Privacy

Orchestr Aerospace Inc. (“Orchestr Aerospace”, “we”) operates orchestrsim.com, orchaerospace.com, and related Orch Avionics marketing and product pages, including the in-browser Jeb's 3D Flight Bag (orchaerospace.com/jebs) and Jeb's Sim Bag (orchaerospace.com/jebsim) electronic flight bags. We are responsible for the personal information described in this policy. Our address is 2211 Michelson Dr, Suite 900, Irvine, CA 92612, USA, and you can reach us at contact@orchestrsim.com.

We apply transparent, GDPR-aligned practices for every visitor. We do not use third-party advertising cookies, and we do not sell your data or track you across unrelated sites.

We use strictly necessary first-party storage only: a small cookie and browser local storage to remember your language preference, cookie-law acknowledgement, your in-app liability-disclaimer acceptance, and related display settings. You may clear this data in your browser at any time.

We use Vercel Analytics and Vercel Speed Insights to understand aggregate page-view counts, top routes, referrers, and Core Web Vitals (LCP / CLS / INP) per page. Both products are cookie-free: they hash your IP address and user-agent at the edge and discard the originals, retaining only an anonymous, aggregated signal. We never receive identifiable personal information through these tools, and we cannot link the signal back to an individual visitor. See https://vercel.com/docs/analytics/privacy-policy for Vercel's documented data-handling.

Jeb's 3D Flight Bag and Jeb's Sim Bag also count a few anonymous usage events around Jeb's Pro, in the apps and in the browser: the upgrade screen opening (and which feature opened it), a plan being chosen, a purchase starting, succeeding or failing (with a short error code), a restore, the first-run introduction being shown or skipped, and an update notice being shown or tapped. Each count holds only the event, the app, the platform (iOS, Android or web), the sales channel (app store or web), the plan and the feature. It carries no user ID, device ID, advertising ID, IP address or free text, nothing is stored on your device for it, and it cannot be linked to you or to your other activity. The counts are stored in our Supabase database and used only to improve the apps and Jeb's Pro; we delete them after 13 months.

To find and fix crashes, our websites and web apps can report errors to Sentry, an error-monitoring service run by Functional Software, Inc. When something breaks, an error event is sent with the error message and stack trace, the page address, your browser and operating-system type and version, and a short trail of the in-app events that led to the error (such as page changes, the addresses of network requests and messages the page wrote to the browser console). A sample of about 10% of page loads, and of requests to our servers, also sends a performance trace: timings of the page load and of its network requests. We do not use Sentry's Session Replay, so nothing records your screen, clicks or typing.

We configure Sentry not to collect personal data: IP addresses are not stored (we remove them before an event is sent and tell Sentry not to infer them from the connection), cookies and every request header except the one naming your browser are stripped, and no user ID or account is attached. Sentry processes this data for us as a service provider and keeps error events for up to 90 days before deleting them. See Sentry's privacy policy at https://sentry.io/privacy/.

If your browser does not offer location, or you decline its location prompt, the web apps ask our host, Vercel, for an approximate location (about city level) that Vercel derives from your IP address while delivering the request. We use it only to centre the map near you when GPS is unavailable. It is not shared with anyone else, and we do not store or log it.

Copilot is an AI assistant, and its answers can be wrong. In the In-browser and This computer (Ollama) modes, the model runs on your own device. If you bring your own OpenAI or Anthropic API key instead, that key is stored only in your browser's local storage on your device, attached to chat requests you initiate, and never persisted on our servers or logged. The messages you send in that mode, together with your flight-plan context, go to the provider you chose and are handled under its own terms and privacy policy. You can remove the key from your browser settings at any time.

When you place a pre-order we collect your name, email address, country, optional notes, the products and quantities you reserve, and an order number. This is stored in our order database, hosted by Supabase, and used only to process your pre-order: confirming it, answering your questions, invoicing the balance, shipping, refunds, and meeting our legal obligations. Your cart is kept in your browser's local storage until you check out.

