Privacy & Security

Sky Matrix is built to keep your data on your device and to use outside services only where a feature genuinely needs them. This page explains what stays local, what leaves the device, the third parties involved, and how to verify the Android app before installing it.

What stays on your device

Your flight data lives only in your browser/app storage on your device:

• The OFP text you load and every field you type (times, weights, crew, notes).
• Your PIN, stored only as a one-way hash, and your biometric enrolment, which stays in your device's secure hardware and is never sent to us.
• Documents you add to the in-app DOCS store and your saved announcements.

None of this is uploaded to any Sky Matrix server. Clearing the app's data removes it.

What leaves the device, and why

A few features need the internet and send the minimum data required:

• Licensing & trials, your Device ID and email are sent to our licensing service to issue or validate an access code.
• AI OFP reading & announcement fill, when you tap these, the relevant OFP text or announcement template is sent to our service to be processed and returned. It is not used to build a public profile of you.
• Aircraft, weather & NOTAM lookups, a flight number/registration or airport code is sent to the relevant data provider to fetch results.
• Payments, handled entirely on the checkout provider's site; we never see or store your card details.

Third-party services

Service	Purpose	Data shared
Cloudflare (Workers)	Licensing, trials, and the AI/data endpoints	Device ID, email, OFP/announcement text
Anthropic (Claude)	AI OFP reading and announcement fill	OFP text / template text you submit
Flightradar24	Aircraft type and route lookup	Flight number or registration
Lemon Squeezy	Checkout & billing (merchant of record)	Your payment & contact details (with them, not us)
Cloudflare (Workers)	Anonymous usage milestones	Device ID + a step name (app opened / OFP loaded). No OFP content or route.
Resend	Sending your access-code emails	Your email address
Cloudflare (Workers)	Hosting the app and website	Standard web request logs

Each provider processes data under its own privacy policy. We share only what the feature you invoked requires. Anonymous usage milestones — so we can see where people get stuck, the app records that a step happened (app opened, OFP loaded). Only your Device ID and the step name are sent — never OFP content, route, times or any flight data.

Security model

• Licences are protected with an ECDSA P-256 digital signature, only our server holds the private key, so codes can't be forged, and each code is bound to a single device (a subscription covers two devices, so you hold one code per device).
• Your PIN is stored as a salted one-way hash; biometric unlock uses the platform authenticator (WebAuthn) and never exposes your fingerprint/face to the app.
• Our Android apps are signed with our own private release key, Android verifies that signature on install and will only accept future updates signed with the same key.
• The app is served only over HTTPS. Sensitive data is never placed in URLs.
• Honest caveat: any client-side gate deters casual access but is not a guarantee against a determined attacker. Use a strong PIN and keep your device secured.

Android APKs, verify before you install

If you sideload one of our Android apps, confirm the file is authentic by checking its SHA-256 checksum against the matching value below before installing.

To check a file, on Windows run certutil -hashfile <filename> SHA256, or on macOS/Linux shasum -a 256 <filename>. The output must match the value above exactly. These checksums are for the current published builds; each one changes whenever that app is rebuilt.

Only install an APK obtained from our official download or checkout link. Because these apps are sideloaded, Android will warn about "unknown sources", that is expected; the checksums above are how you confirm the file hasn't been tampered with.

Your choices

You can stop all outbound data by simply not using the online features, the core briefing works offline. To delete your data, clear the app's storage on your device. For a licence transfer or account/data request, email admin@skymatrix.biz.

Contact

Questions about privacy or security: support@skymatrix.biz.