1. Introduction

This Privacy Policy describes how [LEGAL REVIEW: Replace with legal entity name] ("the Company", "we", "us") collects, uses, and protects your information when you use AviationChat ("the Service").

AviationChat is an AI-powered ground school oral preparation tool — NOT flight instruction or operational advice. See our Terms of Service for the full disclaimer.

2. Information We Collect

2.1 Account Information

• Email address
• Display name
• Authentication provider (Google, Apple, or email/password)
• Certification goals and experience level

2.2 Learning Data

• Chat transcripts — text conversations with AI agents (Capt. Lindbergh, Mrs. Coleman, etc.)
• Voice transcripts — voice sessions with AI instructors (Capt. Sully, Igor DPE)
• Learning telemetry — mastery scores per ACS task, quiz results, study time, strategy effectiveness, lesson completion status
• Session logs — timestamps, session duration, performance grades

2.3 Technical Data

• Browser type and version
• Device type (desktop, mobile, tablet)
• Error logs and performance metrics
• Push notification subscription tokens (if opted in)

3. How We Use Your Data

• Personalized tutoring — adapting instruction to your knowledge gaps, learning style, and mastery level
• Progress tracking — maintaining your mastery map and study queue across sessions
• Service improvement — analyzing aggregate usage patterns to improve AI agent quality, curriculum coverage, and teaching strategies
• Communication — sending push notifications about study reminders (only if you opt in)

4. Data Licensing

By using the Service, you consent to the use of your anonymized and aggregated learning data for educational research and to improve the Service. Individual transcripts and personal data are never sold or shared in identifiable form without your explicit consent.

[LEGAL REVIEW: Confirm data licensing scope aligns with Tier-3 ambitions. Clarify anonymization standards (k-anonymity, differential privacy, etc.). Define whether "aggregated" means cohort-level or individual-record-level with identifiers stripped.]

5. Third-Party Services

We use the following third-party services to operate AviationChat:

• Google Firebase — authentication, database (Firestore), cloud storage, hosting
• Google Cloud Platform — compute (Cloud Run), AI models (Vertex AI / Gemini), search (Vertex AI Search)
• Sentry — error tracking and performance monitoring

These services have their own privacy policies. We encourage you to review them. We do not sell your data to any third party.

6. Data Retention & Deletion

We retain your data for as long as your account is active. You may request deletion of your data at any time by contacting us at [LEGAL REVIEW: Provide contact email for deletion requests].

Upon receiving a verified deletion request, we will delete your personal data within 30 days. Anonymized aggregate data that has already been incorporated into research or model training may be retained.

[LEGAL REVIEW: Confirm 30-day deletion timeline complies with applicable regulations. Address GDPR right-to-erasure if applicable. Clarify backup retention (currently 7-day PITR via Story 11.8).]

7. Minimum Age

AviationChat is intended for users who are at least 16 years of age. We do not knowingly collect personal information from anyone under 16. If we learn that we have collected data from a user under 16, we will promptly delete that information.

[LEGAL REVIEW: Confirm minimum age of 16 is sufficient. Verify COPPA compliance (applies to under 13). Consider whether state-specific laws require parental consent for users aged 13–17.]

8. Security

We implement industry-standard security measures including encrypted connections (HTTPS/TLS), Firebase Authentication, rate limiting, and Firestore security rules to protect your data. However, no method of electronic storage is 100% secure.

9. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data
• Object to or restrict processing of your data
• Data portability (receive your data in a structured format)

[LEGAL REVIEW: Confirm applicable privacy frameworks (CCPA, GDPR if EU users, etc.) and ensure all required rights are listed.]

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the version number and "last updated" date. If you have an existing account, you will be asked to review and accept the updated Policy before continuing to use the Service.

11. Contact

For privacy-related questions or data requests, contact us at: [LEGAL REVIEW: Provide privacy contact email or address]