Last updated: 19 July 2026 · Version 2.1
SkyNexus Limited (Company Number 17114302) is the data controller responsible for your personal data. We are a private company registered in England and Wales at 38 Salisbury Road, Worthing, BN11 1RD.
We are registered with the Information Commissioner's Office (ICO) under registration reference ZC111428.
Our Data Protection Officer is Noel Doherty. If you have any questions about how we handle your data, you can contact us at privacy@skynexus.voyage.
This policy covers the SkyNexus iOS app and the SkyNexus website (including the waitlist). SkyNexus lets you reconstruct and keep your personal flight history — a private archive of the flights you have taken, built by scanning boarding passes or adding flights yourself.
We collect only what we need to give you your flight archive. We do not use your data to track you across other companies' apps or websites, we do not show third-party advertising networks your data, and we do not sell your data.
| Data | What it is | Why | Lawful basis |
|---|---|---|---|
| Name & email (Sign in with Apple) | Your name and email are provided by Apple when you first sign in. If you choose Apple's Hide My Email, we receive and use only the private relay address. Apple returns these to us once, at first sign-in only. | To create and secure your account and to contact you about your account. | Contract (GDPR Art 6(1)(b)) |
| Account identifier | A user ID that links your account to your saved flights. Sign in with Apple is the only sign-in method; there is no password. | To operate your account and associate your flight history with you. | Contract (GDPR Art 6(1)(b)) |
| Your flight history (the content you create) | The flights you add or scan, and the details shown on your cards — flight number, date, route (origin/destination), airline, aircraft type, and similar travel facts. | This is the product: your personal, private flight archive. | Contract (GDPR Art 6(1)(b)) |
| Boarding-pass scans (camera) | When you scan a boarding pass, the app reads the pass and stores the scan on your account — including the raw barcode and the details parsed from it. The raw barcode can contain personal data such as your name, booking reference (PNR), and sequence number. We retain this to build your flight archive and to recognise duplicate scans. We never display these sensitive fields on a flight card, and they are never included in anything you share or in any public link (see "Sharing a flight card"). All of it is deleted when you delete your account. | To read your flight details from the pass, build your archive, and recognise duplicates. | Contract (GDPR Art 6(1)(b)) |
| Usage data (product interaction) | A minimal signal recording how an app session began (for example, opening the app directly or following a shared-card link). This is not linked to advertising and does not identify you to third parties. | To understand how the app is used and improve it. | Legitimate interest (GDPR Art 6(1)(f)) |
No tracking. The app contains no third-party advertising, analytics, or crash-reporting SDKs. We do not use the Advertising Identifier (IDFA), we do not present the App Tracking Transparency prompt, and we do not collect your location. In App Store terms, your data is not used to track you.
If you choose to share a flight card, the shared version is deliberately stripped of anything that could identify you. A shared card carries only non-identifying travel facts — such as the flight number, date, route, airline, aircraft type, and card styling. It never includes your name, booking reference, seat, frequent-flyer number, passport or identity data, or the aircraft's registration. Milestone captions (for example "100th flight") never include your name.
If you choose to add your own words to a shared card (such as a caption) or set a display name, that text is content you are choosing to make visible to others, and it is governed by our Terms of Use. To help keep shared content safe we screen submitted text against a list of prohibited terms, and you can report anything abusive — see Support & Safety.
On our website we use Plausible Analytics to understand how visitors use the site. Plausible does not use cookies, does not collect personal data, and is hosted in the EU. No individual tracking occurs — we see only aggregate statistics such as total page views and referral sources.
If you join our pre-launch waitlist, we collect your email address (to notify you at launch), a record and timestamp of your consent, your IP address (as proof of consent, stored separately and used for no other purpose), and any UTM parameters from the link you followed (to understand which marketing channels work; these do not identify you personally). The lawful basis for the waitlist email is your consent (GDPR Art 6(1)(a)); the consent record, IP, and analytics rest on our legitimate interest in regulatory compliance and understanding our channels.
We share your data only with the service providers we need to run SkyNexus. We do not sell your data to anyone.
| Provider | Role | Data location |
|---|---|---|
| Apple | Sign in with Apple (authentication). Apple also processes any in-app purchase you make. | Per Apple's privacy policy |
| Supabase | Authentication and the database that stores your account and flight history | EU (Ireland) |
| Cloudflare | Website hosting, the shared-card service, DNS, and security; the waitlist database (D1) | Global CDN; waitlist database in EU |
| Resend | Sends the confirmation email when you join the waitlist | United States |
| Plausible Analytics | Cookieless website analytics (no personal data processed) | EU (Germany) |
We keep your core account and flight data in the EU (Ireland). Some of our service providers process data outside the UK and EEA — for example, Resend (United States) for the waitlist confirmation email. Where data is transferred outside the UK and EEA, it is protected by EU Standard Contractual Clauses (SCCs) and/or the UK International Data Transfer Agreement (IDTA), as required by UK GDPR and EU GDPR. Cloudflare also holds approved Binding Corporate Rules.
We keep your account and flight history for as long as your account exists. You can delete your account at any time from within the app (Settings → Delete account). Deletion is immediate and permanent: it removes your account and all associated flight records, boarding-pass data (including the raw barcode), and app events in a single cascade. We do not keep a shadow or "soft-deleted" copy; the only thing retained is an anonymous deletion record (a random identifier and a timestamp) that contains none of your personal data.
Our database backups are retained on a rolling basis for up to 7 days. When you delete your account, the live data is removed immediately, and any copies held in backups are no longer available once they age out of that 7-day window.
Waitlist email addresses are kept until the product launches plus 12 months, or until you withdraw consent, whichever comes first. Consent records are retained for 3 years after the email is deleted, as evidence of lawful consent.
Under UK GDPR and EU GDPR, you have the following rights over your personal data:
To exercise any of these rights, email privacy@skynexus.voyage. We will respond within one month.
SkyNexus is not directed to children under 13 and we do not knowingly collect their personal data. If you believe a child has provided us with personal data, contact us and we will delete it.
If you are unhappy with how we have handled your data, you have the right to lodge a complaint with a supervisory authority.
In the UK, this is the Information Commissioner's Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. Our ICO registration reference is ZC111428.
If you are in the EU, you may complain to the data protection authority in your country of residence.
We do not use your personal data for automated decision-making or profiling.
We will update this page if our data practices change. The "last updated" date at the top of this page will reflect the most recent revision.