Privacy Policy

What changed on November 10, 2026: we now say that our company website, airworthylabs.com, uses its own Google Analytics property, separate from this website's, and that it loads only after you choose Allow in that site's banner (Third-Party Services). The two sites store your choice separately. We also corrected the names of the banner buttons and now say that your analytics choice is kept for 12 months. Separately, we now say that airworthylabs.com, which is also served at airworthylabs.app, uses Cloudflare Web Analytics in the same way as this website.

What changed on November 9, 2026: we added more detail to §9d: what each party does with the details a shop records, what deleting them removes, what the shop keeps, what deleting does not reach, and that a shop which takes you off its own list can still see them until you delete them. Data Retention now says how long we keep the records of a request made through that page, and what we keep as proof that a deletion happened.

What changed on November 4, 2026: we now say plainly that after you delete your account we keep, with no time limit, the Apple transaction ID of your purchases, and for most purchases a one-way code for the account that held them, to prevent fraud and to protect the purchaser (§6, Data Retention, GDPR / UK GDPR, Data deletion). These records hold no name, email address, or Apple account identifier. We also corrected the places that said purchase records are deleted with your account. We also describe the one-way fingerprints of the photos in a paid inspection. We keep them with no time limit after you delete your account, and remove the link to your account, so that a shared paid set is never charged twice. A fingerprint contains no personal data and cannot be turned back into the photo (§6, Data Retention, GDPR / UK GDPR).

What changed on November 2, 2026: we added §9a (shop invitation links and requests to join), §9b (the Shop plan welcome email), and §9c (inspections a shop keeps after you delete your account), described the web links a shop can send its customers (§9), added §9d (people a shop records who do not use Jug Scope, and how they can see or delete what we hold), listed every kind of email we send through Resend, and disclosed Cloudflare Web Analytics, which measures visits to this website without waiting for your analytics choice.

Jug Scope ("the App") is developed and operated by Airworthy Labs LLC ("we," "us," "our"). This privacy policy explains what data we collect, how we use it, and your rights when you use the App, this website, and our company website, airworthylabs.com.

Nothing you capture is uploaded to Airworthy Labs by default. Your borescope images and inspection records stay on your device and in your private iCloud account unless you turn on a specific opt-in feature or take a specific action described below. Each cloud-upload path — usage analytics, diagnostic uploads, cloud-library upload, and inspection-image sharing — is off until you enable it or initiate it. The App writes to your device's Photo Library only when you explicitly export to Photos (§4a).

Data We Collect

1. Account Information (Sign In with Apple)

You sign in with Apple. The App never asks Apple for your name. The first time you sign in on a device, the App asks Apple for your email address, and Apple lets you share it or hide it with Hide My Email (a private relay address); either works. Apple sends that email address to Airworthy Labs inside the sign-in token, our backend stores it with your account, and the App shows it in Settings. We use it for account communications and, if you opt in, marketing emails (see Marketing section below). On later sign-ins on the same device the App does not ask for it again.

Builds 81 and earlier also asked Apple for your name and showed a registration form; see §14.

2. User Identifiers

The App works with several identifiers tied to your account:

• CloudKit User Record ID — Apple's opaque identifier linking your data to your iCloud account. Never shared externally.
• Account owner hash (e.g., a1b2c3d4e5f6…) — for signed-in users, this is derived directly from your Apple account: it is the first 16 hexadecimal characters of a SHA-256 of your Sign in with Apple identifier. It prefixes the storage location of any diagnostic logs, connection-troubleshooting (forensic) reports, and opt-in image copies you upload to Airworthy Labs. Because it is derived from your Apple account, this hash is stable and account-linked, and Airworthy Labs can associate it with your account. It is not a random per-install value, and it is not detached from your identity — it lets us link your uploads back to you.
• Apple account identifier (raw Sign in with Apple sub) — in addition to the derived hash above, the raw Apple identifier itself is transmitted to Airworthy Labs' Cloudflare Workers backend when you sign in. It is stored server-side in our Cloudflare D1 database (for example, as the key for your subscription, entitlement, and purchase-intent records) and is embedded in the session token your device holds while you are signed in. It is account-linked and lets us associate your backend records with your Apple account.
• Install identifier (a device identifier) — a randomly generated identifier (a UUID) created once when the App is installed. The App sends this install identifier, with your device model (e.g., iPhone15,2), with each usage-analytics event — so only if you have turned usage analytics on (§7). Our backend records those events against your account, so the install identifier is linked to you. The current App sends it nowhere else; builds 81 and earlier also sent it with the in-App registration (§14).

3. Aircraft and Inspection Data (iCloud / CloudKit)

The App stores the following in your private iCloud container via Apple CloudKit:

• Aircraft profiles: tail number (N-number), make, model, engine model, engine serial number and year (when known), cylinder count
• Inspection records: date, aircraft, completion status, Hobbs/tach hours, export-unlock status
• Per-cylinder and per-component findings, annotations, and free-text notes attached to individual images
• Inspection metadata and history, and — for inspections you send to or receive from another shop — a provenance record of that forwarding chain
• The borescope image files themselves, stored as CloudKit assets. Because embedded EXIF metadata (including GPS location, if present — see §5) travels with the image file, that metadata is present inside your private CloudKit container along with the image

This data lives in your private iCloud container under Apple's infrastructure. Except for data you choose to share through the opt-in features described below, Airworthy Labs does not access your individual inspection records.

Recovered Photos. If syncing finds a photo that one device's copy of an inspection has and another device's copy lacks, and no delete of that photo was recorded, the App keeps it out of the inspection and lists it in Recovered Photos instead. The list is stored in your private iCloud and appears on every device signed in to your account until you restore or delete each photo. It can include photos you deleted on build 81 or earlier, whose deletes were never recorded, and photos taken on another device that never synced. A photo deleted on a current version of the App never appears there. The first time the App sets photos aside, it also offers once to save them as a Jug Scope file (see §13). That file is your own copy, outside Airworthy Labs' storage.

Some inspection details do reach Airworthy Labs or Savvy Aviation when you use a feature that needs them. When you share an inspection, upload one to Savvy, buy an unlock for it, send a diagnostic report, or enter a tail number in the aircraft form, the App sends the inspection details involved — such as the aircraft tail number, the inspection ID and date, Hobbs/tach hours, and your notes — as described in §4, §6, and §8 to §11. Apple manages this data under Apple's Privacy Policy.

4. Photos and Videos (Borescope Images)

Borescope images you capture are stored locally on your device and in your private iCloud container (see §3). By default, they are never uploaded to Airworthy Labs. They reach Airworthy Labs' cloud storage (Cloudflare R2) only through an opt-in feature you turn on or a sharing action you take:

• Share capture data (opt-in, off by default) — if you enable Share capture data in Settings, then whenever you upload an inspection to Savvy, a copy of each image that reaches Savvy is also uploaded to Airworthy Labs' Cloudflare R2 storage so we can improve image quality and provide support. Images you never upload to Savvy are not copied. The copy is the saved photo file itself, so if the capture recorded a GPS location, the copied photo includes that GPS location in its EXIF metadata, along with the rest of its embedded EXIF metadata (see below). Each copy also carries the aircraft tail number, the inspection details (inspection ID, date, cylinder, and view), the time the copy was made, the App's version and build number, and your account owner hash (§2), which is linked to your account; your raw Apple account ID, email address, and name are not attached. If usage analytics is on (§7), it also carries the random analytics session identifier for that launch of the App. We use everything in the copy, including its GPS location, to improve image quality and provide support. This is off unless you turn it on. After your first successful upload to Savvy on a device, the App also asks once whether you want to enable this sharing.
• Cross-shop inspection sharing (you initiate it) — described fully in §9 below.
• Jug Scope Cloud library — Auto-upload and Upload to Cloud (off by default; you enable or initiate it) — the App can keep a copy of your captures in a cloud library on Airworthy Labs' Cloudflare R2 storage so you can access them across devices. This is off by default. If you turn on Auto-upload new captures to Cloud in Settings, each new capture is uploaded to R2 automatically when it is saved. You can also tap Upload to Cloud on the Home screen to upload existing captures in bulk. As with the paths above, each uploaded image carries its embedded EXIF metadata (including GPS location, if present) and is keyed by your account owner hash, so Airworthy Labs can access it; the aircraft tail number is used to route the upload. These images are kept until you delete them or delete your account. A deleted image can be recovered for 90 days by contacting support (see “When you delete a photo” below).

