Legal

Privacy Policy

Last updated: October 13, 2026

XC Fly ("we") is a flight-instrument app and social network for free-flight pilots — published on the app stores as "XC Fly — Voo Livre" — operated by DAC Sistemas (DAC Sistemas Ltda., Brazilian company registry CNPJ 24.594.223/0001-92), through the website xcfly.com.br, the web application and the mobile apps (Android and iOS). This policy describes how we collect, use, store and protect your personal data, in compliance with the Brazilian General Data Protection Law (LGPD — Law No. 13,709/2018).

By using XC Fly — whether through the website, mobile app, web application or any associated service — you agree to the terms of this policy.

1. Who we are

XC Fly is a flight-instrument, flight-logging and social-network app for free-flight pilots (paragliding, paramotor, hang gliding and ultralight), developed and operated by DAC Sistemas, headquartered in Brazil. We are the controller of your personal data under the LGPD.

  • Legal name: DAC Sistemas Ltda.
  • CNPJ: 24.594.223/0001-92
  • Platform: XC Fly — xcfly.com.br / app.xcfly.com.br / the "XC Fly — Voo Livre" app
  • Official channel (LGPD / privacy): contato@xcfly.com.br
  • User support: suporte@xcfly.com.br

2. Data we collect

2.1 Data you provide

  • Account: name, e-mail, password (stored with a secure hash) and photo (optional), via direct sign-up or Google/Apple login.
  • Profile: photo, bio, location (city/state/country), flying discipline, certification level, federation registration number (ABVL/CBVL, CABPP or international equivalents) and equipment used (wing, glider, motor).
  • Precise location (GPS): while you use the app, for the flight instruments, flight recording (IGC/GPX files) and, when you enable it, live tracking. On Android, recording uses a foreground service with a visible notification; collection only happens while the flight panel is in use.
  • Content you create: recorded or uploaded flights (IGC/GPX) and their metrics (altitude, speed, vario, distance), takeoff/landing site, pilot notes, photos, comments, waypoints, routes and messages in site chats.
  • Group XC flights: planned routes, selected waypoints, dates, and invitations sent and accepted between pilots.
  • Social interactions: comments, flight reactions (like, fire, respect), flying-site reviews and messages to other pilots.
  • Communications: when you contact us by e-mail or through the support form.

2.2 Data collected automatically

  • Usage data: pages visited, features used, session time and actions inside the platform — collected via Google Analytics 4 with anonymized IP (anonymize_ip).
  • Basic technical data: app version, platform, truncated IP address, device type, operating system, browser and preferred language — used for support and compatibility.
  • Diagnostic logs: stay on your device and only reach us if you voluntarily send them to support.
  • Push tokens (Firebase Cloud Messaging): device identifier used to deliver notifications (e.g. weather alerts, takeoffs of pilots you follow). They can be revoked at any time in the app settings.
  • Cookies and similar technologies: used on the website and web application to keep your session authenticated, remember preferences (dark/light theme, language) and collect anonymized usage metrics. See section 8.

2.3 Data from third parties

When you sign in through an identity provider (e.g. Google, Apple), we only receive the basic profile information you authorize on that service (name, e-mail, photo). We do not store your password in those cases.

3. How we use your data

We use your data for the following purposes, with the corresponding LGPD legal bases:

  • Core function (performance of contract): display your flight instruments, record and process your flights, create and manage your account.
  • Social features (performance of contract): profile, activity feed, achievements, flight-companion detection ("flew together"), live tracking and interactions with other pilots.
  • Weather forecast (performance of contract): forecasts for your saved locations and any alerts you enable.
  • Improvements and personalization (legitimate interest): analyzing how the platform is used to improve features, recommend flying sites and personalize the feed.
  • Security (legitimate interest): detecting and preventing fraud, unauthorized access and abuse of the platform.
  • Service communications (performance of contract): notifications about your account, new followers, flight reactions and weather alerts.
  • Marketing (consent): newsletters and XC Fly news — only if you opt in. You can unsubscribe at any time.
  • Legal obligations: responding to requests from competent authorities when required by law.

