Privacy Policy
Last updated: 2026-10-11
1. Data controller
Naka-Tek (SAS, SIREN 848 613 139, 128 rue La Boétie, 75008 Paris, France) is the data controller for personal data processed through the GhostTrace App and the website ghosttracefpv.com. For any privacy-related question, contact privacy@ghosttracefpv.com or contact@ghosttracefpv.com.
2. Local-first by design
GhostTrace is built local-first. Telemetry, blackbox imports, drone configurations and pilot statistics are stored on your device. In guest mode (no account), your flights stay on your phone. Only the position and the date of a flight are sent to the weather, place-name and terrain services (see section 6).
3. Categories of data we process
When you create an account: email address, password (hashed by our auth provider), Supabase user identifier. When you use the App: drone configurations (name, frame type, motor and battery specs), flight sessions (GPS coordinates, telemetry samples, timestamps), pilot statistics (total flight time, distance). For the lost-drone finder: last known GPS position of your drone, real-time location of your phone (only while the screen is open). Crash reports: stack traces and basic device info if the App crashes.
4. Legal basis (GDPR Art. 6)
Account, authentication and cloud sync: performance of the contract between you and Naka-Tek (Art. 6.1.b). Crash reports: legitimate interest in maintaining a working application (Art. 6.1.f). Product analytics: legitimate interest in understanding usage to improve the App (Art. 6.1.f) — collected with pseudonymous identifiers, no advertising. Marketing: not applicable, we do not do marketing.
5. Sub-processors
We rely on the following sub-processors: Supabase (PostgreSQL database, authentication, file storage — EU region). Amplitude (product analytics for the App and the website — EU data residency, Frankfurt). Anthropic (writes the recap of a flight from its figures and its position). Firebase Crashlytics and Firebase Cloud Messaging by Google (crash reports, notifications). Netlify (hosting of the website and the web app). Open-Meteo, Nominatim (OpenStreetMap Foundation) and OpenTopoData (the weather, the spot name and the terrain altitude of a flight). The list of sub-processors may be updated; the "Last updated" date will be revised when it is.
6. Data location
Your account, drone and flight data is stored in the European Union (Supabase). Some services process it occasionally outside the EU: Anthropic, to write the recap of a flight; Google, for crash reports and notifications — under the EU-US Data Privacy Framework; Netlify, which hosts the website and sees visitors' IP addresses. To find the weather, the name of the spot and the height of the ground, the App sends the position and the date of the flight to Open-Meteo, Nominatim and OpenTopoData. It does so in guest mode too. These services get neither your name nor your email address. Analytics events are routed to Amplitude's EU cluster (Frankfurt).
7. Retention
Your data is kept as long as your account exists. When you delete your account in the App (profile icon → Account → Delete Account), it is erased from our database right away. A copy may stay for a while in our host's backups and in our providers' logs. We never bring deleted data back. Amplitude and Google keep the statistics and crash reports under their own rules. The data on your phone stays until you delete your account or the App.
8. Cookies & web tracking
The App itself does not use cookies. The website ghosttracefpv.com uses a strictly-necessary cookie to remember your cookie consent, and a functional cookie to remember your language preference. If, and only if, you accept, the website also uses Amplitude — the same EU-hosted analytics as the App — to count page views and to measure how the in-browser demo is used. It then sets an identifier cookie on ghosttracefpv.com and its subdomains, so that a visit continuing into the pilot app at app.ghosttracefpv.com is recognised as the same visit rather than counted twice. If you decline, no analytics cookie is set and no event is sent: there is no reduced or anonymous fallback. We do not run advertising, and we do not track you across other websites.
9. Your rights (GDPR Art. 15-22)
You have the right to access, rectify, erase, restrict the processing of, port and object to the processing of your personal data. You can delete your account directly from the App (profile icon → Account → Delete Account). For any other request, write to privacy@ghosttracefpv.com — we respond within 30 days. You also have the right to lodge a complaint with the French data-protection authority (CNIL — cnil.fr) or any other competent EU authority.
10. Children
The App is not directed to children under 16. We do not knowingly collect personal data from children. If you believe a child has shared personal data with us, contact privacy@ghosttracefpv.com and we will delete it.
11. Security
Data in transit is protected by TLS. Data at rest in Supabase is encrypted by the platform. Passwords are hashed with bcrypt by the auth provider. Access to production infrastructure is limited to Naka-Tek staff and uses multi-factor authentication. In the event of a personal data breach likely to result in a high risk to your rights, we will notify you and the CNIL within 72 hours, in line with GDPR Art. 33-34.
12. Changes to this policy
We may update this policy from time to time. Material changes will be announced in-app and the "Last updated" date will be revised.
13. Contact
For any privacy-related question or to exercise your rights: privacy@ghosttracefpv.com or contact@ghosttracefpv.com.