In each of these cases the uploaded images reside in Airworthy Labs' Cloudflare R2 storage, keyed by your account owner hash, and Airworthy Labs can access them to operate and support the service. They are kept until you delete them or delete your account, and they are not deleted on a timer while you keep them. When you delete one, its copy is kept for 90 more days so it can be recovered, as described below. Embedded EXIF metadata — including make/model of your camera, any Savvy identifiers, Hobbs/tach hours, engine serial number, your free-text notes, and the capture's step/shot number and altitude, in addition to GPS location — travels with the image and is retained alongside it, including in a recovery copy.

Current versions of the App label these image uploads only with your account owner hash; the raw Apple account ID, email address, and name are no longer attached to the uploaded image objects (the raw Apple identifier is still used by the sign-in and account backend, as described in the User Identifiers section above). However, images and other objects uploaded by earlier versions of the App may still carry your Apple account ID, email address, and name in their stored metadata, and that metadata is retained alongside those objects until the objects are deleted.

When you delete a photo or an inspection. On your device, the App removes its own copy at once. The copy in your private iCloud is removed the next time the App syncs, which can be later if your device is offline or iCloud is unavailable. Copies you exported to your Photo Library are not touched (see §4a). If a photo was never uploaded to Airworthy Labs, that is the whole of it: the photo is deleted at once and cannot be recovered. Download to This Device copies photos onto your device and does not remove them from Jug Scope Cloud.

If the photo is stored in Jug Scope Cloud, its copy in Airworthy Labs' Cloudflare R2 storage is not erased at once. It is moved to a private recovery area and can be recovered for 90 days by contacting support at [email protected]. After 90 days, its image file is permanently deleted; the cleanup runs once a day, so this can happen up to about a day later. You cannot restore a deleted photo yourself. Airworthy Labs staff perform a recovery when you ask for one, and each recovery is recorded. Photos you have already sent to a shop or a customer are kept for the people who received them (see §9). Deleting your account permanently deletes every recovery copy at once, without waiting for the 90 days to end.

Older versions of the App, and shared devices. On an older version of the App, deleting a photo removes it from your device and your iCloud as before. Its Jug Scope Cloud copy moves to the recovery area the next time you open an updated version of the App; until then, it stays stored, and links you have already shared keep working. An inspection deleted on an older version was never actually deleted, so it is still listed after you update, and you need to delete it again. On a device that more than one person uses, deleting a photo removes it from the device and from iCloud at once, but its Jug Scope Cloud copy moves to the recovery area only while the Jug Scope account that uploaded it is signed in on that device. Until then, that copy stays stored.

Photos rescued during an update. If your devices update at different times, the App may rescue a photo it finds in the App's own storage on one of them as a new copy. Deleting that new copy does not move the original Jug Scope Cloud copy to the recovery area; the original stays stored until you delete your account. And if a photo is stored only in Jug Scope Cloud, and the only device that had it was erased or reset before it updated, the App cannot find that photo.

Shared diagnostic copies are the exception. Delete Shared Diagnostic Images in Settings erases the opt-in diagnostic copies described above immediately. They are not kept for 90 days and cannot be recovered. Deleting a photo or an inspection in the App does not touch its diagnostic copy; only this Settings action, or deleting your account, erases it. We keep a record that each erasure happened (when it happened, and how many items it erased), without the images.

What we keep after the 90 days. When a recovery copy's image file is permanently deleted, Airworthy Labs keeps a record that the deletion happened. The record holds your Apple account identifier, the photo's original file name (which contains the aircraft tail number), the tail number, and the inspection and capture identifiers. It holds no image. We keep this record until you delete your account.

Records that outlast your account. Two logs are kept after you delete your account, because they record the erasures themselves. The log of diagnostic-image erasures holds when each erasure happened and how many items it erased, identified by a one-way code derived from your account identifier or from the aircraft's tail number, with no image; deleting your account adds an entry to it. The log of authorized erasures records that an erasure was authorized, with your account recorded as a one-way code derived from your account identifier rather than the identifier itself. Neither log can be deleted.

When you choose to upload to Savvy Aviation, images are transmitted directly to Savvy's servers (and, for the image bytes themselves, to a Savvy-issued Amazon S3 storage URL) — see §11. Savvy Aviation's handling of that data is governed by Savvy Aviation's Privacy Policy.

4a. Photo Library (Export Only)

The App writes images to your device's Photo Library only when you explicitly export an inspection to Photos; it never copies captures there on its own. When you export, the App asks for Photo Library access if you have not given it yet, then saves the exported images — with their embedded EXIF metadata, including GPS location, if present — to albums named for the aircraft and date. The App also uses Photo Library access when you choose to import an image from your Photo Library.

An exported copy is separate from the App's own storage and from your private CloudKit container: deleting a capture or an inspection in the App does not delete a copy you exported. Delete it from the Photos app if you no longer want it. Because it lives in your Photo Library, it is also subject to Apple's iCloud Photos sync if you have that turned on, independent of Airworthy Labs.

Airworthy Labs does not itself upload these Photo Library copies anywhere — they are separate from the Cloudflare R2 upload paths described in §4.

5. Precise Location

The App asks for "When In Use" location permission when you start your first inspection. If you grant it, the App embeds GPS coordinates into the EXIF metadata of each borescope image you capture, and those GPS coordinates are sent to Airworthy Labs or Savvy Aviation inside any image you upload or share. This records where each inspection was performed. That EXIF data travels with the image everywhere the image goes: it is present in your private CloudKit container (§3), in any copy you export to your Photo Library (§4a), and — if you enable any of the cloud-upload paths in §4, share an inspection with another shop, or upload to Savvy (§11) — in the copy Airworthy Labs or Savvy stores. It is not transmitted to Airworthy Labs on its own; it only travels as part of an image file, through the paths described above. You can disable location embedding for future captures at any time by revoking location permission in iOS Settings  ›  Privacy & Security  ›  Location Services  ›  Jug Scope. Location is not the only thing in the file. Each image also carries the tail number, aircraft make and model, cylinder and view, inspection and capture dates, app version, camera model, and, when you have entered them, Hobbs and tach hours, engine type and serial number, your free-text notes, and any Savvy aircraft identifier (see §4). Revoking location permission does not remove these.

6. In-App Purchases (StoreKit)

When you purchase a subscription or credits, Apple processes the payment. We receive a StoreKit receipt (including the full StoreKit-2 signed transaction, or "JWS") to verify your entitlement. We do not store your payment card information. Purchase history is maintained by Apple and accessible via your App Store account settings.

Before certain purchases complete, the App records a purchase-intent with our backend that includes the aircraft tail number and inspection ID the purchase applies to, so the correct inspection can be unlocked once the purchase is verified. If you purchase an export-credit unlock, we also record a ledger entry containing the inspection ID, your account identifier, the credit amount, and the reason for the transaction; this ledger is retained to support entitlement enforcement and is deleted when you delete your account. Two small purchase records are the exception, described next.

Purchase records we keep after you delete your account. When you delete your account, we delete your entitlement records, your purchase-intent records, and your export-credit ledger. We then keep two kinds of purchase record with no time limit. We do not delete them on a schedule. (1) For an export-credit unlock: the Apple original transaction ID of the purchase, whether the credit was granted or refunded, and the date it was first granted. When you delete your account, we remove the link to your account from this record. (2) For each subscription or other purchase on your account, and each purchase-intent record: the Apple original transaction ID or the purchase token the App created, a one-way code that records which account held the purchase, whether that account was deleted, and the date. We make the code with a secret key that only we hold, from the purchase and your account identifier together, so it cannot be turned back into your account identifier. We remove a record of this second kind only when someone uses Restore Purchases on their device to move that purchase to their own account. We keep these records to prevent fraud and to protect the purchaser: so that a purchase made on a deleted account cannot be claimed by someone else, and so that a purchase cannot be credited twice. They do not contain your name, email address, or Apple account identifier. They are not anonymous: a transaction ID is a pseudonymous identifier, and Apple can link it to the person who bought it. We keep them under our legitimate interests (see GDPR / UK GDPR). To ask about them, use the contact details in the Contact section at the end of this policy.

