Privacy policy

PitchYaw is the data controller for personal data processed on this site, under the UK GDPR and the Data Protection Act 2018. We collect the minimum we need to run a drone community site, and you can export or delete your data yourself at any time.

What we collect and why

Account data — email address, password (hashed by our authentication provider), username, and the optional profile details you add: display name, pilot type, home region, bio, avatar and gear list. Legal basis: performance of a contract (running your account). Content you post — photos (including camera metadata you choose to upload), captions, spot submissions, ratings and reports. Legal basis: contract and our legitimate interest in operating a community platform. Affiliate clicks — we count clicks on retailer links in aggregate; we do not track which user clicked. Weather and map services — spot pages fetch weather from Open-Meteo and map tiles from OpenStreetMap; your browser requests tiles directly from OpenStreetMap, whose own privacy policy applies.

Cookies

We use only strictly necessary cookies — the session cookies that keep you signed in. We do not set advertising or analytics cookies. If that changes, we'll ask for your consent first, as PECR requires.

Where your data lives

Account data and content are stored with our infrastructure provider, Supabase, in their London (UK) region. Uploaded photos are stored in the same region and served publicly (that's the point of the gallery — don't upload anything you don't want public).

Your rights

You can export your data (Settings → Download my data — a JSON file of your profile, photos, ratings, likes and spot submissions) and delete your account (Settings → Delete account — this permanently removes your account, profile, photos and ratings). You also have the rights of access, rectification, restriction, objection and portability under UK GDPR, and the right to complain to the ICO. To exercise any right you can't self-serve, contact us via the details on our community pages.

Retention

Account data is kept while your account exists and deleted when you delete it. Moderation reports are kept (without your content) for up to 12 months for safety audit purposes. Aggregate, non-personal statistics may be retained indefinitely.

Children

Accounts are for ages 13+. We delete accounts and data of younger children on discovery — see the community guidelines.