1. What we collect
We collect only what's needed to run the Service:
- Account information: your email address (and password, or sign-in provider identifier) used to create and access your account.
- Payment information: handled by Stripe. We never receive or store your full card number, CVC, or bank details. We do receive payment status, transaction amounts, and limited billing metadata (like card last-4 and card brand) needed to grant access and handle refunds.
- Course progress data: lesson completion, quiz and practice-exam attempts and scores, chart-trainer activity, streaks, and certificates — used to power your readiness score, dashboards, and (if applicable) your organization's team-progress reporting.
- Support & guarantee evidence: messages you send through the support inbox, and pass-guarantee proof. You upload a PSI scheduling confirmation and the Airman Knowledge Test Report as PDF, JPG, or PNG files, up to 10 MB each. Files go into a private Supabase Storage bucket named guarantee-claim-evidence. The bucket is not public. Each file is stored under your account id, and the claim row records that path (proof_of_scheduling_path and faa_failure_report_path). You can upload, read, and delete files only inside your own folder. A file already attached to a claim cannot be deleted or overwritten. Staff can read the files to review the claim; a staff download link is signed for 10 minutes and only if the path starts with your account id. If upload is unavailable, you may submit an HTTPS link instead. We do not publish these files.
- Practice-test leads: if you choose to enter your email on a free Part 107 practice test, we store that email, your consent, the score from that attempt, and when you subscribed. On the 20-question test we also store an optional first name, the topic breakdown, the study plan, and the campaign source of the visit: UTM parameters, the referring site's host, and Google click identifiers (gclid, gbraid, or wbraid) when the ad link includes them. We use this to show your study plan, email you that plan, and send occasional study tips and offers. Every message includes an unsubscribe link. Using that link sets unsubscribed and unsubscribed_at on the lead. You can also ask us to stop by emailing privacy@astrapilotacademy.com.
- Anonymous practice-test activity: on the free practice test and the practice quiz we store a random browser-session id, the step reached (page viewed, first answer, score, email form shown, email submitted, saved, duplicate, or not saved), the score percent, a coarse device type, and the same campaign source described above. That activity table does not include your email, name, or IP address. The session id and campaign source are also kept in a first-party cookie in your browser, the campaign source for up to 7 days, so a later page on this site can stay tied to the visit that brought you in. We use this to see where visitors leave the practice test. We do not use that cookie to advertise to you on other sites.
- Astra Pro compliance binder: if you join Astra Pro, or you record an FAA pass date, we store the certificate and recurrent-training dates you enter. When you add them, we also store each aircraft's nickname, make and model, the last 4 characters of its registration number, registration expiry, Remote ID method, and Remote ID serial. We do not ask for the full registration number. Insurance rows store the carrier, policy type, coverage, expiry, and an optional certificate file. Authorization rows store the type, reference, location, dates, and an optional document. Those files stay in a private bucket. You open them from your account with a short-lived signed link. If you create a client proof link, anyone with it can see the name you saved, whether the certificate date is inside the 24-calendar-month window, aircraft last-4 and expiry, insurance carrier, coverage, and expiry, and authorizations that are in effect. The page says this is your entry, not a check by Astra or the FAA. The link does not include your email, phone, Remote ID serial, or files unless you turn on certificate-of-insurance sharing. You can revoke the link. We use the dates to email you before a registration, policy, or authorization expires. You can turn those reminders off on the binder page. Transactional membership email (welcome, failed payment, cancellation, renewal notice) is separate from marketing email.
- Installed app reminders: if you turn on notifications, we store that device's push endpoint, its encryption keys, the categories you left on, and a short browser description. We use them only to send the reminders you chose: Astra Pro compliance dates, Part 107 recurrent training, and a notice when a client accepts a Job Desk agreement. You can turn a category off or remove the device. If the push service says the subscription has expired, we delete it. The app works without notifications.
- Basic technical data: standard server logs (IP address, browser/device type, timestamps) used for security and abuse prevention.
2. How we use it
- To create and maintain your account and deliver the course you paid for.
- To process payments, receipts, and refunds (including pass-guarantee refunds) through Stripe.
- To calculate your readiness score, track progress, and issue completion certificates.
- To send transactional email (receipts, reminders to keep studying, guarantee-window notices) and respond to support requests.
- To send the optional device reminders you turn on.
- To measure, with Google Ads, whether an ad led to a practice-test signup, a waitlist signup, or a course purchase. Those events do not include your email or name.
- To see, without attaching your email, where practice-test visitors drop off and which campaign brought them in.
- To keep the Service secure and prevent fraud or abuse.
- If you're on a team/enterprise plan, to share your progress and completion status with your organization's admin.
3. We do not sell your data
Astra Pilot Academy does not sell your personal data to third parties. We don't give advertisers your email or name. We share data only with the service providers described below, as needed to run the Service, or when required by law.
4. Service providers we use
- Stripe — payment processing. Stripe handles your card details directly under its own privacy policy; we never see or store full card numbers.
- Supabase — our database and authentication provider, used to store account, progress, and course data securely.
- Email delivery provider — used to send transactional email (receipts, reminders, support replies).
- Google Ads — conversion measurement. On the marketing site and in the course area (not in the admin console, and not in Astra Pro) we load Google's tag. It can set conversion-tracking cookies, including through googletagmanager.com and doubleclick.net, so we can see whether an ad led to a signup or a course purchase. We do not send your email or name with these events. You can review or turn off personalized ads in Google's ad settings.
The site uses Vercel Web Analytics and Speed Insights for aggregate, cookieless usage and performance measurement.
5. Data retention
We keep your account and course data for as long as your account is active, and for a reasonable period afterward to comply with legal, tax, and accounting obligations, and to resolve disputes (including guarantee claims). Guarantee evidence stays in the private bucket while the claim is open and for that same dispute-resolution period afterward. It is not kept as a public file, and it is deleted when the account-deletion request covers it and no tax, fraud, or open-claim hold still applies. You can request deletion — see "Your choices" below.
6. Your choices
- You can access and update most account information from your account settings.
- You can request a copy of the personal data we hold about you.
- You can request that we delete your account and associated personal data, subject to reasonable exceptions (e.g. records we're required to keep for billing, tax, or fraud-prevention purposes).
- You can unsubscribe from non-essential emails at any time; we'll still send transactional email tied to your account and purchases.
- You can control Google ad personalization, including cookies used for conversion tracking, in Google's ad settings.
To exercise any of these, contact us at privacy@astrapilotacademy.com.
7. Security
We use industry-standard safeguards — including encryption in transit, access controls, and a PCI-compliant payment processor (Stripe) so card data never touches our servers — to protect your information. No system is 100% secure, and we can't guarantee absolute security.
8. Children's privacy
The Service is intended for adults preparing for an FAA certification and is not directed to children under 13. We don't knowingly collect personal data from children under 13.
9. Changes to this policy
We may update this Privacy Policy from time to time. If we make material changes, we'll update the effective date above and, where appropriate, notify you directly.