Photo fingerprints for paid inspections. When an inspection has been paid for, the App also sends us a fingerprint (a SHA-256 hash) of each photo in it, so that if you AirDrop or otherwise share the paid photos and someone re-exports exactly those photos, the inspection is not charged a second time. The App sends these while a paid inspection is still open, including for photos you never send, so that photos taken before it ends stay paid for after it ends. For each fingerprint we store the inspection ID, the fingerprint, the identifier of the account that registered it, and the date. We never receive the photo for this purpose. A fingerprint contains no personal data and cannot be turned back into a photo or reveal what is in it; it can only confirm that a file someone already holds is identical. Only the account that paid, or an active member of the shop that paid, can register fingerprints, up to 1,000 per inspection. We keep the fingerprints with no time limit after you delete your account, so that a shared paid set is never charged twice. When you delete your account, we remove the link to your account from them. We use them to deliver what you paid for (see GDPR / UK GDPR).

7. Usage and Product Interaction Data

Usage analytics are off by default and are collected only if you opt in (during onboarding or at any time in Settings). When you enable them, the App records usage events — such as inspection completion, camera connection success, and export format preferences — along with a random session and install identifier, your device model, and the app version, to help us understand feature usage. These analytics are linked to your account, not anonymous: the session and install identifiers are random rather than your name or email, but our backend stores every event with your Apple account identifier, so the events can be traced back to you for as long as the records exist.

Events are sent to Airworthy Labs' analytics backend (Cloudflare Workers, stored in a Cloudflare D1 database) and are also mirrored into Apple CloudKit. In the D1 backend the events are recorded against your account — that account link is what lets us erase them when you delete your account. Each event also carries an event-specific metadata field describing what happened, which for some events includes context such as your aircraft tail number, cylinder number, camera or view type, camera network address, error text, aircraft record identifier, app/API URLs, and — on Savvy upload events — whether you sent as Owner or Mechanic (events from builds 81 and earlier could also carry beta program codes). The same events — including that metadata field, your device model, and the app version — are mirrored into Apple CloudKit so we can view usage dashboards; the CloudKit copy is not limited to random identifiers. The D1 usage events are automatically deleted after 30 days. The CloudKit copies — the raw events plus the derived per-session summaries built from them — are not deleted on a timer; they persist so the dashboards stay available.

When you delete your account we also erase these CloudKit copies — but that erasure works by looking your records up through an account-to-session map stored in the D1 usage events, and because those D1 events are themselves purged after 30 days, if your account has been dormant for more than 30 days a small pseudonymous residual copy may remain in the analytics store that we can no longer target for deletion. These CloudKit copies are per-session pseudonymous (keyed by the random session and install identifiers), not anonymized aggregates. Separately, we also keep a single pseudonymous summary snapshot of recent dashboard data on Cloudflare R2 (used to serve the public dashboard described below); this snapshot is not on the 30-day age-based deletion schedule that applies to diagnostic and forensic uploads, and persists until it is next rebuilt or your account-deletion erasure specifically reaches it.

Independent of the analytics toggle, the App always keeps a small set of lifetime usage counters on your device only (total captures, sessions, exports, imports, inspections, and uploads, plus first/last session dates). This local counter data never leaves your device on its own — but if you send a diagnostic report (§8), a summary line built from these counters is included in that report.

We do not sell your analytics data or share it with data brokers. We may, however, publish aggregate, de-identified usage statistics — for example, a public usage dashboard. That published dashboard is coarsened to protect small groups: usage is grouped into day buckets, exact build numbers are dropped, and any day/version/duration/feature combination that would apply to fewer than five distinct installs is suppressed rather than published. The dashboard's published rows do not include the install identifier or device model — those are stripped before the data is served. It never contains your name, email, or aircraft tail numbers. You can turn analytics off at any time in Settings.

The App's in-app consent screens (onboarding and Settings) give a shorter, plain-language summary of this analytics data. This policy is the authoritative, complete description of what is collected.

8. Diagnostic Logs and Connection-Troubleshooting Reports (Opt-In)

The App can upload diagnostic data to Airworthy Labs' cloud storage (Cloudflare R2) in two ways: reports you choose to send, one at a time, and automatic connection-troubleshooting reports, which upload only if you have turned on the diagnostic uploads setting (off by default). Both are labeled with your account owner hash (the raw Apple account ID, email, and name are not sent to this storage location):

• Reports you choose to send — when you tap Send Diagnostic Report, or, in beta builds, tap Send Report when the App asks after a camera connection or capture problem, the App sends a diagnostic report and log file. Choosing to send is consent for that one report only: it is sent once, and it never turns on diagnostic uploads. If your device is offline — for example while it is joined to a borescope's Wi-Fi — the report is held on your device and sent the next time Jug Scope is open and online. A held report is deleted after 7 days unsent, when you sign out, or when you delete your account, and you can delete it at any time in Settings › Troubleshooting. Reports and logs include camera connection events and errors; app lifecycle and crash-recovery data; Wi-Fi discovery timing and protocol data; your Wi-Fi network name and local IP address; connection state and error codes; your aircraft tail number(s) as a routing identifier; the Owner or Mechanic choice used for a Savvy upload; and a lifetime-usage-counter summary line (see §7). A report you choose to send also includes the result of the most recent connection-troubleshooting (forensic) check, if one has run since Jug Scope was last launched. The next item describes what that check collects, including the camera response previews. We sanitize known-sensitive strings (such as Wi-Fi passwords) out of these logs before they are written, but the sanitizer does not yet strip every field that could identify you personally (for example, a registrant name or an account-identifier fragment that ends up in a log line is not guaranteed to be redacted today).
• Automatic connection-troubleshooting (forensic) reports — if you have enabled diagnostic uploads, the App also uploads a forensic probe report automatically in a broader set of situations than just an initial connection failure — including a failed connection attempt, an unexpected stream termination, an authentication retry, or certain camera-specific anomalies — so we can diagnose the problem. These reports contain your aircraft tail number (for automatically-triggered reports the tail number field is not populated; a real tail number is only included when you manually run a connection-troubleshooting report) plus a substantial network and device inventory: protocol state and error codes, discovery timing, your local IP address, gateway, subnet mask and network interfaces, Wi-Fi network name (SSID) and access point identifier (BSSID), mDNS service records, USB device identifiers, and TLS certificate details for the camera's connection. To diagnose the failure, the probe also queries the camera's own web endpoints and records a preview of each response — typically up to about 1–2 KB for an automatically-triggered report and up to about 8–16 KB for a manually-run one (occasionally more for text-based status pages), with recognizable secrets such as passwords or Wi-Fi keys redacted where our redaction rules recognize them. That redaction is not universal — some header and protocol fields (for example, certain authentication or vendor-specific headers, and raw protocol payloads) can pass through unredacted. Because some of the queried endpoints are snapshot or video-stream URLs, this preview can include a fragment of raw image or video-frame data from the connected camera, capped to the size described above; the report does not contain your saved inspection images or a borescope video recording.

Diagnostic logs and forensic reports — including the tail numbers they contain — are retained for 30 days on Cloudflare R2 and then automatically deleted. A small owner-linked pointer file used to locate your most recent forensic report is retained on the same 30-day schedule.

Because forensic reports can upload automatically in the situations described above once diagnostic uploads are enabled, this data is not limited to moments when you tap a button. Apart from reports you choose to send, nothing in this category is uploaded while diagnostic uploads are turned off (the default). Once you turn the setting on, the automatic uploads described above will occur.