Deposits are paid through Stripe Checkout on Stripe's own secure page. Stripe collects your card details, billing address and shipping address; card numbers never reach our servers. Stripe sets its own strictly necessary cookies on that page for payment security and fraud prevention, under Stripe's privacy policy (https://stripe.com/privacy). We receive the payment status and the addresses you give Stripe so we can fulfil the order.

We only ship to the countries listed at checkout and check orders against export-control and sanctions rules before shipping. We send you order-related emails only, never marketing, unless you separately ask to hear from us. We do not sell or share your order data with anyone except Stripe and Supabase as service providers, our shipping carrier when your unit ships, and authorities where the law requires.

Retention. Because pre-orders are conditional sales under U.S. FCC rules (47 CFR 2.803), we keep pre-order records for 60 months; tax and accounting records are kept as Canadian and U.S. law require. You may ask to access, correct or delete your data at any time by writing to contact@orchestrsim.com; we will delete what the law does not require us to keep. Our person in charge of the protection of personal information (Quebec Law 25) can be reached at the same address.

Contact orchestr@orchestrsim.com or contact@orchestrsim.com for privacy inquiries.

Jeb's Flight Bag (our full native electronic flight bag for iOS and Android), Jeb's 3D Flight Bag (iOS and Android), and Jeb's Sim Bag (iOS and Android) follow the same posture as our other apps: the apps have no user accounts, we assign no user IDs, and we do not track you across sessions or apps. Jeb's 3D Flight Bag and Jeb's Sim Bag are thin native wrappers that load our web apps (orchaerospace.com/jebs and orchaerospace.com/jebsim) inside the system WebView, so the handling described here also matches the in-browser experience. The one exception is optional and web-only: if you buy Jeb's Pro in a browser, you create an account for that purchase, as described in “Jeb's Pro on the web” below.

Location. With your permission, these apps read your device's GPS location to draw your own position on the moving map and to fetch nearby weather, traffic, and charts. Your coordinates are sent only to the data services listed below as part of those requests (for example a map area, or a latitude/longitude to look up the local METAR). We do not store your location, build a location history, or link it to your identity, and you can revoke location access at any time in your device settings.

Aviation data. These apps make outbound HTTPS requests to fetch publicly available aviation data, routed through our API proxies: FAA terminal procedure charts and airport diagrams; METAR/TAF and NEXRAD weather radar (NOAA / Iowa State Mesonet); RainViewer precipitation; live aircraft traffic (adsb.fi, OpenSky, FlightAware); winds aloft; terrain elevation; and OpenStreetMap / CartoDB / Esri map tiles. Jeb's Sim Bag additionally displays the publicly available VATSIM network data feed (other users' public callsigns, positions, and frequencies) and is not affiliated with, endorsed by, or sponsored by VATSIM. These requests carry no user identifier; upstream operators see only your IP address as part of standard HTTP traffic.

On-device storage. Preferences, your liability-disclaimer acceptance, scratchpad notes, cached charts, and, if you choose to enter one, your own OpenAI or Anthropic Copilot API key are stored only on your device; the API key is attached only to chat requests you initiate and is never persisted on or logged by our servers. The optional ADS-B receiver feature listens only on your local Wi-Fi network and never reaches the public internet.

The native iOS and Android builds request only the device capabilities these features need: location (moving map) and, on the full Jeb's Flight Bag, optionally the microphone (voice input to the Copilot), motion sensors (attitude display), camera (optional external traffic feed), and local-network access (ADS-B receivers). Full machine-readable details ship in each build's privacy manifest. To request deletion or ask any privacy question about the mobile apps, contact contact@orchestrsim.com.

Jebediah is a supplemental electronic flight bag distributed via the Mac App Store and as a Developer-ID build from orchestrsim.com. Nothing leaves your device automatically. Flight plans, logbook entries, settings, downloaded charts, and crash reports are stored locally under macOS standard locations (Application Support, Caches, Documents) and never transmitted to us or to third parties. We do not run any analytics or telemetry. We do not assign user IDs and we do not track you across sessions or apps.

