AACO Virtual is a free, non-commercial flight simulation community. We collect as little as we can, we never sell data, and the site has no advertising and no analytics or tracking tools.
Who is responsible
The data controller is the operator of the site: Amar Al Khatib. Contact: contact@aaco-virtual.org
What we store
- Your account: pilot name, email address, password (stored only as a salted scrypt hash, never readable), pilot code, home airline, SimBrief Pilot ID or username, your preferences, your role, the date you joined and your last login. If you link Discord: your Discord ID and user name.
- Your flying: bookings (including the SimBrief flight plans you import into them), flight reports sent by the ACARS (route, times, aircraft, fuel, distance, landing rate and the flight log: position, altitude, speeds, lights and simulator warnings recorded during the flight), the score and checks computed from them, your claims, your tour progress and event registrations.
- Sign-in sessions: for each session, the date it started, when it expires and your browser's user agent, so you can see where you are logged in. Failed logins are counted for 15 minutes per email address, in memory only, to block password guessing.
Why, and on what legal basis
- To run your pilot account and the virtual airline: bookings, flight reports, hours, ranks, tours and events. This is the service you sign up for (GDPR art. 6(1)(b)).
- To keep the site secure and stop abuse (legitimate interest, art. 6(1)(f)).
- To show the community on public pages: pilot roster, leaderboards, tour standings, event attendees, your public profile and passport (legitimate interest of the community). You can turn this off at any time in Profile with “Show me on public pages”.
Who can see it
- Everyone: your pilot name, pilot code, rank, home airline, accepted flights and statistics, unless you turned off “Show me on public pages”. Your email address is never public.
- The staff (volunteers who run the airline): your account details except your password, to review flight reports and help you, for example with a password reset link.
- Services we rely on:
- SimBrief (by Navigraph): when you import a flight plan, our server asks SimBrief for your latest plan using your SimBrief ID. Planning a flight takes you to the SimBrief site, under its own privacy policy.
- Discord: only if you choose to sign in with Discord or link your account.
- Esri (ArcGIS Online): the map on the passport page loads its background from Esri, which receives your IP address like any website you visit.
- Google Cloud (servers in Belgium): hosts the site and its database on our behalf and keeps technical logs (such as IP addresses) for security.
- Cloudflare: manages the domain name and forwards emails sent to our addresses (such as contact@) to the staff.
- AeroDataBox provides the real-world schedules and fleets. It receives no personal data.
Cookies
One cookie keeps you logged in (aaco_session, removed when you log out, 30 days at most). Signing in with Discord also uses a temporary cookie for 10 minutes. Both are strictly necessary, so the site needs no cookie banner. There are no advertising or analytics cookies.
How long we keep it
- Your account: until you delete it.
- When you delete your account, your name, email, password, SimBrief ID, Discord link, bookings, event registrations, claims and flight report comments are erased at once. Your accepted flights stay in the alliance statistics, shown only as your pilot code with no name.
- Sign-in sessions: 30 days at most. Password reset links: 24 hours, and they work only once.
Your rights
- Access and portability: download all your data as a file in Account & privacy.
- Correction: edit your details in Profile and Account & privacy.
- Erasure: delete your account yourself in Account & privacy.
- Objection and restriction: turn off public pages in your profile, or contact us.
- You can also complain to the data protection authority of your country (for example the CNIL in France).