9. Cross-Shop Inspection Sharing

If you send an inspection to another shop, or accept an inspection that another shop has shared with you, that inspection's images and metadata are uploaded to and stored in Airworthy Labs' Cloudflare R2 and Cloudflare D1 storage so the other party can receive them. This happens only when you initiate or accept a share. The data exchanged includes the recipient's contact address — the email address or phone number you enter, used to route the share to them — the sending shop or user's identity and display name, any shop name or customer display name you enter for a shop or a tail, the email address or phone number of anyone you invite to your shop, the aircraft tail number, the inspection images and their embedded metadata, and (for a forwarded inspection) the provenance chain showing who originally performed and who subsequently shared it. As currently implemented, each party to a share can also see certain internal account-routing identifiers belonging to the other party, beyond the identifiers this policy otherwise describes as shared; we are narrowing this to the minimum necessary and it is not yet complete as of this writing. If you revoke a share, the share is marked revoked and immediately stops being usable, but the recipient contact address, the record of which images were included, and the underlying R2 image objects are not immediately deleted — full cleanup of a revoked share is on our near-term roadmap, not yet shipped. A shop can also send a customer a web link to one inspection. Anyone who has the link can open it without signing in and see the tail number, inspection date, the shop's name, and the photographs, which keep their embedded metadata. That metadata can include GPS location if present (§5), the aircraft make and model, Hobbs and tach hours, engine type and serial number, your free-text notes, and any Savvy aircraft identifier (§4), so anyone who opens the link can read it. A link stops working after the time the shop chose, at most 90 days, and we count how many times it is opened. The person who created the link or any owner of the shop can turn it off in Jug Scope at any time, and anyone who has the link can turn it off from its page with Turn this link off. Turning a link off, or closing the shop, stops it opening the photographs, but does not delete them or recall copies already downloaded.

9a. Shop Invitation Links and Requests to Join

A shop owner can invite a mechanic with a single-use invitation link instead of an email address. When the owner creates a link, they type a short note of up to 60 characters to help them recognize who it is for. Jug Scope does not send the link; the owner shares it however they choose. We store only a hashed form of the link's code, together with the note, the shop, the owner who made it, and when. A link can be used once, and it expires after 72 hours.

When the mechanic opens the link in the App and asks to join, we record their Jug Scope account and the time with the request, and the App shows them a 4-digit code. To approve, the owner types the code the mechanic reads to them; the code is never shown to the owner. Three wrong codes decline the request automatically, and a request nobody answers expires after 7 days. Only an approval adds the mechanic to the shop. Every member of a shop can retrieve the shop's member list, which shows each current and former member's Apple account identifier (§2), role, and membership dates.

• What the shop's owners see — the note, whether the link is open, used, approved, declined, cancelled, or expired, how many code attempts remain, and whether the person asking was removed from that shop before. A request does not show them the person's name, email address, or Apple Account.
• What the person asking sees — the shop's name, their 4-digit code while the request is waiting, and the outcome. Someone holding a link that is cancelled or expired, or that someone else has already used, is not shown the shop's name.

If an invitation link is opened in a web browser instead of the App, it loads a page at jugscope.com/invite that runs no scripts or analytics and tells the browser not to pass the address on to other sites. As with any web address, the link, including its code, reaches our web host and can stay in that browser's history.

Link and request records are deleted automatically about 30 days after the link expires or is cancelled, or after the request is approved, declined, withdrawn, or expires. Closing a shop cancels its open links and waiting requests at once. Deleting your account deletes every link you created and every request you made, and removes your account from any approval or decline you recorded.

9b. Shop Plan Welcome Email

When you start a Shop plan, we send one welcome email to the email address Apple shared with us when you signed in (§1). It is sent after the App confirms your purchase with our server, and an account receives it at most once. It is not sent for a Shop plan shared with you through Family Sharing, or to accounts that already had a Shop plan before this email was introduced.

The email contains fixed setup steps (creating your shop and inviting your mechanics), a link to jugscope.com/support, and, once the shop web portal is available to you, the portal's address. It contains no images or tracking pixels, and no shop name, price, account identifier, or invitation link, and we do not ask our email provider to track opens or clicks. It is sent from a Jug Scope address, through our email provider Resend (see Third-Party Services). Because it is a one-time message about the plan you bought, not marketing, it has no unsubscribe link.

If you signed in with Hide My Email, the address Apple shared with us is a private relay address. We send the welcome email to that relay address, and Apple forwards it to you, so we never learn your personal address. Apple forwards relay mail only from senders registered with it, and we have registered our sending domain with Apple.

Our record of this email holds your account, which Shop plan started it, when, and whether it was sent. It does not store your email address or the message. If the email cannot be sent, we may try again within 30 days, up to five times. The record is deleted when you delete your account.

9c. Inspections a Shop Keeps After You Delete Your Account

If you delete your account, inspections you captured that are already in a shop's hands stay with that shop as its records. "In a shop's hands" means the shop holds the inspection, or you sent it directly to the shop and did not revoke the share. This does not apply to a shop that closes because you were its only owner when you deleted your account. When a shop closes, whether its owner closes it or its only owner deletes their account, we open an internal support record that holds the shop's identifier, the date, whether it had a paid plan, and how many members it had, but no names or contact details; our support inbox is notified, and the record is deleted after 180 days.

• What the shop keeps — the inspection and its photographs, with the tail number, dates, engine and cylinder details, engine serial number, Hobbs and tach hours, and your notes. Inspection shares that you or the shop sent on the shop's behalf, including shares to its customers, keep working.
• What is removed — the inspection and those shares are re-attributed to "Former member," a placeholder that holds no name, email address, or account. Your account, and the purchase and device markers recorded when the inspection started, are removed from the inspection. Each kept photograph is saved again with its GPS location, camera make and model, software, and other device details stripped out; the image itself is not changed. A photograph we cannot reliably strip is deleted instead of kept. Web links you created for a shop's customers are deleted with your account.

Everything else you captured is deleted from our servers as described under Data deletion. The Delete Account screen in the App tells you, before you confirm, whether this applies, and we follow the rule that screen showed you even if your deletion has to be retried later.

9d. People a Shop Records Who Do Not Use Jug Scope

A shop can record an aircraft owner's or customer's name, email address, and phone number in Jug Scope, and link that person to an aircraft the shop works on, for example to send them an inspection or a web link (§9), or to ask them to share that aircraft's records with the shop in Savvy Aviation. That person may never have used Jug Scope, and we did not get these details from them. We store what the shop recorded, and which account in the shop recorded it. Every email we send to such a person says that a maintenance shop recorded their contact details and tells them how to have them removed.

The shop and Airworthy Labs each have a part in this. The shop decides whether to record you and what to record, and no other shop can see what it recorded. Airworthy Labs stores those details for the shop, sends any email to you through Resend, and runs the page described below. If you want to know why a particular shop recorded you, ask that shop, or contact [email protected].

Anyone a shop has recorded can see what we hold at their email address, and have it deleted, at api.jugscope.app/data-request, without signing in. Enter the email address, and if a shop has recorded it, or a close variant of it (with different capital letters, or a +tag), we email a separate code to each one. A code works for 15 minutes, or until you use it to delete, and can show your records up to ten times. With it you can see the records every shop holds for that address and delete them from every shop at once. The page accepts email addresses only; if a shop recorded only your phone number, contact [email protected] to make the request.

Deleting cannot be undone. It acts on the email address the code was sent to, as the shop recorded it, at every shop that recorded that address, all at once. A close variant of the address has its own code, and is deleted with that code. Deleting removes your contact record at each of those shops, with your name, email address, and phone number, and the index we use to look up that address and phone number. It cancels any inspection a shop was sending to that address that was still waiting for a shop owner’s approval, and deletes any notice we hold about a send to that address that a shop owner approved or declined.

Some records are part of a shop’s own maintenance history. The shop keeps them, with your details taken off:

• Aircraft entries — the shop keeps its entry for each aircraft it linked you to: the tail number, the label it gave the aircraft, the make, model, and engine details, and its notes on the work. Only your link to the entry is removed. The notes and labels are the shop’s own writing and may mention you, for example by name. Jug Scope does not edit them; to have something in them changed, ask that shop.
• Savvy Aviation requests — a request the shop made through Jug Scope for you to share an aircraft’s records in Savvy Aviation is closed and no longer names you. The shop keeps a record that it asked. This does not change anything you set up in Savvy Aviation itself; if you added the shop to your aircraft there, remove it there.
• Web links — a web link a shop made in Jug Scope and attached to your record is turned off and stops working. The shop keeps a record that it sent the link, with no personal details attached.