Jebediah makes outbound HTTPS requests only to fetch publicly available aviation data: FAA Digital Terminal Procedures Publication (DTPP) approach plates, METAR/TAF/NOTAM text from NOAA Aviation Weather Center and Nav Canada, and OpenStreetMap map tiles. These requests carry no user identifier; the operators of those services see only your IP address as part of standard HTTP traffic. The optional GDL90 ADS-B receiver feature listens on UDP port 4000 on your local Wi-Fi network for traffic broadcasts from a Stratux or compatible receiver; this is local-network-only and never reaches the public internet.

The Mac App Store edition is sandboxed and declares only the Required-Reason API categories Apple permits for ordinary app functionality: NSUserDefaults (CA92.1, used by Qt's QSettings for your preferences), file timestamp (C617.1, used to scan downloaded charts), system boot time (35F9.1, used by Qt's diagnostics), and disk space (E174.1, used to size the chart cache). Full machine-readable details are in the bundle's PrivacyInfo.xcprivacy.

We do not knowingly collect data from anyone under 13. Jebediah is intended for licensed pilots or for educational use under direct adult supervision. To request deletion of any data we may inadvertently hold (e.g., crash reports you have separately emailed to us), or for any other privacy question regarding the macOS app, contact orchestr@orchestrsim.com.

Using Jeb's 3D Flight Bag and Jeb's Sim Bag in a browser never needs an account. If you choose to buy Jeb's Pro on orchaerospace.com, you create an optional account so the purchase can be restored in any browser. The iOS and Android apps have no accounts: purchases there go through Apple or Google, and nothing in this section applies to them.

Account. Your account is held by Supabase, our authentication and database provider. We store your email address, a user ID and sign-in times. You can sign in with a one-time link we email you, or with Google. If you choose Google, Google confirms who you are and shares your email address and basic profile (name and picture) under Google's privacy policy (https://policies.google.com/privacy); we use only the email address. Your sign-in session is kept in your browser's local storage so you stay signed in; signing out removes it.

Billing. Payments are processed by Stripe on Stripe's own checkout and billing pages, under Stripe's privacy policy (https://stripe.com/privacy). Stripe collects your card details and billing address, and a VAT or GST number if you enter one; card numbers never reach our servers. From Stripe we receive your customer and subscription identifiers, plan, status, renewal or end date, and the country that issued your card, which we use only to check eligibility for regional prices. Your request for immediate access and your acknowledgement about the right of withdrawal (see our Terms of Sale) are recorded with the payment.

Entitlement record. We keep one record per account: your user ID, email address, Stripe customer ID, plan, status, end of the current period, whether you hold a lifetime purchase, whether you have used the free trial, and when the record last changed. We use it only to unlock Pro, to answer support and billing questions, and to offer the free trial once per person. Your browser also keeps a copy of your Pro status so Pro works offline.

Retention and your choices. We keep the account and its entitlement record while the account exists. You can ask us to delete your account at any time at contact@orchestrsim.com; deleting it deletes the entitlement record. Invoices and transaction records are kept, by us and by Stripe, for as long as tax and accounting law requires (generally six to seven years). Legal bases under the GDPR: performance of our contract with you for the account, billing and entitlement; legal obligation for tax records; and our legitimate interest in preventing fraud and repeat free trials.

Depending on where you live (for example under the EU or UK GDPR, Quebec's Law 25, Canada's PIPEDA, or California law), you may ask to access, correct, delete or receive a copy of your personal information, object to or restrict its use, and withdraw any consent you gave. Write to contact@orchestrsim.com; we answer within 30 days. You may also complain to your data-protection authority, for example your EU supervisory authority, the UK Information Commissioner's Office, or Quebec's Commission d'accès à l'information.

We and our service providers (Vercel, Supabase, Stripe, Sentry and, if you sign in with it, Google) process data in the United States and other countries. Where EU, UK or Swiss law requires it, these transfers rely on the safeguards each provider offers, such as standard contractual clauses or the EU–U.S. Data Privacy Framework.

When we change this policy we post the new version on this page and update the date at the top. If a change materially affects how we use information you have already given us, we will tell you before it takes effect.