until you revoke it. After that, the link shows nothing.

What we keep afterwards: we keep a copy of what was shared until you delete your account.

Diagnostic sharing

Diagnostic sharing is off unless you switch it on, under Privacy & Data in the app.

While it is on, crash reports go to Google's Firebase Crashlytics: when the app crashes, freezes, or fails to save, open or sync something. A report describes the app and the phone — for example the app's version, which kind of task failed, the phone's model and operating-system version, and what the app was doing. It is tied to a random identifier for this installation of the app, not to your account. Google keeps crash reports for 90 days, then begins removing them from its live and backup systems.

Switching it off stops new reports and deletes the reports the app has not yet passed on for sending. A report already waiting in Google's upload queue at that moment may still be sent.

Notifications

The apps do not use push notifications, and they do not register your phone for them. On Android, the app shows notifications from the phone itself about flight recognition, and these can name an airport.

Service logs

When the app or a Flight report page talks to our service, Google Cloud records the request: the IP address it came from, the app or browser that sent it, the address requested and the time. Private Flight-report links are not recorded.

Our service also writes operational logs. These include your account's internal identifier, what the service did and, for security checks, a shortened form of the network address a request came from.

Request records and operational logs are kept for 30 days and then deleted. Records made before 27 September 2026 may also contain a Flight report's private link, or the routes and dates of flights; they are deleted by 27 October 2026.

Who else processes data, and where

• Google runs our service (Firebase and Google Cloud). Accounts and flight records are stored in the United States (Google's nam5 multi-region). Firebase Authentication processes data in the United States; Crashlytics may process data in other countries. Google processes this data on our behalf.
• Google (Google Workspace) hosts our email, including messages you send to contact@racingeagles.com.
• Apple and Google check that the app is genuine (DeviceCheck, Play Integrity), and handle Sign in with Apple and Sign in with Google when you use them.
• Google, on Android, receives ML Kit's statistics, described under "What leaves your phone before you sign in or choose anything".
• On Android, Firebase Authentication uses Google's reCAPTCHA to protect sign-in from abuse; it may read information about your device to do so.
• Google and Microsoft host your mailbox. When you connect one, our service reads it through their interfaces.
• AeroDataBox, through RapidAPI, answers flight-schedule questions when you turn on live flight updates or flight identification (see "Live flight updates" and "Identifying a flight"). It receives an airport code and a time window — no name, email address, account identifier or booking reference.
• Cloudflare serves this website.
• Apple (TestFlight) delivers iPhone test versions; Google Play distributes Android test versions, and Google (Firebase App Distribution) can also deliver them (see "While the apps are being tested").

We share your information only with the companies listed above, and only for the purposes described. Google, for Firebase, Google Cloud and Google Workspace, and Cloudflare process it on our behalf under data-processing terms that allow them to use it only to provide their services to us and require them to protect it with appropriate security measures. Apple, Google and Microsoft handle information under their own terms and privacy policies when you use their services — signing in, testing, downloading the app or a mailbox you connect — and Google does so for the ML Kit statistics and reCAPTCHA checks described above. AeroDataBox and RapidAPI receive from our service only an airport code and a time window — no name, email address, account identifier or booking reference.

We do not sell your information, we do not use it for advertising, and we do not track you across other companies' apps or websites.

The legal basis for using your information, and where it goes

If you live in the European Union or the United Kingdom, the law asks us to say why we may use your information:

Where it is processed. Racing Eagles LLC is in the United States, and our service stores accounts and flight records in the United States (Google's nam5). If you live in the European Union or the United Kingdom, your information is processed in the United States.

Phone backups

On iPhone, your phone's own backup (iCloud or your computer) includes what the app keeps on the phone: your flight record and settings, your profile, the airports your phone recognised, TravelKit's list of documents and their details, and items waiting to be added from the Share menu. The original TravelKit files, passports and saved numbers, and the live-status copies are left out. An iCloud backup is protected by your Apple account; a backup on your computer is protected as your computer protects it, and is encrypted only if you choose that. We have no access to either.

On Android, the app tells Android to leave all of its data out of Google's cloud backup and out of phone-to-phone transfer.

How long we keep things, and how to remove them

Remove data from this device (Privacy & Data) deletes from that phone your flights, TravelKit, recognition history, calendar selections, profile and settings. It leaves your account as it is. On iPhone it deletes the TravelKit documents, passports and numbers of whoever is using the app at that moment — the signed-in account's, or those saved while signed out. On Android it deletes every TravelKit document, passport and number on the phone.

Delete account and its data removes from our service your account and your record — flights, changes, profile, identified flights, your live-updates choice and any flight status, mailbox connections with their questions and bookings, Flight reports and your Rankings row. It also:

• asks Firebase Authentication to delete your sign-in identity. Firebase Authentication may take up to 180 days to remove it from its live and backup systems after we ask;
• disconnects any Gmail mailbox and asks Google to withdraw its authorisation;
• if you signed in with Apple, asks Apple to revoke the app's authorisation;
• once the service confirms, removes the app's data from that phone.