If a shop sent an inspection to that address and nobody has claimed it yet, we remove the address from it, and any claim link sent for it stops working. Nobody can claim it after that; to receive it, ask the shop to send it again. If the inspection has already been claimed into a Jug Scope account, by you or by anyone else, it keeps the address it was sent to. It now belongs to that account, and is removed when that account is deleted. If no shop has recorded your address as a customer, this page cannot find an inspection sent to it; to have the address removed, contact [email protected].

Deleting does not delete the inspections themselves, or any email, printout, or paperwork a shop has already sent you or kept. It does not reach anything outside our database: copies on a shop’s own devices, emails already delivered, or the records Resend, which delivers our email, keeps under its own policy. If a shop takes you off its own customer list, we keep the details, and that shop can still look them up, until you delete them here; we keep them so that this page can still find them for you. How long we keep the records of a request, and what we keep as proof that a deletion happened, is set out under Data Retention.

10. Aircraft Registry Lookup (FAA)

When you type an aircraft tail (N-)number into the aircraft form and either move to the next field or submit the form, the App automatically looks up that tail number against the FAA aircraft registry, via Airworthy Labs' own lookup service (not a direct connection to the FAA). This is automatic — it is not something you separately choose to trigger — and happens whenever you finish entering a tail number in that form, whether or not you use the suggested result. The tail number you entered is sent to our lookup service and is recorded in our operational logs (aggregated as lookup success/failure/latency counts) to help us monitor the service; no other personal information is included in that request.

11. Savvy Aviation Integration

If you connect a Savvy Aviation account, the App automatically checks Savvy for a summary of an aircraft's engine-monitor and inspection data whenever you open that aircraft's Tail Detail screen — this lookup happens on screen load, not only when you choose to upload an inspection. Results are cached locally for up to 24 hours between lookups. When you choose to upload an inspection to Savvy, the App sends your Savvy account token, the Savvy aircraft ID, the inspection title and date, Hobbs and tach hours, cylinder count, any free-text notes you enter, and who is sending the set — Owner or Mechanic, sent as Savvy's submitted_by field. The App asks that question the first time you send to Savvy and remembers your answer for your account on that device; you can change it before each send; if you request an analysis from Savvy, the App also sends free-text subject and body fields describing what you'd like reviewed. Image bytes are uploaded directly from your device to a Savvy-issued Amazon S3 storage URL, not routed through Airworthy Labs' own servers. Savvy Aviation's handling of this data is governed by Savvy Aviation's Privacy Policy.

12. Voice Commands (Microphone and Speech Recognition)

If you enable voice-activated capture, the App uses your device's microphone and Apple's on-device Speech Recognition framework to detect a small set of spoken commands ("Shoot," "Next," "Back") during an inspection. This processing happens entirely on your device; no audio is sent to Airworthy Labs or to any external server. You can disable this at any time by revoking Microphone or Speech Recognition permission in iOS Settings  ›  Privacy & Security  ›  Jug Scope.

13. Data Export Files (.jugscope / ZIP Archives)

The App lets you export an inspection, an aircraft's full history, or your full dataset as a .jugscope archive (a ZIP file containing a manifest and your images), which you then share yourself via AirDrop, Mail, Files, or another app of your choosing. These exports include every capture in the exported scope, including captures you have marked hidden within the App (hidden captures are flagged as such in the manifest so the hidden state survives a round-trip back into the App) — hiding a capture in the App does not exclude it from an export you create. Airworthy Labs does not receive a copy of these export files unless you separately choose to send one to us (for example, by attaching it to a support email); creating and sharing an export is entirely under your control. The one-time offer to save Recovered Photos as a Jug Scope file (§3) creates the same kind of file. It is your own copy, and Airworthy Labs does not receive it.

14. Beta Program Registration (In-App, Builds 81 and Earlier)

The current App has no registration form: you sign in with Apple and nothing else is asked (§1). Builds 81 and earlier — older builds that may still be installed on some devices — can show a registration form on a fresh install until those builds expire. That form sends your name, email, install identifier, and device model, along with your role (owner/mechanic/shop), fleet size, typical inspection method, and a description (including free text) of your current borescope hardware, plus the app version and build. It is stored in Apple CloudKit and in our Cloudflare D1 database. Existing registration records are kept, and are erased when you delete your account or request deletion.

15. Beta / Waitlist Application (Website)

The website beta application form is closed, and the endpoint that received it now refuses every submission. When it was open, the form collected your first and last name, email, phone number, your Apple Account email (if different), your role, tail number(s), engine type, current borescope, fleet size, inspections per year, aircraft count, Savvy subscriber status and level, and how you heard about us. Those submissions were stored in an Apple CloudKit database used to manage applications, and each one generated a notification email to Airworthy Labs through Resend (see Third-Party Services below). No new notifications are sent now that the form is closed.

The application records submitted while the form was open are retained while Airworthy Labs decides what to do with them. This application store is separate from the in-App registration described in §14. Its records are readable only by Airworthy Labs’ own server; other iCloud users cannot read them. It has no self-service or automated deletion endpoint; if you want a record you submitted through this website removed, contact us and we will remove it manually.

Marketing Communications

Today, Airworthy Labs does not send automated marketing email campaigns — there is no win-back offer or re-engagement email currently implemented. Email is used operationally: to send you a magic sign-in link when you authenticate; if you start a Shop plan, to send you one welcome email with setup steps (§9b); where that notice is turned on, to tell you whether a share you sent was approved or declined; to send messages to people a shop has recorded, including data-request codes (§9d); and to alert our own support inbox to a closed shop or an account deletion that needs attention, with no name or address in the message. While the website beta application form was open, an internal notification was also generated for us (see §15) rather than a marketing message to you. TestFlight build availability is delivered by Apple through the TestFlight app itself, not by an Airworthy Labs email.

If we introduce automated marketing communications in the future, we expect them to draw on the following categories of data, and every such email will include an unsubscribe link and, where required by law, will only be sent with your consent:

• Email address — release announcements, feature updates, beta program updates
• Purchase data — for example, a subscription renewal reminder or a lapsed-subscription win-back offer
• Usage patterns — for example, a re-engagement message based on in-app activity

Every marketing email we send, now or in the future, will include an unsubscribe link in compliance with CAN-SPAM. To opt out at any time, use the unsubscribe link in any marketing email or contact [email protected].

What We Do NOT Do

• No third-party advertising SDKs or ad networks in the App
• No data shared with data brokers or sold to third parties
• No tracking across other apps or websites
• No borescope video recordings uploaded — recorded video is processed entirely on-device and is never uploaded as a video file (if you enable diagnostic uploads, a forensic report may include a small byte-limited fragment of a camera endpoint's output, as described in §8)
• No payment card information collected or stored by Airworthy Labs

Note: an earlier version of this policy stated that no location data is stored in CloudKit. That was inaccurate as it applies to your image files — as described in §3 and §5, GPS coordinates embedded in an image's EXIF metadata are present in your private CloudKit container along with the image itself, because the image file (not just a separate structured field) is what CloudKit stores.

Third-Party Services

The App and website use the following third-party services:

