MRO Tracker
Privacy Policy
Last updated: October 13, 2026
This Privacy Policy describes what information MRO Tracker ("we," "our," "the Service") collects, how it's used, and who it's shared with. It covers the web app and the MRO Tracker mobile apps for iPhone, iPad and Android (see Mobile Apps).
Information We Collect
| Category | What's collected |
|---|---|
| Account information | Email address and password (password is not visible to us — it's managed by our authentication provider). |
| Task data | Task descriptions, timestamps, and due dates that you or your organization enter into the Service. |
| Login activity | Login timestamps, IP address, and browser/device information, used for account security and audit history. |
| Profile photo | A profile photo, if you set one on the website. It is shown in place of your initials to the people you can message (in the Messages list, people search, the chat header and next to your messages) and in your organization's user list, on the website and in the mobile apps. You can remove it at any time in My Preferences; your initials are shown instead. |
| Expenses and flight times | Crew expenses you submit (date, category, merchant, amount, aircraft, payment method and receipt photo) and flight times recorded with the flight recorder. These go to the people in your organization who approve them: expense approvers (for example admins, the director of operations or the chief pilot) see the submitted expense details and receipt, and maintenance approvers (for example admins, the director of maintenance, maintenance control or mechanics) see the recorded flight times, on the website and in the Admin app. If an expense is rejected, you see the reason. |
| Organization data | Organization name, uploaded logo image, and admin/member assignments. |
| Billing information | Subscription plan, seat count, and billing status. Payment card details are handled entirely by our payment processor (Stripe) — we never receive or store your full card number. |
We do not run advertising, third-party ad trackers, or analytics pixels in the Service.
How We Use Information
- To provide and operate the Service — logging tasks, generating reports, and managing organization membership.
- To authenticate accounts and maintain account security.
- To send reports and account-related emails you or your organization's admins have configured.
- To process subscription payments and manage billing.
- To maintain a login/security audit trail for your organization's admins.
- To send push notifications to the mobile apps for the alerts you choose.
- To answer the questions you ask MRO Insight.
- To prepare a flight briefing or an airport weather and NOTAMs lookup when you run one in the Pilot or Admin app (see Flight Briefing and Airport Lookup).
- To detect takeoff and remind you to record, or start recording, a flight you are booked on, if automatic recording is turned on (see Mobile Apps).
Who We Share Information With
We use the following third-party service providers to operate the Service. Each processes a limited set of data as necessary to perform its function:
| Provider | Purpose |
|---|---|
| Netlify | Application hosting and account authentication. |
| Supabase | Database storage for task, organization, and login-history data. |
| Stripe | Payment processing and subscription billing. |
| Resend | Delivery of report and notification emails. |
| Twilio | Delivery of text messages (SMS) to users who opt in. |
| Anthropic | The AI model that answers MRO Insight questions, writes the flight briefing summary (if the AI summary setting is on) and, when you ask it to, reads an expense receipt photo to fill in the expense. |
| FAA and weather services | The route, airports and times of a flight you brief, or the airport and time you look up, sent to look up weather, TFRs and NOTAMs (for example the FAA NOTAM API and FAA TFR feed). No account or personal details are sent. |
| Apple Maps and Google Maps | The briefing and airport lookup map (Apple Maps on iPhone and iPad, Google Maps on Android) and its radar layer. |
| Apple and Google | Delivery of push notifications to the mobile apps (Apple Push Notification service and Firebase Cloud Messaging). |
We do not sell personal information to third parties.
Text Messages (SMS)
If you opt in to text messages, we keep your mobile number, the date, time and IP address of your consent, the texts you send to MRO Tracker and our replies. We use them only to send you the messages you asked for, to answer your texts and to keep a record of your consent.
No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent will not be shared with any third parties. We share your number only with our text message provider (Twilio) to deliver messages.
Reply STOP to any text to opt out, or remove your number in My Preferences.
