Privacy policy

Last updated: 29 September 2026 · Controller: Wingwait (wingwait.com) · Contact: [email protected]

The short version. Wingwait is free and needs no account. If you choose to become a Supporter, Stripe handles the payment and we keep only what's needed to run your membership and alerts. The map runs on public aircraft broadcasts. With your consent (UK/EEA/Switzerland) or by default (elsewhere), we use Google Analytics to understand how the site is used and Google AdSense to show one small ad. You can change your choice at any time: Privacy & cookie choices.

1. Who we are

Wingwait ("we", "us") runs the website wingwait.com, a free live flight tracker. We are the data controller for the personal data described here. Contact us at [email protected].

2. What we collect and why

Data	What and when	Purpose	Lawful basis (UK GDPR)
Usage analytics	Pages viewed; features used (for example searches, flight numbers searched, filters, alerts switched on, share taps, stream view, errors); device, browser and screen type; approximate location derived from your IP address (country or city); referring site; a random analytics identifier stored in a cookie.	To understand which features people use, fix problems and improve the site	Consent (UK/EEA/CH). Legitimate interests elsewhere.
Advertising data	Cookies and device identifiers set by Google; the page you're on; IP address; ad interactions	To show and measure ads that fund the site. Personalised ads only with consent.	Consent (cookies and personalised ads). Legitimate interests for non-personalised ads, fraud prevention and frequency capping.
Your device location	Only if you allow it in your browser. Used when you tap ⌖, "What's above me?", or turn on Overhead alerts, and to centre the map on first visit.	To show aircraft near you	Consent (your browser permission)
Map-area coordinates	The centre and radius of the area you're viewing, sent to the flight-data networks (and our own relay) to ask what's flying there	To load the aircraft on your map	Legitimate interests (providing the service you asked for)
Server and security logs	IP address, time, requested URL, browser type, processed by our host Cloudflare	To deliver the site and protect it from abuse	Legitimate interests
Preferences on your device	Theme, alerts on/off, watched flights, cached routes (see the cookie policy)	To remember your settings	Strictly necessary / your request
Supporter membership (only if you subscribe)	Your email address, a Stripe customer and subscription reference, your plan, status and renewal date, your restore code, and scrambled (hashed) sign-in tokens for your devices. We never see or store your card details.	To provide the membership you bought, remove ads, let you restore it on other devices and handle billing questions	Contract. Legal obligation for tax and accounting records (held by Stripe).
Closed-app alerts (supporters who turn them on)	A push-notification address for your device issued by your browser's push service (for example Google or Apple), and the callsigns of flights you asked to be alerted about	To send the take-off and landing alerts you asked for	Contract
Emails you send us	Your email address and message. The feedback button also adds technical diagnostics you can see and edit before sending.	To reply and fix problems	Legitimate interests

We do not collect phone numbers or special-category data, and card details go straight to Stripe, never to us. We do not sell personal data. Analytics events never include your precise location.

3. Google Analytics and Google Tag Manager

We use Google Analytics 4, loaded through Google Tag Manager, to measure use of the site. In the UK, EEA and Switzerland, analytics cookies are off until you agree in the consent message (Google Consent Mode v2). Until then Google may receive cookieless pings (such as a page view with no identifier) that it uses for aggregated modelling. IP addresses are not stored by Google Analytics 4. We keep analytics data for 14 months. Google acts as our processor for analytics. See Google's privacy policy and how Google uses information from sites that use its services.

4. Advertising (Google AdSense)

We show one small, labelled ad at the end of the flight list, served by Google AdSense. Google and its partners may use cookies and identifiers to serve ads, limit how often you see them, prevent fraud, and, if you consent, personalise ads based on your visits to this and other sites. For personalised advertising, Google is an independent controller. In the UK/EEA/CH, you're asked through Google's certified consent message (IAB TCF) before any advertising cookies are used, and you can refuse. Elsewhere you can opt out at Google Ad Settings or aboutads.info. The ad is never shown in stream view.

5. Payments, flight data and other services

Stripe processes Supporter payments, manages subscriptions and provides the "Manage membership" page. Stripe is an independent controller for payment and fraud-prevention data (Stripe privacy policy). Payments appear on statements as WINGWAIT.
Push services (such as Google Firebase Cloud Messaging, Apple and Mozilla) deliver closed-app alerts to your device. The alert text contains only the flight's callsign and whether it took off or landed.
adsb.lol, a community ADS-B network. Our relay server asks it for aircraft in the area you're viewing; your IP address isn't passed on.
adsbdb.com, for route and airline look-ups by callsign.
Planespotters.net, for aircraft photos by registration or ICAO address.
OpenStreetMap (or CARTO) map tiles, Google Fonts and cdnjs (Cloudflare), which receive your IP address when your browser loads map images, fonts and the map library.
Cloudflare hosts the site (privacy policy).
Hetzner Online hosts our relay server in Germany, which fetches flight data and stores Supporter membership and alert records (privacy policy).

6. International transfers

Our relay server is in the EU (Germany), which the UK recognises as providing adequate protection. Google, Cloudflare and Stripe may process data in the United States and other countries. These transfers rely on the UK International Data Transfer Addendum / EU Standard Contractual Clauses and, where applicable, the UK–US Data Bridge and EU–US Data Privacy Framework.

7. How long we keep data

Analytics: 14 months, then deleted by Google.
Advertising cookies: up to 13 months (see the cookie policy).
Consent record: up to 13 months, then you're asked again.
Supporter records: while your membership is active, then deleted automatically 2 years after it ends (so we can deal with refunds, disputes and restores). Stripe keeps its own billing records as the law requires.
Alert records: each watched flight is forgotten after it lands or after 36 hours; a device's push address is removed when you sign out there, when the device stops accepting alerts, or with your membership.
Emails: as long as needed to deal with your message, and no more than 2 years.
Things stored on your device stay until you clear them.

8. Your rights

Under UK GDPR you can ask for access to, correction of, or deletion of your personal data. You can also object to processing based on legitimate interests, restrict processing, ask for portability, and withdraw consent at any time (Privacy & cookie choices). Supporters can see their details in Settings and manage or cancel billing through "Manage membership". Because the site has no general accounts, we usually can't link analytics data to you. Email us and we'll help. If you're unhappy, you can complain to the Information Commissioner's Office: ico.org.uk, 0303 123 1113. If you're in the EEA, you can contact your local data protection authority.

9. Children

Wingwait is a general-audience site and isn't directed at children under 13. We don't knowingly collect their personal data.

10. Changes

We'll update this page and the date above when things change. Significant changes will be highlighted on the site.