• Apple iCloud / CloudKit — inspection data storage and sync — Apple Privacy Policy
• Apple StoreKit — in-app purchase processing — Apple Privacy Policy
• Apple Sign In — account authentication — Apple Privacy Policy
• Cloudflare Workers — entitlement verification, analytics, and upload APIs — Cloudflare Privacy Policy
• Cloudflare R2 — storage for diagnostic logs, connection-troubleshooting (forensic) reports, opt-in inspection images, and cloud-library capture copies — Cloudflare Privacy Policy
• Cloudflare D1 — database for opt-in usage analytics and entitlement records — Cloudflare Privacy Policy
• Cloudflare Turnstile — bot protection on the website beta application form while it was open (§15). The form is closed, so no new challenge data is processed. Airworthy Labs did not store any data from this challenge; Cloudflare received the visitor's IP address and device/browser signals to perform it — Cloudflare Privacy Policy
• Cloudflare Web Analytics — website visitor analytics (this website and our company website, airworthylabs.com, which is also served at airworthylabs.app, where it runs in the same way; in this policy, “airworthylabs.com” includes airworthylabs.app; not the App). Cloudflare adds a small script to every page of both websites, and the script runs as soon as a page loads, without waiting for your analytics choice. On the invitation pages at jugscope.com/invite (§9a), the page's own security settings stop your browser from loading the script, so it sends nothing from those pages. Elsewhere, the script loads from static.cloudflareinsights.com and reports the page you viewed (its path, without any query string), the site that linked you here, page-load and performance timings, and your browser, operating system, and device type; Cloudflare also records the country you visited from. As with any web request, Cloudflare receives your IP address when your browser loads the script. Cloudflare states that Web Analytics uses no cookies or local storage, and that it does not fingerprint visitors by their IP address, browser details, or any other data for the purpose of displaying analytics. Cloudflare provides it as our processor (service provider) under its data-processing terms. The Cookie choices link does not control it on either website — Cloudflare Privacy Policy
• Amazon S3 — used by Savvy Aviation to receive image uploads directly from your device when you upload to Savvy (see §11); Airworthy Labs does not operate this storage — Amazon Privacy Notice
• Savvy Aviation — optional user-initiated inspection upload and automatic tail-summary lookups — Savvy Aviation Privacy Policy
• Resend — email delivery for sign-in magic links, the one-time Shop plan welcome email (§9b), and website beta-application notifications while that form was open (§15) — Resend Privacy Policy
• Google Analytics (GA4) — website visitor analytics only (this website, not the App). GA4 loads on this website only after you choose Allow in the analytics banner; until then no request goes to Google Analytics and no Google Analytics cookie is set. Your choice is stored only in your browser, on this website (the answer and the date you gave it), is never sent to us, and can be changed at any time through Cookie choices at the bottom of every page; withdrawing stops GA4 and removes its cookies. airworthylabs.com, our company website, uses its own Google Analytics property, separate from this website's. It loads only after you choose Allow in that site's banner; until then no request goes to Google Analytics and no Google Analytics cookie is set. Cookie choices at the bottom of its pages lets you change that choice; withdrawing stops Google Analytics there and removes its cookies. Your choice there is stored only in your browser, separately from your choice on this website. Google Signals and ad personalization are off on both websites. — How Google uses information from sites that use its services; Google Privacy Policy

Email through Resend. Resend also delivers share-outcome notices where that notice is turned on, messages to people a shop has recorded and data-request codes (§9d), and alerts to our own support inbox (see Marketing Communications). Resend receives each recipient's email address, including the addresses of people who do not use Jug Scope.

Third parties that process your data on our behalf are expected to protect it consistent with this policy and applicable law, and we do not authorize any of them to use your data for purposes beyond what is described here and in their own linked privacy policies.

Data Retention

• Aircraft and inspection data (including image files and their EXIF metadata) — until you delete it from iCloud
• Photo Library copies you export — not managed by the App once exported; retained until you delete them yourself from the Photos app (see §4a)
• Usage analytics (opt-in) — the Cloudflare D1 usage events are auto-deleted after 30 days; the mirrored Apple CloudKit copies (raw events and the derived per-session summaries) and the public-dashboard summary snapshot on R2 are not deleted on a timer. We erase the CloudKit copies when you delete your account, but for accounts dormant more than 30 days a small pseudonymous residual copy may remain, because the record used to locate those copies has itself been purged (see §7)
• Diagnostic logs, connection-troubleshooting (forensic) reports, and their tail numbers — 30 days on Cloudflare R2, then auto-deleted; also erased when you delete your account, whichever comes first
• Reports waiting to send — held on your device only, until sent; deleted after 7 days unsent, when you sign out, or when you delete your account; you can delete them sooner in Settings › Troubleshooting
• Opt-in shared inspection images and Jug Scope Cloud copies — kept until you delete them or delete your account; not auto-deleted on a timer while you keep them. When you delete a photo, its copy is kept for 90 days so it can be recovered by contacting support, and then its image file is permanently deleted. Shared diagnostic copies you erase in Settings are deleted immediately (see §4). Metadata carried by images uploaded by earlier app versions (which may include Apple account ID, email, and name) is retained alongside those images, and their recovery copies, until they are deleted
• Records of deleted photos — after a recovery copy's image file is permanently deleted, a record of the deletion (Apple account identifier, original file name, tail number, and inspection and capture identifiers, with no image) is kept until you delete your account
• Erasure logs — the log of diagnostic-image erasures (when, and how many items, under a one-way code derived from your account identifier or the aircraft's tail number, with no images) and the log of authorized erasures (your account recorded as a one-way code derived from your account identifier) are kept indefinitely and are not erased when you delete your account; deleting your account adds an entry to each
• Data-request records (the page that lets anyone a shop has recorded see or remove those details) — the email address a request was made for, the address we sent the code to, and the code (which we store only in scrambled, hashed form), are deleted from our database within three hours of the request. Resend, which delivers the message, keeps its own copy under its own policy (see Third-Party Services and §9d)
• Proof that a removal happened — when you remove your details through that page, we keep a fingerprint of the email address in our deletion log, made with a secret key, as proof that the removal was carried out. It is not the address itself and cannot be turned back into it; but if we are asked whether a particular address was removed, we can check that address, spelled as the shop recorded it, against the fingerprint. It is kept indefinitely and is not erased by the removal it records
• Shop invitation links and requests to join — deleted automatically about 30 days after the link or request ends; deleted at once when you delete your account; cancelled when the shop closes (see §9a)
• Shop plan welcome email record — kept with your account (no address or message is stored); deleted when you delete your account (see §9b)
• Inspections kept by a shop after you delete your account — kept by that shop as its records, re-attributed to “Former member” with your account and the photographs’ device details removed (see §9c)
• Customer web links — work until the shop’s chosen expiry (at most 90 days), until turned off, or until the shop closes, whichever comes first; a link a shop attached to the record of someone it recorded is also turned off if that person deletes their details, and the shop keeps a record that it sent the link, without that person’s details (§9d); links you created are deleted when you delete your account (see §9, §9c)
• Cross-shop shared inspections — revoking a share stops it from being usable immediately, but the recipient contact address, the image-share record, and the underlying images are not immediately purged (see §9)
• Beta program registration (in-App, builds 81 and earlier) — existing records are kept until you delete your account or request deletion (see §14)
• Beta / waitlist application (website) — the form is closed; records already submitted are retained while Airworthy Labs decides what to do with them, and are removed on request, manually, as this store has no deletion endpoint (see §15)
• In-app purchase / entitlement records and the export-credit ledger — payment is managed by Apple; Airworthy Labs stores your entitlement records (transaction ID, product, status, expiry) and export-credit ledger entries (inspection ID, account, amount, reason) durably to enforce your subscription and unlocks and to restore purchases across devices, and deletes them when you delete your account, except the purchase records in §6 (the Apple original transaction ID, and for most purchases a one-way code for the account that held it, with no name, email address, or Apple account identifier), which we keep with no time limit to prevent fraud and to protect the purchaser. We also keep, with no time limit, a one-way fingerprint of each photo in a paid inspection, with the inspection ID and the date, so that a shared paid set is never charged twice. The fingerprint contains no personal data and cannot be turned back into the photo, and when you delete your account we remove the link to your account from it (§6)
• Data export files (.jugscope / ZIP) — live on your device and wherever you choose to send them; Airworthy Labs holds no copy unless you separately send us one (see §13)
• Website analytics and bot-protection data (Google Analytics, only after you allow it; Cloudflare Web Analytics, on every page except invitation pages, and also on airworthylabs.com; Cloudflare Turnstile, while the application form was open) — we do not set a custom retention period; these providers apply their own standard retention schedules under their respective privacy policies. Cloudflare keeps Web Analytics records in full for 7 days and then keeps an aggregated sample. Your analytics choice, on this website and on airworthylabs.com, stays in your browser for 12 months, or until you change it or clear your browser's site data; after that we ask again.
• Operational request logs (Cloudflare, our API backend) — client IP address, requested object keys, and request metadata may be captured in standard operational logging at the infrastructure layer; we do not extend Cloudflare's own log retention beyond its standard schedule