We do not sell your data. We do not use your data for advertising.

4. What is visible to other people

  • Your public profile: name, photo, flying sites and flight statistics.
  • Public flights: track on the map, metrics and flight-companion detection ("flew together") — private flights do not take part.
  • Live tracking: your real-time position, only while you are broadcasting. The session ends automatically after landing or after a few minutes without a signal.
  • Comments and messages in community spaces (site chats, feed).

You control the visibility of each flight (public/private) in the settings. Public content may be indexed by search engines.

4.1 Schools: what your school sees

  • When you join a school through an invite link, you start sharing with that school's instructors and staff: your name, your photo, your course progress, your class attendance and any notes the instructor writes about you.
  • Flights attached to the course: while your enrolment is active and you keep the flight-sharing consent on, your school's instructors can see the flights you attach to course steps — including flights marked as private, since that is how the instructor reviews the exercise. You can turn this consent off at any time in your journey; it stops applying from that moment on.
  • Enrollment record: your school may ask for registration data it is required to keep (ID document, tax number, date of birth, blood type, emergency contact, marital status, profession and address). That data belongs to the school: only that school's team and you can see it; not even the XC Fly team looks at it. You fill in and correct your record in the app; blood type and emergency contact exist for rescue in case of an accident.
  • Documents sent to the school (ID photo, ID card or driving licence, proof of address, medical certificate, contract) are stored in a private area, reachable only by that school's team and by you through temporary links. They are never published on any open page and do not appear on your profile. The school is responsible for asking only for what it needs and for deleting what it no longer needs.
  • Completion certificate: when you finish a course, XC Fly creates a public page with your name, your photo, the course, the school and the date. Anyone with the link can open it. Ask your school or our support to remove it if you no longer want it public.
  • Certificates issued by the school (solo flight, practical exam, safety courses, etc.) also have a public verification page with your name, the school, the type, the issue date and the validity. The certificate file itself stays private.
  • Activity photos and videos: your instructor logs each activity (class, flight, ground handling) with photos and videos you may appear in. This material stays inside the school: only that school's instructors, staff and students can see it, and it is not published on any open page. If you would rather not appear, ask your school to remove it. The school is responsible for holding your image-use consent.
  • When you leave the school, instructors stop seeing your data from then on. The course history stays with the school as a training record.

5. Data sharing (processors)

XC Fly does not sell your personal data. We use infrastructure services that process data on our behalf, only in the situations below:

  • Cloudflare R2: storage of IGC and GPX files and images (avatar, flight photos).
  • Keycloak: authentication, identity management and login federation.
  • PostgreSQL / Redis / RabbitMQ: database, cache and event queue — hosted on Kubernetes infrastructure under our control.
  • Mapbox: map rendering — receives coordinates in order to display the maps in the app.
  • Google Analytics 4 (Google LLC): anonymized usage metrics on the website and web application, with anonymized IP.
  • Firebase Cloud Messaging (Google LLC): delivery of push notifications to your phone.
  • Open-Meteo: weather lookups for flying sites (no personal data sent — only the site's coordinates).
  • Transactional e-mail services: for account notifications and password recovery.
  • Legal requirements: when compelled by law, court order or a request from a competent authority.
  • Merger or acquisition: if control of the company is transferred, your data will be protected by the same standards as this policy.

All processors above act under contractual instructions and are required to maintain equivalent or higher levels of data protection. None of them is authorized to use your data for their own purposes.

6. Storage and security

Your data is stored on servers located in Brazil or in countries with a level of protection equivalent to the LGPD. We adopt the following technical and organizational measures:

  • Encrypted data transmission via TLS/HTTPS.
  • Passwords stored with secure hashing algorithms (bcrypt).
  • Session tokens protected in the device's secure storage.
  • Internal access restricted by role (least-privilege principle).
  • Regular backups with encryption at rest.
  • Continuous monitoring to detect security incidents.

