Privacy policy
Which data Tailkeeper processes on the website and in the app, what for and for how long.
Controller
The full details follow before the launch. Until then you reach us by mail.
The essentials first
This policy covers the website tailkeeper.eu (also when you arrive through tailkeeper.de) and the application Tailkeeper in the browser, on the phone and as Windows app. Everything runs on our own servers in Germany. We show no advertising, use no tracking and no analytics, and embed no content of other providers; we even serve the fonts ourselves.
Visiting the website
When you open a page, our server processes the data your browser sends along: IP address, time, requested address, status code, browser identification and the page you came from. We need them to deliver the pages and to fend off attacks (Art. 6(1)(f) GDPR).
The full IP address stays in the log file from which we block attacking addresses for at most 7 days. Our central logs hold it only shortened (IPv4 to the first three parts, IPv6 to the first 48 bits) and delete it after 14 days.
The website sets no cookies, stores nothing in your browser and contains no scripts. The home page picks the language from the setting of your browser; nothing is stored for that.
Contact by mail
When you write to us, we process your address and your message to answer it (Art. 6(1)(b) or (f) GDPR). We delete them once the matter is settled and no duty to keep them applies, at the latest 24 months later.
Your account in Tailkeeper
For your account we process your mail address, your name, your password (only as a hash, never in plain text), language, formats and settings, an optional profile picture that only your own owner group sees, and the methods of the second step of your sign-in. The basis is the contract on the use of Tailkeeper (Art. 6(1)(b) GDPR).
For signing in, the app sets a cookie for your session, which it needs technically, and remembers trusted devices. The mail with the code of a sign-in names the device, the browser and the approximate location. Our server finds the location itself in a file of DB-IP (IP Geolocation by DB-IP); your address goes to no one for this.
We check a new password against known data breaches with the service “Pwned Passwords” of Have I Been Pwned. Only the first five characters of a hash leave the server, never the password.
Sign-ins, changes of the mail address and other security-relevant steps stay in the security log of your account for 13 months.
Data of your owner group
Flights, bookings, owners, shares, reservations, receipts and documents belong to the owner group. The group is responsible for them; Tailkeeper processes them on its behalf (Art. 28 GDPR). We check uploaded files for viruses on our server and store each file encrypted.
External people such as flight schools, charterers or guests see only the aircraft the group shares with them. Whoever uses a charter link without an account gives a name and a mail address; we delete both 12 months after the link ends. Only the name of the pilot stays with the flight, because the invoice needs it.
Mails
Mails of Tailkeeper go out through our own mail server. We delete sending orders 30 days after delivery and the recipient address in the sending log after 90 days.
Deletion
- Account: You delete it yourself under “My account”. It is locked at once; for 30 days you can take that back, after that we delete it in every service. Your name in flights, bookings and statements of a group stays as part of its books.
- Former owners: The accountant can anonymise former owners. The name is replaced, the figures of the statements stay the same.
- Owner group: The accountant deletes it with the same grace period of 30 days.
- Backups: What was deleted disappears from the backups too after 12 months at the latest.
Access and export
Under “My account”, “My data” gives you all data of your account as a file at any time (Art. 15 and 20 GDPR). The group exports its aircraft in full as an encrypted ZIP file; it opens with 7-Zip, WinRAR, Keka or the Finder.
Who processes data for us
Two providers process data on our behalf. We have a data processing agreement with both, and no data leaves the European Union.
- Strato AG, Berlin: servers and data centre in Germany.
- Hetzner Online GmbH, Gunzenhausen: storage for our backups in Nuremberg. The backups are encrypted before they leave our server; Hetzner cannot read them.
Your rights
You have the right of access, rectification, erasure, restriction of processing and data portability (Art. 15 to 20 GDPR) and can object to processing based on legitimate interest (Art. 21 GDPR). Write to support@tailkeeper.eu for this.
You can also complain to a data protection supervisory authority (Art. 77 GDPR), for example the one where you live.
Last updated: 23 October 2026