Your Rights and Controls

• Usage analytics — off by default; enable or disable at any time in Settings
• Image sharing and cloud upload — off by default; controlled by the Share capture data setting, the Auto-upload new captures to Cloud setting (with the Move to Cloud action for existing captures), and by whether you choose to send or accept a cross-shop inspection share
• Photo Library — the App writes there only when you export to Photos; revoking the Photos permission in iOS Settings stops future exports, but does not remove copies already exported (see §4a)
• Website analytics — GA4 loads only after you choose Allow; change your choice at any time through Cookie choices at the bottom of any page. Cloudflare Web Analytics is not covered by that choice and runs when a page loads on either website (see Third-Party Services); a browser content blocker that blocks static.cloudflareinsights.com stops it
• Diagnostic uploads — off by default. When enabled, connection-troubleshooting (forensic) reports can upload automatically in the situations described in §8; turn the setting off to stop them. Separately, a report you choose to send (Send Diagnostic Report, or Send Report when the App asks) is sent once and does not turn the setting on
• Location embedding — disable by revoking location permission in iOS Settings
• Voice commands — disable by revoking Microphone or Speech Recognition permission in iOS Settings
• Marketing emails — unsubscribe via the link in any marketing email, or email [email protected]
• If a shop recorded your details — see or delete what we hold at your email address at api.jugscope.app/data-request, or email [email protected] about a phone number (see §9d)
• Data deletion — delete individual inspections, aircraft profiles, or your entire account from within the App; or contact [email protected] to request complete account deletion within 30 days. A photo you delete that was stored in Jug Scope Cloud can be recovered for 90 days by contacting support (see §4). Deleting your account is designed to erase the data Airworthy Labs holds: your analytics records (the Cloudflare D1 rows, including usage events, and the mirrored Apple CloudKit analytics copies), your opt-in inspection-image and Jug Scope Cloud copies in Cloudflare R2, including any copies still in the 90-day recovery area, your diagnostic logs and forensic reports, and your in-App beta registration record (builds 81 and earlier, §14). It also immediately voids the sign-in session token your device is holding. The core deletion — your Cloudflare D1 records and the inspection images stored under your account prefix — is applied directly and is the reliably-completed part. Erasing the copies that live in separate services (the Apple CloudKit analytics copies and the opt-in diagnostic-image storage) is performed on a best-effort basis: it is the intended behavior, but it depends on those services being reachable and provisioned, so in rare cases a copy may persist until a later cleanup. As noted in §7, for accounts dormant more than 30 days a small pseudonymous analytics residual may remain. The website beta-application store (§15) is not part of this automated flow; a record there is removed on manual request. Your inspection records in your private iCloud are stored under Apple's infrastructure, not on Airworthy Labs' servers (see §3), and stay under your control until you delete them — from within the App or from your iCloud account. Inspections you captured that are already in a shop's hands stay with that shop, without your name, account, or the photographs' device details (see §9c). Inspections you sent on a shop's behalf that someone else captured also stay with whoever you sent them to, shown as from "Former member", without your name or account. Two erasure logs are not erased, because they record the erasures themselves: they hold one-way codes derived from your account identifier or a tail number, times and counts, never images (see §4 and Data Retention). The purchase records described in §6 are also kept, with no time limit, to prevent fraud and protect the purchaser; they hold no name, email address, or Apple account identifier.

International Data Transfers

Airworthy Labs LLC is based in Texas, USA. The service providers listed above — Apple, Cloudflare, Amazon Web Services, Savvy Aviation, Resend, and Google — are U.S.-based companies, and your data may be processed on servers located in the United States or in other countries where these providers or their global infrastructure operate, regardless of where you access the App or website from. If you are located outside the United States, this means your personal data may be transferred to, stored in, and processed in the United States and other jurisdictions that may have data protection laws different from those of your home country. Each provider maintains its own data-processing terms and safeguards, described in the privacy policies linked above.

GDPR / UK GDPR

Under the EU GDPR and UK GDPR, we process personal data only where we have a lawful basis under Article 6. The bases below map to the processing this policy already describes. Where a feature is off by default or something you initiate, only the basis for that specific action applies.

• Account and authentication (Sign in with Apple) — §1, §2 — performance of a contract (Art. 6(1)(b)). Processing the email address Apple provides (the current App never requests your name), your CloudKit user record ID, the account owner hash, the raw Sign in with Apple identifier, and your session token is necessary to create your account, sign you in, and provide the App you have asked to use.
• Aircraft and inspection data in your private iCloud — §3, §5 — performance of a contract (Art. 6(1)(b)). Storing and syncing your aircraft profiles, inspection records, findings, notes, and borescope images (including any GPS EXIF they carry) delivers the core inspection function you request. This data lives in your private CloudKit container under Apple's infrastructure.
• In-app purchases, entitlements, and the export-credit ledger — §6 — performance of a contract (Art. 6(1)(b)). We process StoreKit receipts, the purchase-intent record (aircraft tail number and inspection ID), and entitlement and export-credit ledger entries to deliver the features you buy, unlock the correct inspection, and restore your purchases across devices. This includes the photo fingerprints in §6, which let a paid inspection be re-exported when shared without being charged twice.
• Optional cloud features you turn on or initiate — §4 (Share capture data, Auto-upload to Cloud, Move to Cloud), §4a (exporting to Photos), §9 (cross-shop sharing), §11 (uploading to Savvy, including the Owner or Mechanic choice), §13 (exports you create and send) — consent (Art. 6(1)(a)) for the settings you switch on, and performance of a contract (Art. 6(1)(b)) for a specific upload or share you actively initiate. Each of these is off or inert until you enable the toggle or take the action. You can withdraw consent by turning the setting off, which stops future uploads.
• Shop invitation links and requests to join — §9a — performance of a contract (Art. 6(1)(b)), to add a mechanic to the shop that invited them.
• Shop plan welcome email — §9b — performance of a contract (Art. 6(1)(b)), to help you set up the plan you bought.
• Inspections a shop keeps after you delete your account — §9c — legitimate interests (Art. 6(1)(f)): the shop’s interest in keeping the inspection records it received for aircraft it maintains. The kept copy is de-identified as §9c describes.
• Usage analytics in the App — §2, §7 — consent (Art. 6(1)(a)). Analytics, including the install identifier sent with them, are off by default and collected only after you opt in during onboarding or in Settings. You can withdraw consent at any time by turning analytics off; withdrawal does not affect the lawfulness of processing that already happened.
• Diagnostic logs and connection-troubleshooting (forensic) reports — §8 — consent (Art. 6(1)(a)), given per report when you choose to send one, or by enabling the diagnostic-uploads setting, which is off by default. Once you enable it, some forensic reports upload automatically in the situations described in §8; turning the setting off stops those automatic uploads.
• Beta program registration — §14 (in-App, builds 81 and earlier) and §15 (website, now closed) — consent (Art. 6(1)(a)). This information was provided voluntarily when applying to the beta program, and existing records are retained as §14 and §15 describe. As §15 discloses, the website application store is readable only by our own server and has no self-service deletion endpoint; you can withdraw and ask us to remove a submission by contacting us.
• Website analytics (Google Analytics) — consent (Art. 6(1)(a)). GA4 loads only after you choose Allow on this website or on airworthylabs.com; you can withdraw at any time through Cookie choices on that site, which stops GA4 and removes its cookies.
• Website analytics (Cloudflare Web Analytics) — legitimate interests (Art. 6(1)(f)): our interest in understanding traffic to this website and to airworthylabs.com, and how well their pages perform. It runs without waiting for your analytics choice, and it sets no cookies and stores nothing in your browser.
• FAA and Savvy aircraft lookups — §10, §11 — performance of a contract (Art. 6(1)(b)) for returning the lookup results you request as part of using the aircraft form and the Savvy integration, and legitimate interests (Art. 6(1)(f)) in monitoring and maintaining the reliability of our own lookup service through aggregated success/failure/latency logs. Our interest is keeping these features working; only the tail number is sent for the lookup itself.
• Security, fraud prevention, and service integrity — legitimate interests (Art. 6(1)(f)). We process operational request logs (client IP address, requested object keys, request metadata), bot-protection signals (Cloudflare Turnstile, while the website application form was open), rate-limiting data, and entitlement and session-management records to secure the service, prevent abuse and fraudulent or duplicate purchases, and keep the App reliable. Our legitimate interest is protecting the service and our users from abuse and error, and we limit this processing to what that purpose needs. This includes the purchase records in §6 that we keep, with no time limit, after you delete your account: the Apple original transaction ID of a purchase (with, for most purchases, a one-way code for the account that held it) so that a deleted account's purchase cannot be claimed by someone else and a purchase cannot be credited twice. They hold no name, email address, or Apple account identifier. This also covers the photo fingerprints in §6 that we keep, with no time limit, after you delete your account, so that a shared paid set is never charged twice. They contain no personal data and cannot be turned back into a photo, and we remove the link to your account. You can object to this under Your Rights and Controls.
• People a shop records who do not use Jug Scope — §9d — legitimate interests (Art. 6(1)(f)): a shop’s interest in recording its own customers and mechanics so it can deliver inspection results and run its business, and our interest in holding that contact information for the shop. You can object, or ask for erasure, at api.jugscope.app/data-request (see §9d).
• Operational and marketing email — performance of a contract (Art. 6(1)(b)) for the magic sign-in link we email when you authenticate and the one-time Shop plan welcome email (§9b), and consent (Art. 6(1)(a)) for any future marketing email, which is not sent today and would include an unsubscribe link (see Marketing Communications).
• Voice commands — §12 — processed entirely on your device using Apple's frameworks. No audio is transmitted to us, so we carry out no server-side processing of this data.

