Skyhawk One – Privacy Policy

Last updated: 17/10/2026 (DRAFT)

Skyhawk One ("the app") is provided by T-DRONE PTY LTD trading as Skyhawk Aerial (ABN 63 701 868 742) ("we", "us"). This policy explains how we collect, use, store, share and delete personal information when you use the app on Android, through Google Play, or on the web. We handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles.

1. Contact

Privacy questions, access or correction requests and complaints: PO Box 58, Mooroolbark VIC 3138, or email info@skyhawkaerial.com.au. We aim to reply within 30 days. If you are not satisfied, you can contact the Office of the Australian Information Commissioner (oaic.gov.au).

2. What we collect

• Company details you enter at sign-up: company name, ABN and CASA aviation reference number (ARN).
• Account details: name, email address and a password (stored only as a salted PBKDF2 hash; we cannot see your password).
• Operational records you or your company's users enter: pilots (names, ARNs, licence/certificate dates), aircraft, batteries, maintenance, jobs, job areas drawn on the map (coordinates), mission forms, flight logs, signatures entered as names/ticks, and attachments you upload.
• Technical data: a session cookie to keep you signed in, and standard server logs (IP address, time, request) kept by our hosting provider for security.

We do not collect device location automatically, contacts, photos (other than files you choose to attach), advertising identifiers or payment card details. The app has no advertising and no analytics or tracking SDKs.

3. How we use it

Only to provide the app: signing you in, storing and syncing your company's records across your devices, producing PDFs you request, showing weather and aerodrome information for a job area, account support, security and fraud prevention, and meeting legal obligations. We do not sell personal information and do not use it for marketing without your consent.

4. Who can see your data

Each company's data is kept separate. Only users that your company's admin has added can see your company's records. We do not access your records except where needed for support you ask for, security, or where required by law.

5. Service providers and overseas disclosure

• Have I Been Pwned (Pwned Passwords) receives the first 5 characters of a SHA-1 hash of a new password to check it has not been breached.
• Cloudflare, Inc. hosts the app and database. Data may be stored or processed on Cloudflare servers outside Australia (including the United States).
• Stripe Payments Australia Pty Ltd processes subscription payments. Stripe receives your email, company name and card details; we receive only a customer ID, subscription status and payment outcome, never your card number. Stripe's privacy policy: stripe.com/privacy.
• When you use a job's map or weather features, your device or our server sends the map area or job coordinates and times to: OpenStreetMap (map tiles and address search), Open-Meteo (wind), GFZ Potsdam and NOAA SWPC (Kp index). Your device also loads fonts and app libraries from Google Fonts and unpkg, which receive your IP address. No account details are sent to these services.

6. Security

All traffic uses HTTPS. Passwords are hashed. Session tokens are random and stored only as a hash. Every database query is limited to your company. Passwords must be at least 9 characters and are checked against known breached passwords using the Have I Been Pwned k-anonymity service (only the first 5 characters of a one-way hash are sent; your password is never sent). Repeated failed sign-ins are temporarily blocked. A copy of your company's data is also kept on your device so the app works offline; signing out removes it.

7. Pricing and billing

Skyhawk One costs A$25 per month per company (GST inclusive where applicable), billed monthly by Stripe until cancelled. A company account is created only after the first payment succeeds. Company admins can update card details or cancel at any time from Account › Manage subscription on the web; cancellation takes effect at the end of the paid period. If a subscription is cancelled or a payment fails, access is locked but your company data is kept, not deleted, so access returns when the subscription is renewed. To delete data, use the deletion options below. The Android app is free to download and is used by signing in to an existing account; it does not sell subscriptions.

8. Retention and deletion

We keep your data while your account exists, including while a subscription is cancelled or unpaid. Billing records are kept by Stripe and by us as required by Australian tax law (generally 5 years), even after account deletion. You can delete it at any time:

• In the app: Account › Delete my login (removes your login), or, for company admins, Delete company and all its data (removes the company, all its users and all records).
• On the web, without the app: delete-account.html, or write to us at the address above.

Deletion is permanent and immediate in the live database. Encrypted database backups held by our hosting provider are overwritten within 30 days. Records that your company's users created stay with the company when one user's login is deleted, because they belong to the company's operational records; the company admin can delete them. You are responsible for keeping any records CASA requires you to retain (for example by downloading a backup) before deleting.

9. Access and correction

You can view and correct your information in the app, download a full copy (Backup page), or contact us.

10. Children

The app is for licensed drone operators and is not directed at children.

11. Changes

We will post any changes on this page with a new "Last updated" date.