You can delete your account in the app, or by emailing contact@racingeagles.com. If an account created with Sign in with Apple is deleted by email, we cannot ask Apple to revoke the app's authorisation; you can remove Racing Eagles yourself in your Apple Account settings, under Sign in with Apple.

How long it takes. Deletion starts at once. A large record can take a few days to remove completely, and your sign-in identity is deleted once your record is gone. Deleting your account does not immediately remove your data from recovery copies that already exist; those copies are deleted as "Other copies" describes.

What remains after deletion. None of the following contains your name, your email address or your profile, and none is deleted later. The marker and the receipt are kept under the internal identifier your account had (a random code, not your sign-in identifier); the other records are no longer linked to your account.

If Apple cannot be reached when you delete an account created with Sign in with Apple, we keep the Apple authorisation, encrypted, and retry for up to 7 days (or 12 attempts). Then we discard the authorisation together with the sign-in identifier your account had.

Provider information. What AeroDataBox returns is deleted from our service 7 days after we received it. On your phone, a live status goes as "Live flight updates" describes, and an identified airline and flight number goes as "Identifying a flight" describes.

Other copies.

• Daily recovery copies. Once a day, our service saves a copy of the records it keeps for accounts to private storage in the United States, so that the service can be restored after a failure. A copy includes accounts and profiles, flight records with your changes and answers, your choices, device keys, Flight reports and their links, Rankings rows, and connected mailboxes with their bookkeeping (the mailbox credential stays encrypted). It excludes the email address you sign in with, your password, what AeroDataBox returned, live flight status, Flight reports that name an airline, and bookings waiting to be delivered to your phones.
• Recovery copies are scheduled for automatic deletion 35 days after they are created. Deletion is processed asynchronously, so removal may occur later. Deleting your account does not immediately remove your data from copies that already exist; it is removed when those copies are deleted. Copies made after you delete your account hold only what our database keeps after deletion (see "What remains after deletion" and "If Apple cannot be reached").
• We do not return recovered data to the live service unless account deletions and withdrawals of optional processing or sharing can be respected. If we cannot ensure this, recovery does not proceed.
• For one hour after a record changes or is deleted, its earlier version can still be read back from our database; after that it cannot. Google, which runs the database and the storage, may take longer to remove deleted data from its own storage systems.
• Request records and operational logs are deleted after 30 days.
• Crash reports follow "Diagnostic sharing", and sign-in information follows "Delete account and its data".
• Test services keep their own records (see "While the apps are being tested").

While the apps are being tested

TestFlight (iPhone). When you test through Apple's TestFlight, Apple shares with us how you joined (by email invitation or through a public link) and the status of your invitation; how many times you installed and opened the test version, and which version you have; your device model and a device identifier, your system version and your device language; and crash counts and crash logs. If we invited you by email, Apple also shares your name and that email address. If you joined through a public link, Apple does not show us your name or email address.

Feedback is voluntary. If you send feedback through TestFlight, we receive your comments and any screenshot you attach, together with technical details: the app version and how long it had been running, your device model, system version and processor type, battery level, carrier, time zone, network connection, free storage and screen resolution. If you joined through a public link, your feedback includes an email address only if you type one in. Apple's own settings and privacy policy govern what TestFlight collects; the app's Diagnostic sharing switch does not control it.

Google Play testing (Android). When you join a test through Google Play, you join with your Google account. If you join through our Google Group, the group's managers can see the address you joined with. Google tells us that you installed a test version and passes on the feedback you choose to send.

Firebase App Distribution (Android). When you test through Firebase App Distribution, Google holds for us the email address you were invited with, your name if you give one, and whether you accepted the invitation and downloaded a test version. Google keeps this until we ask for it to be deleted, and then removes it from its live and backup systems within 180 days.

Leaving a test, or being removed from one, is separate from deleting your Racing Eagles account, and deleting your account does not remove you from a test. We use this information only to run the test and fix problems.

Children

Racing Eagles is not intended for children under 13, and we do not knowingly collect their information. The app does not ask your age or check it. In the United Kingdom, 13 is the age from which a child can give their own consent to an online service offered directly to them; in the European Union that age is set by each country, between 13 and 16.

Your choices and rights

Wherever you live, you can ask us for a copy of your data, to correct it, to export it, or to delete it. You can withdraw any permission you gave: Diagnostic sharing, live flight updates, flight identification, a mailbox, calendars, flight recognition or Rankings. You can also object to how we use your data. Write to contact@racingeagles.com. If you live in the European Union or the United Kingdom, you can also complain to your data-protection authority. We do not sell or share personal information for advertising.

Changes

If the website starts doing something different — a contact form, say, or analytics — this page will be updated to say so before that change goes live. The same undertaking covers the apps: if what they ask for, keep or share changes, this page is updated before the change reaches you.

Effective date: 5 October 2026.

Questions

Privacy questions and requests: contact@racingeagles.com.

Racing Eagles LLC, a Washington limited liability company, is responsible for this website and for the Racing Eagles apps.