Where we rely on legitimate interests, you have the right to object (see below), and we will stop unless we can show compelling legitimate grounds that override your interests. Where we rely on consent, you can withdraw it at any time without affecting processing that occurred before withdrawal.

We honor data access, correction, and deletion requests now, and give EU and UK users the following rights:

• Access, rectification, and erasure — EU and UK users may request a copy of their data, ask us to correct it, or ask us to delete it, by contacting [email protected]
• Data portability — you can export your own inspection data at any time using the App's built-in export feature (see §13); you may also request an export directly from us
• Restriction of processing and objection — you may ask us to pause specific processing (for example, analytics or marketing) while a request is resolved, or object to processing based on legitimate interest, by contacting us at the address above
• Withdrawing consent — where processing depends on your consent (for example, usage analytics or marketing email), you can withdraw it at any time using the in-App toggle or the marketing unsubscribe link, without affecting the lawfulness of processing before withdrawal
• Automated decision-making — we do not make decisions producing legal or similarly significant effects about you based solely on automated processing
• Complaints — you have the right to lodge a complaint with your local data protection supervisory authority if you believe we have not handled your data lawfully

We do not currently actively market Jug Scope to EU/UK users.

CCPA / CPRA (California)

This is our notice at collection under the California Consumer Privacy Act, as amended by the CPRA. It describes the categories of personal information we collect, where it comes from, and why. The section reference after each category points to the full detail; retention for each category is described in the Data Retention section above.

Categories of personal information we collect, mapped to CCPA statutory categories:

• Identifiers — your email address (from Sign in with Apple), your name (from the registration in builds 81 and earlier or the closed website application, or a display name shown when you share, §9), your Apple account identifier, the account owner hash, your CloudKit user record ID, a per-install UUID (sent with opt-in usage analytics), your device model, the name, email address, or phone number of someone you share with or invite or that a shop records (§9d), and the IP address that may be captured in operational logs (§1, §2, §9, §9d, §14, §15). Purpose: create and secure your account, sign you in, route your uploads and lookups, operate the service, and, if you turn on usage analytics, link those events to your account (§7).
• California customer-records information (Civ. Code §1798.80) — email address; name and phone number where older registrations or the closed website application collected them; and the name, email address, or phone number of someone you share with or invite or that a shop records (§1, §9, §9d, §14, §15). Purpose: account communications, routing shares and invitations, any marketing email described under Marketing Communications, and, for past beta applicants, the retained application records.
• Commercial information — subscription and entitlement records, the purchase-intent record (tail number and inspection ID), export-credit ledger entries, and photo fingerprints of paid inspections (§6). Purpose: deliver, unlock, and enforce the features you buy, and restore purchases across devices. Purchase data may also inform marketing email, such as a renewal reminder, as described under Marketing Communications.
• Internet or other electronic network activity — opt-in usage analytics events and their metadata, opt-in diagnostic logs and connection-troubleshooting reports, and aircraft-lookup requests (§7, §8, §10, §11); and, on this website and on airworthylabs.com, the pages you view, the site that linked you here, and the browser, device, and performance data Cloudflare Web Analytics collects (see Third-Party Services). Purpose: in the App, only if you opt in, to understand feature usage and diagnose connection problems; on this website and on airworthylabs.com, to understand traffic and page performance; opt-in usage data may also inform marketing email as described under Marketing Communications; lookups return the aircraft data you request.
• Geolocation data — precise GPS coordinates embedded in an image's EXIF metadata, only if you grant location permission (§5). Purpose: record where an inspection was performed. This data travels inside the image file, not as a separate feed.
• Audio and visual information — the borescope images you capture and, in the opt-in or user-initiated upload paths, the copies you send us (§3, §4, §9). Voice-command audio (§12) is processed on your device and is not collected by us. Purpose: the inspection-record function you use the App for and, for copies you choose to share with Share capture data, improving image quality and providing support (§4).
• Professional or employment-related information — whether you send a Savvy upload as Owner or Mechanic (§11); and your role, fleet size, typical inspection method, and current borescope hardware if you registered in builds 81 and earlier or applied through the closed website form (§14, §15). Purpose: label your Savvy uploads as you choose; operate and evaluate the beta program.

Sensitive personal information. Precise geolocation is "sensitive personal information" under the CPRA. We collect it only as EXIF embedded in your images when you grant location permission, and we use it only for the disclosed purpose above — recording where an inspection took place. We do not use or disclose sensitive personal information to infer characteristics about you, so the right to limit its use does not change how we handle it beyond what is described here. Your session token functions as an account log-in credential and is used only to authenticate you. Your Apple sign-in identifier also keys your account, purchase, and shop records and, if you turn on usage analytics, links those events to your account (§2, §7).

Sources. We collect this information from you directly, from your device and its network environment, and from Apple (Sign in with Apple and StoreKit).

Business and commercial purposes. We use the categories above to provide and secure the App and website, complete transactions, provide support, diagnose problems (opt-in), understand feature usage (opt-in), understand website traffic and performance, prevent fraud and abuse, and comply with law. Marketing Communications describes the marketing email we may send and the data it may draw on.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising, as those terms are defined in the CCPA/CPRA. The App contains no third-party advertising SDKs or ad networks and does no cross-app or cross-site tracking (see "What We Do NOT Do"). We have not sold or shared personal information in the preceding 12 months, and we do not sell or share the personal information of consumers we know to be under 16.

California residents have the following rights, which we honor:

• Right to know and access — you may request the categories and specific pieces of personal information we have collected about you, the sources, the purposes, and the categories of third parties with whom we share it, by contacting [email protected]
• Global Privacy Control (GPC) — this website does not yet automatically detect and act on a GPC browser signal; because we do not sell or share personal information as described above, there is currently nothing a GPC opt-out would change, but you may still contact us with any request
• Access, correction, deletion, and portability — California residents may request access to, correction of, deletion of, or a portable copy of their personal data by contacting [email protected]. We honor these requests today
• Authorized agent — you may designate an authorized agent to submit a CCPA request on your behalf by having them contact us with written proof of your authorization
• Non-discrimination — we will not deny you goods or services, charge you a different price, or provide a different level of service because you exercised a CCPA right

Apple App Store Guideline 5.1.1

Where a third party processes personal data on our behalf as described in this policy, we require that processing to remain consistent with the protections described here; we do not permit a third-party processor to use data collected through the App for its own independent purposes beyond providing the service to us (for example, Savvy Aviation's use of data you affirmatively upload to Savvy is governed by Savvy's own privacy policy once it reaches them, as noted in §11).

Children's Privacy

Jug Scope is designed for adult aircraft owners and mechanics. We do not knowingly collect personal information from children under the age of 13.

Changes to This Policy

We may update this policy from time to time. The effective date at the top reflects the most recent revision. Material changes will be communicated via the App or by email.

Contact

For privacy questions, marketing opt-out, or data deletion requests:

[email protected]

Airworthy Labs LLC
4702 Colchester Way
Missouri City, TX 77459-2716