Privacy Policy

Last updated: April 2026

1. Controller

The data controller responsible for this website is:

AleaNCore GmbH
Germany
Email: info@hobbsmd.app

For all data protection enquiries, including requests to exercise your rights, please contact us at info@hobbsmd.app.

2. What data we collect and why

When you use HobbsMD we collect only the data necessary to provide the service. We do not sell personal data, serve advertisements, or use tracking analytics.

Data	Purpose	Legal basis
Email address, display name	Account creation and authentication	Art. 6(1)(b) GDPR — performance of contract
Password (stored as PBKDF2-SHA256 hash only — plaintext is never retained)	Secure account access	Art. 6(1)(b) GDPR
Aircraft details (tail number, engine type, fuel system, hours)	Associate engine data with the correct aircraft for trend analysis	Art. 6(1)(b) GDPR
JPI engine monitor data (CHT, EGT, oil temperature/pressure, fuel flow, RPM — uploaded by you)	Compute engine health statistics and generate AI-powered debrief	Art. 6(1)(b) GDPR
Pilot remarks (optional free-text notes you enter per flight)	Provide context to the AI analysis	Art. 6(1)(b) GDPR
Session cookie (`hmd_session`)	Keep you signed in across page loads. Strictly necessary — see Section 5.	Art. 6(1)(b) GDPR

3. How long we keep your data

We retain your account, aircraft, and flight records for as long as your account is active. If your account has not been used for 3 consecutive years, we will delete your data automatically. You may also request deletion at any time (see Section 8).

Uploaded JPI files are processed in memory and written to a temporary file solely to parse the binary format. The temporary file is deleted immediately after parsing is complete — it is never permanently stored on our servers.

4. Third-party AI sub-processors

To generate engine health analysis, we send a structured summary of your flight statistics (no raw JPI bytes, no personally identifying information beyond the aircraft tail number you entered) to one of the following AI providers. The active provider is configured server-side; only one provider is used per analysis request.

Provider	Data sent	Country	Basis for transfer
Anthropic, PBC Privacy policy	Flight statistics summary, aircraft type, flight history summary, pilot remarks	United States	Standard Contractual Clauses (SCCs, Art. 46(2)(c) GDPR)
Google LLC (Gemini API) Privacy policy	Flight statistics summary, aircraft type, flight history summary, pilot remarks	United States	Standard Contractual Clauses (SCCs, Art. 46(2)(c) GDPR) — Google Cloud Data Processing Amendment
DeepSeek (Hangzhou DeepSeek Artificial Intelligence Co., Ltd.) Privacy policy	Flight statistics summary, aircraft type, flight history summary, pilot remarks	China (not an EU-adequate country)	Standard Contractual Clauses (SCCs, Art. 46(2)(c) GDPR). Note: DeepSeek is used only as an automatic fallback if the primary provider is temporarily unavailable. The data transferred is limited to anonymised flight statistics and does not include your name or email address.

Our hosting provider is OVH SAS (France, EU), which processes your data on our behalf under a data processing agreement. No personal data leaves the EU via OVH.

5. Cookies

HobbsMD uses exactly one cookie:

Name	Purpose	Duration	Type
`hmd_session`	Keeps you authenticated after login. Contains a signed session token — no personal data.	30 days or until you sign out	Strictly necessary — no consent required under ePrivacy Directive

We do not use analytics cookies, advertising cookies, or any third-party tracking scripts. No cookie consent banner is displayed because strictly necessary cookies are exempt under Art. 5(3) of the ePrivacy Directive.

6. Your rights

Under the GDPR you have the following rights regarding your personal data:

Right of access (Art. 15) — request a copy of the data we hold about you.
Right to rectification (Art. 16) — ask us to correct inaccurate data.
Right to erasure (Art. 17) — ask us to delete your account and all associated data.
Right to restriction (Art. 18) — ask us to restrict processing in certain circumstances.
Right to data portability (Art. 20) — receive your data in a structured, machine-readable format.
Right to object (Art. 21) — object to processing based on legitimate interests.
Right to withdraw consent (Art. 7(3)) — where processing is based on consent, withdraw it at any time without affecting prior processing.

To exercise any of these rights, email info@hobbsmd.app. We will respond within 30 days.

7. Right to complain

You have the right to lodge a complaint with a supervisory authority. As AleaNCore GmbH is based in Germany, the competent authority is:

Der Bundesbeauftragte für den Datenschutz und die Informationsfreiheit (BfDI)
Graurheindorfer Str. 153, 53117 Bonn, Germany
www.bfdi.bund.de

You may also complain to the supervisory authority of your country of residence or workplace.

8. Changes to this policy

We will update this policy when our practices change. The date at the top of the page always reflects the most recent revision. Continued use of the service after an update constitutes acceptance.