VATFLOW Privacy & Data Handling Policy

TMU management for VATSIM · Personal, non-commercial project

Last updated: 8 July 2026

VATFLOW is a personal, non-commercial hobby project built for use on the VATSIM network. It is not an official VATSIM product and is not endorsed by or affiliated with VATSIM, VATUSA, or any Air Route Traffic Control Center, vACC, or division. It is provided as-is, for the personal use of the author and controllers who choose to use it.

Summary

VATFLOW is designed to store as little personal data as possible. It does not operate a user database. When you sign in with VATSIM Connect, VATFLOW confirms your controller identity in the moment and issues a short-lived session token that lives only in your own web browser. VATFLOW does not sell, rent, share, or trade any personal information, and has no advertising.

What data VATFLOW receives

Signing in is handled entirely by VATSIM Connect (auth.vatsim.net). VATFLOW never sees or handles your VATSIM password. After you authorize the sign-in, VATSIM provides VATFLOW with a limited set of details from your VATSIM profile:

Your VATSIM CID (member ID)
Your name as held by VATSIM
Your controller rating and related network details

VATFLOW requests only the minimum permissions ("scopes") needed to verify that you are a VATSIM controller. It does not request your email address unless explicitly stated at the time of sign-in.

Separately, VATFLOW reads the public VATSIM data feed (data.vatsim.net) — the same live network data anyone can access — to display aircraft, flight plans, and online positions. This is public network activity, not private account data, and is used only to render the tools.

How that data is used

The details from VATSIM Connect are used for one purpose: to confirm, at sign-in, that you are a VATSIM controller and to establish your access level within VATFLOW. Your CID and rating may be included inside the session token described below so the tools know who you are during your session.

VATFLOW does not use this data for profiling, analytics, marketing, or any secondary purpose.

What is stored, and where

VATFLOW is built to avoid keeping a server-side record of you:

No user database. VATFLOW does not maintain a stored list of members, logins, or profiles. The information VATSIM returns at sign-in is used to verify you and is then discarded on the server side; it is not written to any database.
Session token (in your browser). After you are verified, VATFLOW issues a short-lived, digitally signed session token that is stored only in your own browser (local storage). This token contains your CID and rating so the tools can recognize you during your session. It expires automatically after a limited time, after which you sign in again. It is not shared with third parties. Clearing your browser's site data removes it.
Tool settings (in your browser). Preferences and configurations you create — such as FCA definitions, runway configurations, and view settings — are stored locally in your browser and, where a page offers live sharing, in that page's shared data store so other controllers on the same tool can see the same traffic picture. These settings are operational data, not personal profile data.
Sign-in secrets. VATFLOW's backend holds only the credentials needed to talk to VATSIM Connect (an application secret and a token-signing key). These are configuration secrets, not information about you.

Third-party services & transient logs

VATFLOW runs on standard web hosting and a lightweight serverless backend (for example, GitHub Pages and Cloudflare). Like virtually all internet services, these providers may automatically keep short-term technical request logs (such as IP addresses and timestamps) for security and abuse prevention. VATFLOW does not control the retention of these provider logs and does not use them to build any profile of you. VATFLOW also contacts VATSIM services and publicly available aviation data sources (for example, weather and airport data) to function.

Data sharing

VATFLOW does not sell, rent, or share your personal data with anyone. The only transfers of your information are: (1) between you and VATSIM Connect during sign-in, which VATSIM governs under its own privacy policy, and (2) within your own browser session as described above.

Your choices

You can decline the VATSIM Connect authorization screen and simply not sign in.
You can sign out or clear your browser's site data at any time to remove your session token and local settings.
You can revoke VATFLOW's access to your VATSIM account at any time from your VATSIM Connect account settings at auth.vatsim.net.

Children

VATFLOW is a tool for VATSIM network members and is not directed at children.

Changes to this policy

This policy may be updated as VATFLOW evolves. The "last updated" date at the top reflects the current version. Continued use after a change constitutes acceptance of the updated policy.

Contact

Questions about this policy or your data can be directed to the project author via the project's repository or the contact method listed there: github.com/djbrombizzle/vatflow.

VATFLOW · Personal use only · Not affiliated with or endorsed by VATSIM, VATUSA, or any division or facility.