In the event of a security incident that may affect your data, we will notify the Brazilian National Data Protection Authority (ANPD) and the affected data subjects within the timeframes set by the LGPD.

7. Retention and deletion

We keep your data for as long as your account exists. You can:

How deletion works: the request schedules the deletion with a 30-day grace period (to prevent accidental deletions) — within that window, simply open the app and tap "Cancel deletion". After the 30 days:

  • Profile, photos, personal data and login credentials are permanently erased;
  • Flight records are anonymized and made private (unlinked from your identity, removed from the feed and public maps);
  • Audit records required by law (LGPD) are retained for the legally required period.

Other retention periods:

  • Security logs: kept for up to 12 months for audit purposes.
  • Tax and contractual data: as required by Brazilian law (up to 5 years).

8. Cookies and tracking

On the website and web application, we use the following types of cookies:

  • Essential: required for the platform to work (authenticated session, CSRF protection). They cannot be disabled.
  • Preferences: store your theme (light/dark) and language choices (xcfly-theme, xcfly-lang-set). They can be removed in your browser settings.
  • Analytics (Google Analytics 4): _ga, _ga_* and _gid cookies to measure traffic in an anonymized way. We also use the _gl parameter (link decoration) to preserve the session when you navigate between xcfly.com.br and app.xcfly.com.br. We honor the browser's Do Not Track signal — if it is on, GA is disabled for your session.

We do not use advertising, remarketing or cross-site tracking cookies for commercial purposes. You can disable analytics cookies at any time in your browser settings or by turning on "Do Not Track".

9. Your rights (LGPD)

As a data subject, you have the following rights guaranteed by the LGPD, which you can exercise at any time by e-mailing contato@xcfly.com.br or through your account settings:

  • Confirmation and access: know whether we process your data and obtain a copy of it.
  • Correction: correct incomplete, inaccurate or outdated data.
  • Anonymization, blocking or erasure: of unnecessary data or data processed in violation of the LGPD.
  • Portability: receive your data in a structured format (JSON, IGC, GPX) for transfer to another service.
  • Erasure: delete data processed on the basis of your consent.
  • Objection: object to processing carried out on the basis of legitimate interest.
  • Withdrawal of consent: revoke authorizations previously granted (e.g. newsletter).
  • Review of automated decisions: request human review of decisions made on the basis of automated data processing.

We will respond to requests within 15 calendar days, which may be extended to 30 days in complex cases, with due justification.

10. Children and teenagers

XC Fly is intended for pilots aged 16 or older. We do not knowingly collect data from children under 16. If we identify an account created by a minor without the consent of a legal guardian, we will delete it immediately. To request the deletion of a minor's data, contact us: contato@xcfly.com.br.

11. External links and integrations

XC Fly may integrate third-party services (e.g. maps, weather forecasts, live cameras at flying sites). We are not responsible for the privacy practices of those services. We recommend that you read the privacy policy of each external service you use through the platform.

12. International transfers

Some of our service providers (e.g. Cloudflare R2 for file storage) operate on infrastructure outside Brazil. In those cases, we adopt appropriate contractual safeguards (standard clauses) to ensure that your data receives protection equivalent to that provided by the LGPD.

13. Changes to this policy

We may update this Privacy Policy from time to time. Any change will be published on this page, with the update date shown at the top. Significant changes will be communicated by e-mail or by a prominent notice on the platform at least 15 days in advance. Continued use of XC Fly after the new rules take effect implies agreement with the changes.

14. Contact and data protection officer (DPO)

To exercise your rights, ask questions or report a privacy concern, contact our Data Protection Officer (DPO):

You may also file complaints with the Brazilian National Data Protection Authority (ANPD): gov.br/anpd.

See also our Terms of Service and the account deletion page.

Back to the home page