Privacy Policy

Effective date: 2026-09-23 (previous version: 2026-05-12)

Surface Ops is published by CAVU Consulting LLC on behalf of uAvionix Corporation ("we", "us"). This Privacy Policy explains what data Surface Ops collects, where it goes, and how it's used. The app is a situational-awareness tool for airport vehicle operators and is designed to collect as little personal information as possible.

1. Information we collect

• Activation code. Each device is activated with a code issued by your airport administrator. The code is sent to our servers at api.surface-ops.com for validation and is stored server-side along with the device fingerprint (below). It is not linked to an individual person's identity by us.
• Device fingerprint. On first launch the app generates a random UUID and stores it in the device's secure preferences. The fingerprint binds the activation code to your specific device. It is not derived from hardware identifiers, the advertising identifier, or any platform-provided device ID.
• Location. With your permission, Surface Ops reads your device's GPS coordinates to render your position on the airport map and to detect runway proximity. Your precise location is used only on the device; it is not transmitted to our servers, nor is it shared with any third party. (Your vehicle may separately appear in the airport's surveillance feed if it carries a transmitter — see “Surface traffic recording” below; that is the airport's data, not your device's GPS.)
• Surface traffic recording. At airports that license Track Replay, our servers record the airport's surveillance feed — the positions, identifiers and callsigns of aircraft and equipped ground vehicles moving on that airport — and retain it for up to 7 days so authorized operators at that airport can replay recent activity. This recording comes from the airport's own surveillance sources, not from your device. If the vehicle you are driving carries an ADS-B or equivalent transmitter, its broadcasts are part of that feed and are recorded along with everything else it reports. Recordings are accessible only to devices activated under an organization that licenses the feature for that airport, and are deleted automatically after 7 days.
• Airport selection. The ICAO/FAA identifier of the airport you select is sent to our servers to fetch weather, frequency, and airport-diagram data on your behalf.

2. Information we do not collect

• We do not use advertising identifiers (IDFA) and do not track you across apps or websites.
• We do not collect contact information, photos, microphone audio, contacts, or health data.
• We do not use third-party analytics, advertising SDKs, or behavioral targeting tools.

3. Third-party services

The app uses the following third parties strictly to deliver requested features:

• National Weather Service (aviationweather.gov) — METAR/TAF and airport metadata. The airport identifier you select is sent through our server to this public API.
• atis.info — D-ATIS text for airports that publish it.
• FAA Airport Mapping (ArcGIS) — Public runway and taxiway polygons.
• OpenStreetMap — Supplemental map geometry for airports not in the FAA dataset.
• Vercel and Neon — Hosting providers for our API and licensing database.

4. Data retention

Activation codes and their associated device fingerprint, last-refresh timestamp, and audit log entries are retained for the duration of your airport's license plus a reasonable period thereafter for support and accounting. You can request deletion of a specific device record by contacting your airport administrator or by emailing us (see Contact below).

Surface traffic recordings made for Track Replay (section 1) are retained for a maximum of 7 days and are then deleted automatically; we keep no longer-term archive of them.

5. Children's privacy

Surface Ops is a workplace tool intended for credentialed airport vehicle operators. It is not directed to children under 13 and we do not knowingly collect data from children.

6. Your rights

Depending on your jurisdiction (including under the GDPR and the CCPA) you may have the right to access, correct, or delete personal information we hold about you. Because Surface Ops does not collect names or contact information directly, identification of the data subject is handled through your airport administrator or by emailing us.

7. Security

All network traffic between the app and our servers is encrypted in transit (HTTPS / TLS). License tokens are stored in the device's secure preferences. Server-side licensing data is held in a managed Postgres database with access restricted to authorized administrators.

8. Changes to this policy

We may update this policy from time to time. Material changes will be reflected in the "Effective date" above. Continued use of the app after a policy update constitutes acceptance.

9. Contact

Privacy questions: airports@uavionix.com. General support: www.uavionix.com/support.