Mobile Apps
The MRO Tracker Pilot, Mechanic and Admin apps for iPhone, iPad and Android sign in with your MRO Tracker account and work with the same organization data as the web app. They also use the following, only as described:
| Data | When and how it's used |
|---|---|
| Location and motion | MRO Tracker Pilot and MRO Tracker Admin use your phone's precise location and motion sensor while you are recording a flight. The flight's track, times and g-loads are uploaded to your organization's MRO Tracker. Recording continues with the screen locked and stops when you stop recording. Automatic recording is off by default. If your organization or you turn it on, the app checks your phone's location in the background, even when the app is closed, but only during the window of a flight you are booked on (from 1 hour before departure to up to 3 hours after) and only near that flight's departure airport. It uses this only to detect takeoff, so it can remind you to record or start the recording, as set. Nothing is uploaded until a recording starts; from then on the flight is recorded and uploaded as above. Outside a booked flight's window and away from its departure airport, your location is not used. To stop it, set Account → Automatic recording to Off in the app (unless your organization has set it for you), or remove the app's “Always” (iPhone and iPad) or “Allow all the time” (Android) location permission in your phone's settings. |
| Camera and photos | Used only when you attach a photo to a squawk, a post-flight check-in or an expense receipt (MRO Tracker Pilot and Admin). Only the photos you choose are uploaded, to your organization's MRO Tracker. If you tap Read the receipt, that receipt photo is also sent to Anthropic to read the amount, date and vendor. |
| Push notifications | If you allow notifications, the app gets a push token from Apple Push Notification service (iPhone and iPad) or Firebase Cloud Messaging (Android). We keep the token with the app, app version and device model to send you the alerts you choose, and remove it when you sign out. Message notifications — the push notification, and the popup shown when a message arrives while the app is open — display the sender's name (and photo or initials, in the popup) and the start of the message on your device's screen, including the lock screen if your phone's notification settings allow it. |
| Sign-in | Sign-in tokens are stored on your device in the iOS Keychain or in Android encrypted storage. |
| Working without signal | So you can keep working without signal, the Pilot, Mechanic and Admin apps keep a copy of the data you have opened (for example your flights, task cards, work orders and messages) on your phone for up to 14 days. Changes you make without signal (for example a squawk or expense with its photos, a sign-off with the signature you draw, or a clock time) are kept on the phone until they are sent to your organization’s MRO Tracker when you have signal again. This copy is kept separately for each person who signs in on the phone and is cleared when you sign out; if changes are still waiting to be sent, the app warns you before you sign out, because they will be lost. Log of changes from the phone. Each change sent from the phone carries an identifier made on the phone and the time the phone recorded it. Our server keeps a log of these changes, with that time, so that a change sent twice (for example after a lost connection) is applied only once. Clock in and clock out times made without signal use the time recorded on the phone. |
| Signatures | Signatures you draw in the app, for example on a flight release or a task card sign-off, are saved with the record you sign, just as in the web app. |
| Feedback | When you report a bug or request a feature, the report is sent to the MRO Tracker team with your email address, the app version and your device model. |
MRO Tracker FAA has no account. The repair classifications you save stay on your device, and the app sends nothing to us. If you sign off a classification, your name, certificate type and number, and the signature you draw are saved with that record on your device, and your name and certificate are remembered on the phone for next time; none of this is sent to us or anyone else. If you print, email or share one (including a signed PDF), it goes only where you send it.
Flight Briefing and Airport Lookup
When you run a flight briefing in the Pilot or Admin app, MRO Tracker sends the flight's route, airports and times to the FAA and to weather services to fetch weather (METARs and TAFs), radar, TFRs and NOTAMs. It combines these with your organization's aircraft and flight records. If the AI summary setting is on (Account → AI summary in briefings; on by default), the briefing data is also sent to an AI model (Anthropic) to write the summary at the top. No personal information is sent beyond what is in the briefing itself. You can turn the AI summary off at any time.
The airport weather & NOTAMs lookup in the Pilot and Admin apps sends the airport identifier and the time you choose to MRO Tracker’s server, which fetches public FAA data (airport details, TFRs and NOTAMs) and weather data for that airport. Only the airport and time are sent to those services, nothing about you. Your recent airports are kept on your phone so you can pick them again.
MRO Insight
MRO Insight, in the web app and in the Pilot, Mechanic and Admin apps, answers plain-English questions about your organization's data. Your question is sent with your own permissions, so MRO Insight can only look up what you can already see in MRO Tracker. The answer is generated by an AI model (Anthropic) from your organization's MRO Tracker data. Your recent questions and answers are kept in your MRO Insight history.
Data Retention
We retain account and task data for as long as your account or organization remains active, plus a reasonable period afterward for backup and legal purposes. Login history is retained to support security auditing. You can request deletion as described below.
Your Choices
You can ask your organization's administrator, or contact us directly, to access, correct, or delete your account information. Organization administrators can manage and remove members directly within the Service. See Delete your account for how to request deletion and what is kept.
Security
We rely on our infrastructure providers' security practices (encryption in transit, access controls) and apply role-based permissions within the Service so that organization data is only accessible to that organization's administrators and authorized super administrators.
Children's Privacy
The Service is intended for business use and is not directed at children. We do not knowingly collect information from children.
Changes to This Policy
We may update this policy from time to time. We'll update the "Last updated" date above when we do.
Contact Us
Questions about this policy? Contact us.