Privacy Policy

This Privacy Policy explains how the Honor Flight App ("we", "us") collects, uses, and shares personal information when you use our web and mobile applications (the "Services").

Information We Collect

• Account and Contact Data: Names, emails, phone numbers of Users and, where provided, Veterans or family contacts necessary for coordination.
• Operational Flight Data: Scheduling, roles, check-in/check-out, accommodation notes (e.g., mobility assistance) that enable safe and effective flight operations.
• Device and Usage Data: Log data, IP address, device identifiers, app/browser events for security and performance.
• Communications: Messages sent through the Services, including SMS/email metadata and content where required to deliver the message.

How We Use Information

• To provide, secure, and improve the Services.
• To communicate with you about flights, operations, and updates.
• To comply with law, enforce our Terms, and prevent abuse.
• To generate de-identified/aggregated insights for service reliability and planning.

Sensitive Operational Information

Some information we process supports operational safety and logistics (e.g., wheelchair access, oxygen handling, seating coordination). This information is not intended to be medical or health information (PHI). We implement heightened security and access controls for such data and offer a Data Processing Addendum (DPA) for Customers requiring additional contractual protections.

Messaging (Email/SMS)

We support consent-based messaging. Recipients can reply STOP to cancel and HELP for assistance. Standard carrier rates may apply. We may throttle or suspend messaging to comply with law and carrier policies. Some SMS features may be limited during early rollout while TCPA-aligned consent capture and campaign registration (e.g., 10DLC) are implemented prior to broad release.

Sharing and Sub-Processors

We use trusted providers for hosting, storage, caching, authentication, email, and SMS delivery. Core sub-processors currently include Amazon Web Services (infrastructure), Upstash (serverless Redis), Google, GitHub, and Apple (optional OAuth identity), Resend (email delivery), and Twilio (SMS delivery). We share personal data with these providers only as necessary to perform the Services and subject to contractual safeguards. For Upstash Redis, we use short TTLs and avoid storing message content in cache (transient caching only). An up-to-date list is maintained at /sub-processors.

Data Retention and Deletion

We retain personal data for as long as needed to provide the Services and for legitimate business and legal purposes. Customers may export data, and we delete Customer Data within a standard retention period after account termination, except as required by law.

Security

We use reasonable technical and organizational measures, including encryption in transit and at rest, access controls, logging, and regular backups. No system is 100% secure, and you are responsible for maintaining the security of your account credentials.

Your Choices

• Access, correct, or delete certain data through the Services or by contacting us.
• Unsubscribe from emails via links; reply STOP to SMS to opt out.

Contact

Questions about this policy? Email info@honorflight.app.