Privacy Policy · Ready for Solo

1. The short version

We collect what we need to run the Service, prevent abuse, and bill you — nothing we sell. Your account and training data live in a Canadian database. We follow Canada's Personal Information Protection and Electronic Documents Act (PIPEDA). You can see your data, correct it, or delete your account at any time.

Ready for Solo (“we”, “us”) is the organization accountable for the Personal Data described here. To reach our privacy contact, see §13.

2. Definitions

“Service” — the Ready for Solo platform: the daily Preflight, the Exams and Radio surfaces, and Mae, our AI tutor.
“Personal Data” — information about an identifiable individual, as PIPEDA uses that term.
“Subprocessor” — a third-party service provider we rely on to run the Service, which processes Personal Data on our behalf (listed in §6).

3. What we collect

Account: your email, a hashed password, your first and last name, an optional callsign and avatar, your chosen license path (PSTAR, PPL, CPL, or IFR), and — if you join through a flight school — that school affiliation.
Anti-abuse signal: a hashed fingerprint of your browser, used once at signup to limit repeat free trials from the same device. It is never sold or shared.
Training activity: your exam attempts, answers and scores, your Smart Card (FSRS) review history, your Radio session results, your conversations with Mae, and the debrief notes generated from your sessions.
Your voice (Radio): when you practise a Radio call, your microphone audio is captured and sent to Google to be graded (see §5). We do not store the audio recording. We do keep a text transcript of what you said, in your session history, so your debriefs and progress make sense.
Billing: a Stripe customer ID, your subscription status, and billing period dates. We never see or store your full card number — Stripe handles your card details directly.
Usage & device: the pages you view and features you use (via PostHog analytics), plus standard technical data such as your IP address, timestamps, and error traces — used for security, rate-limiting, and debugging.

4. Why we use it

To run the Service and personalize Mae's replies to your progress.
To compute your Smart Card (FSRS) schedule so your review queue is tuned to you.
To bill subscriptions accurately, including any applicable taxes.
To detect and prevent abuse — repeat trials, account sharing, payment fraud.
To understand and improve the product, in aggregate.
To respond to your support requests.

5. AI and your data

Mae, your per-question explanations, your session debriefs, the grading of your Radio calls, and the synthesized ATC and Mae voices are all produced by Google's Gemini models. To generate them, we send Google the content needed in the moment — your answers, your messages, and your Radio audio.

We do not use your data to train AI models. We use Google's paid Gemini API, whose terms state that content sent through it is not used to train Google's models. Your conversations with Mae stay scoped to your account.

6. Who we share with — our Subprocessors

The minimum set of Subprocessors needed to run Ready for Solo:

Supabase — our database, authentication, and file storage. Hosted in Canada (ca-central-1).
Stripe — payment processing, subscription billing, and the customer portal. PCI-DSS compliant; they handle your card data, not us.
Google (Gemini) — the AI behind Mae, explanations, debriefs, Radio grading, and generated voices. Processed outside Canada.
PostHog — product analytics and session replay. Processed in the United States.
Sentry — error monitoring. When something breaks, Sentry receives the error and the surrounding technical context (and, on errors, a short replay — see §9).
Resend — transactional email (trial reminders, billing notices, support replies).
Vercel — hosting, content delivery, and basic performance telemetry (Speed Insights) for the app.

We do not share your data with advertisers, data brokers, or anyone else, and we do not sell it.

7. Where your data is processed

Your account and training data are stored in Canada. Some of the Subprocessors above — Google, PostHog, Sentry, Stripe, Vercel, and Resend — process data in the United States or other countries. By using the Service you consent to this transfer. We choose providers with reasonable security commitments, and your data may be subject to the laws of the countries where it is processed.

8. How long we keep it

We keep Personal Data only as long as we need it for the purposes above:

Radio voice audio: not retained — processed for grading, then discarded.
Account profile and training data (exam attempts, Smart Card history, Radio transcripts, debriefs): kept while your account is active, and deleted when you delete your account.
Conversations with Mae: the content is automatically anonymized after 24 months and deleted after 7 years — or sooner, when you delete your account. We keep them this long so a future question about training guidance you were given can be answered.
Inactive free accounts: if you signed up but never subscribed and your account has no activity for 12 months, we delete it — your profile and training data — after sending a warning email to the address on file.
Billing records: retained as long as Canadian tax law requires (generally around six years), even after you delete your account.
Your Stripe customer record: kept at Stripe per their policy for refund and dispute lookback. Ask us if you want it manually purged.
Product analytics (PostHog): up to 12 months.
Session replays and error data (PostHog, Sentry): kept on a short cycle — roughly 30 days for replays and up to 90 days for error reports.
Server logs: roughly 30 days.

9. Cookies, analytics & tracking

We use cookies to keep you signed in (authentication and session). We use PostHog for product analytics — the pages you view and the features you use, tied to your account — stored via cookies and your browser's local storage.

We also use session replay, which records your on-screen interactions (clicks, navigation, and visible page content) so we can understand and fix problems. PostHog may record full sessions; Sentry records a short replay around an error. These replays can capture the text shown on your screen — your form inputs, such as your password, are masked, but other visible content may be included.

Analytics and session replay run for signed-in users and there is no in-app opt-out today. You can limit tracking using your browser's privacy controls (for example, “Do Not Track” or blocking analytics domains), or email us and we will opt you out manually. We do not use third-party advertising cookies.

10. Your rights

Under PIPEDA you can:

Access the Personal Data we hold about you — email support@readyforsolo.com and we will respond within 30 days.
Correct errors from your Account settings or by emailing us.
Delete your account from Account settings. This cancels your subscription and removes your account and training data; analytics and replay records then age out on the retention cycle in §8.
Withdraw consent for analytics by emailing us (see §9).
Complain to the Office of the Privacy Commissioner of Canada if you believe we have mishandled your data.

11. How we protect it

Data is encrypted in transit. Passwords are hashed by our authentication provider — we never see them. Access to your data is restricted by row-level security so that one account cannot read another's. No system is perfectly secure, but we take reasonable measures appropriate to the sensitivity of the data we hold.

If a breach of your Personal Data creates a real risk of significant harm, we will notify you and report it to the Office of the Privacy Commissioner of Canada, as PIPEDA requires.

12. Children

You must be 14 or older to use the Service. If you are under the age of majority in your province, a parent or guardian must consent on your behalf (see Terms §4). We do not knowingly collect data from anyone under 14.

13. Changes & contact

We may update this policy. If a change is material, we will email the address on your account at least 14 days before it takes effect.

Privacy questions or data requests: support@readyforsolo.com.