Privacy policy
Version 2026-11-03
This is a draft awaiting legal review. It describes what the game does with personal data today.
Who I am
I am Jens Christian Blix, a private individual in Norway, and I make and run Airline Simulator on my own. I decide how and why your personal data is used in the game, so I am the controller under the EU General Data Protection Regulation (GDPR) as it applies in Norway. There is no company behind the game yet; if I set one up (for example a sole proprietorship before the game takes payments), it becomes the controller and this policy will say so.
- Name: Jens Christian Blix
- Postal address: Dronning Eufemias gate 51, 0194 Oslo, Norway
- Privacy contact: jcb@idiotsmaking.games
What I collect and why
I collect only what running your account and your games needs. The game has no advertising, no analytics and no tracking of any kind, and I never sell data.
| Data | Where it comes from | Why I use it | Legal basis (GDPR Art. 6) | How long I keep it |
|---|---|---|---|---|
| Email address | You, at sign-up or when you change it | Your login, confirming the address, password resets, account emails | Contract (6(1)(b)) | Until you delete your account |
| Password | You | Signing in. Stored only as a one-way hash; I never see it | Contract (6(1)(b)) | Until you change it or delete your account |
| Sign-in records: IP address, browser, time of sign-in and sessions | Your browser, when you sign in | Keeping accounts secure, spotting misuse | Legitimate interest (6(1)(f)): security | 90 days, then deleted automatically |
| Your airlines and games: names, codes and livery you choose, every decision you make and its results | You, while playing | Running the game you play | Contract (6(1)(b)) | Until you delete the airline, the world ends and is removed, or you delete your account |
| Messages and trade offers you write to other players | You | Delivering them to the players you write to | Contract (6(1)(b)) | Until you delete your account |
| Weekly challenge entries: airline name, code and score | You, while playing | The challenge leaderboard and your challenge history | Contract (6(1)(b)) | Until you delete your account |
| Your own names for the game's aircraft and makers ("nerd mode") | You | Showing them to you | Contract (6(1)(b)) | Until you delete them or your account |
| When you were last in each world | Your browser, while a world is open | Pausing single-player worlds while you are away | Contract (6(1)(b)) | Until you delete your account |
| Push notification settings and devices | You, when you turn notifications on | Sending the notifications you chose | Consent (6(1)(a)), withdrawn by turning them off | Until you turn them off, the device stops accepting them, or you delete your account; sent notifications are deleted after 30 days |
| Which versions of this policy and of the terms of service you accepted | You, at sign-up or from the game's notice | Showing what you were told and agreed to | Legitimate interest (6(1)(f)): accountability | Until you delete your account |
| Reports you make about other players' names and messages: what you reported, the reason and your note | You, with the Report button | Moderating the game, as the terms of service promise | Legitimate interest (6(1)(f)): a safe game for everyone | Until you delete your account; the player reported is never told who reported them |
| Moderation of what you wrote: reports about it, the decision and its reasons, and a paused chat | Other players' reports and the moderators | Deciding reports, telling you why, and hearing an appeal | Legitimate interest (6(1)(f)): a safe game for everyone | Until you delete your account |
| Backups of all of the above | The game's database | Restoring the game after a fault | Legitimate interest (6(1)(f)): keeping the game available | 14 days on the game server, 5 days at a second site |
The servers' own logs record no IP addresses, and each is capped in size so old entries are dropped as new ones arrive.
What other players can see
Other players never see your email address. In a world you share with them, they see what an airline shows the world: its name, code, hub and livery, its routes, fares and fleet, its rank and company value, news about it, and the messages and trade offers you send them.
On the weekly challenge leaderboard, every signed-in player sees your airline's name, code, livery and score, and how many challenges it has won or finished in the top three. Choose airline names that do not identify you if you would rather stay anonymous.
Who processes data for me
The game runs on servers I rent and run myself; your data stays in the EEA except where noted below. These companies handle data on my behalf, only to provide their service:
| Who | What they do | What they handle | Where |
|---|---|---|---|
| Hetzner Online GmbH | Rents me the game server, and the second server that keeps a copy of the backups | Everything in the game's database, and its backups | Data centres in Helsinki, Finland (EEA) |
| Proton AG | Sends the game's emails (confirmations, password resets, email changes) | Your email address and the email's text | Switzerland (EU adequacy decision) |
| The push service of your browser's maker (Google for Chrome and Edge, Mozilla for Firefox, Apple for Safari) | Delivers push notifications, only if you turn them on | A device address your browser creates, and the notification's text | May be outside the EEA, including the USA |
The game loads no fonts, scripts or images from other companies: everything is served from the game's own server. The domain's DNS is hosted by Cloudflare, which only answers which server the name points to and sees none of your data.
Cookies and browser storage
The game sets only cookies it needs to work, so it asks for no cookie consent. It sets no advertising, analytics or tracking cookies, and none from other companies.
- Sign-in session (sb-…-auth-token): keeps you signed in, until you sign out or stay away for about a week.
- Sign-in step (sb-…-code-verifier): links the steps of signing up or resetting a password, for minutes.
- Airline choice (airline-<world>): remembers which of your airlines you are running in a world, for a year.
If you turn on push notifications, your browser also keeps a small background script (a service worker) from the game that shows them; it holds no personal data of its own.
Your rights
Most of your rights take a click on your Account page: download everything I hold about you (access and portability), change your email address (rectification), or delete your account and everything in it (erasure; copies in the backups disappear within 14 days). Turn push notifications off to withdraw that consent. To object to processing based on legitimate interest, ask me to restrict it, or anything else, write to jcb@idiotsmaking.games and I will answer within one month. You can complain to the Norwegian Data Protection Authority, Datatilsynet (datatilsynet.no), or the authority where you live in the EEA.
Children
You must be at least 13 years old to create an account. If I learn that an account belongs to someone younger, I will delete it. A parent who believes their child has an account can write to me.
Security
The game is served only over HTTPS. Passwords are stored as one-way hashes, and every account confirms its email address before it can sign in. The database cannot be reached from the internet, only from the game itself, and each player can read only their own private data. The servers accept administrative logins only with keys, only over a private network, and install security updates every day. If a breach puts your data at risk, I will tell Datatilsynet within 72 hours and tell you without undue delay where the law requires it.
Changes to this policy
When I change this policy, I will update its version above, and the game will tell you about it the next time you visit.