Privacy Policy

Last updated: 30 October 2026

1. Who is responsible for your data

Airline Legend is operated by Object IT Limited (NZBN 9429031476065), a company registered in New Zealand ("the Operator", "we", "us"). The Operator is the controller responsible for personal information handled through the Service and complies with the New Zealand Privacy Act 2020. Where the EU/UK General Data Protection Regulation (GDPR) applies to our handling of your data, the Operator acts as the data controller. This policy explains what we collect, why, and your choices. To contact us about privacy, use the Contact us page.

2. Information we collect

You give us:

Account details — your email address and, if you register with a password, a securely hashed password (we never store your password in plain text).
Single sign-on (SSO) — if you sign in with a provider such as Google or Microsoft, we receive a provider account identifier and your email address from that provider so we can create and link your account. We do not receive your provider password.
Messages — anything you send us through the contact form or support.
Profile and gameplay — your airline names, in-game choices, and Jet Coins balance and history.

We collect automatically:

Technical data — IP address, browser/user-agent, and basic log data, used to run the Service, keep it secure, and prevent abuse (including rate-limiting and anti-spam).
Sign-in audit — a record of sign-in attempts (time, IP, provider, success/failure) for security.

Children. The Service is not directed to children and we do not knowingly collect information from children under 13. If you are in the EU/EEA, you must be at least the age of digital consent in your country (between 13 and 16, depending on where you live); below that age, a parent or guardian must give consent. If you believe a child has given us personal information, contact us and we will delete it.

3. How we use your information and our legal basis

Where the GDPR applies, we rely on the legal basis shown next to each purpose:

Create and manage your account and sign you in (including via SSO) — performance of our contract with you.
Run the game, including Jet Coins and purchases — performance of our contract.
Reply to your messages — our legitimate interest in supporting users, or contract.
Keep the Service secure, prevent fraud and abuse, and enforce our Terms — our legitimate interest in a safe, working Service.
Analytics, advertising and any interest-based (profiling) advertising — in the EU/EEA, the UK, Switzerland, Turkey, Brazil, Canada, South Korea, China and India, your consent; elsewhere, our legitimate interest in understanding how the Service is used, which you can opt out of at any time (see section 9).
Meet legal obligations — compliance with a legal obligation.

Where we rely on consent, you can withdraw it at any time; this does not affect processing done before you withdrew.

4. Payments

Jet Coins can be bought with real money. Payments are handled by one of two providers, depending on the country of the billing address you give at checkout:

Lemon Squeezy LLC (United States) — for buyers in the EU/EEA, the United Kingdom, Norway and Switzerland. Lemon Squeezy is the merchant of record for those sales, which means it is the seller and an independent controller of the personal data it collects to complete and tax the sale; its own privacy policy applies to that processing.
Stripe, Inc. (United States) — for buyers everywhere else. Stripe processes those payments on our behalf, as our processor.

We never receive or store your full card number. Your payment details go directly to the provider. What comes back to us is only what we need to credit the purchase and keep lawful records: an order and transaction reference, the amount and currency, the outcome, the billing country (which decides which provider and which tax applies), and, where the provider gives it to us, the card brand and last four digits. Our legal bases are performance of our contract with you, and compliance with a legal obligation for the tax and accounting records we are required to keep.

5. Sharing your information

Other players. Other players see what you do in the game: your airline's name, code and results in the worlds you play, and your airline's name and results on leaderboards. Leaderboards never show your account name, username or email address; a name of your own appears there only if you add one and turn it on in your account settings. The top half of the monthly solo board, with those same names, is also shown on a public page that anyone can open without an account. On the forum you appear under that name, or as “pilot” and a number until you choose one.

We do not sell your personal information for money. We share it only with:

Service providers who host our infrastructure or send email on our behalf, under confidentiality obligations;
payment providers — Stripe and Lemon Squeezy, as described in section 4;
SSO providers you choose to sign in with, to authenticate you;
Google, which provides Google Analytics on our behalf and receives your IP address, device and browser information and analytics cookie identifiers (see section 9); and, if we introduce advertising, advertising partners, who may receive similar limited data to serve and measure ads — we do not share your name, email, or password with any of them; and
authorities, where required by law or to protect rights, safety, and the Service.

International transfers. The Operator is based in New Zealand, which the European Commission recognises as providing an adequate level of data protection, so transfers to us from the EU/EEA rest on that adequacy decision. Some of our service providers process data in other countries, including the United States — both of our payment providers, Stripe and Lemon Squeezy, are US companies. Where we transfer personal data out of the EU/EEA or the UK to a country without an adequacy decision, we use an approved transfer mechanism — such as the European Commission's Standard Contractual Clauses (with the UK Addendum where relevant) or a provider's EU-US Data Privacy Framework certification — so your information stays protected to a comparable standard.

6. How long we keep it

We keep your information only as long as needed for the purposes above:

Account and profile data — while your account is active.
Sign-in and security logs — a limited period (typically up to 12 months) for security and abuse prevention.
Request logs — server request logs, which include IP addresses, are kept for up to 30 days.
Transaction records — as long as required to meet tax and accounting obligations, which can be several years.
Backups — we keep encrypted backups of the database so the Service can be restored after a failure. Backups are kept on a rolling schedule and none is older than 90 days.

When you delete your account, we delete or anonymise your personal information in the live Service straight away, except records we must keep for the limited periods above. Backups taken before you deleted your account still contain it until they age out of the rolling schedule, so deletion completes within 90 days. If we ever have to restore from a backup, we re-apply the deletions made since that backup was taken, so a restore does not bring a deleted account back.

If you were playing in a shared world, the airline you founded there keeps flying under computer control rather than being deleted, so that the other players' game survives your leaving. It keeps the airline name you chose, and nothing about it links back to your account.

7. Security

We protect your information with measures appropriate to the risk, including hashed passwords, encrypted transport (HTTPS), access controls, and rate-limiting. No system is perfectly secure, but we work to keep your data safe. If a privacy breach occurs that is likely to cause serious harm, we will notify affected individuals and the relevant authorities as required by law (including the New Zealand Privacy Act 2020 and, where applicable, the GDPR).

8. Your rights

Depending on where you live, you have rights over your personal information. To exercise any of them, use the Contact us page. You can also delete your account at any time from your account settings.

Everyone. You can ask to access or correct your personal information.
EU/EEA and UK (GDPR). You also have the right to erasure, to restrict or object to processing, to data portability, and to withdraw consent at any time. You have the right to lodge a complaint with your local data protection supervisory authority.
California (CCPA/CPRA). You have the right to know, delete, and correct your personal information, and to opt out of any "sale" or "sharing" of it — including targeted advertising. We do not sell your personal information. We use Google Analytics only to measure how the Service is used; you can turn it off at any time from Cookie settings, and we treat the Global Privacy Control signal as an opt-out of any sale or sharing. If we introduce advertising that counts as "sharing", we will provide a "Do Not Sell or Share My Personal Information" control. We will not discriminate against you for exercising your rights.
New Zealand. You may complain to the Office of the Privacy Commissioner.

9. Cookies, advertising and third parties

We use essential browser storage to keep you signed in and remember settings such as your language; these are necessary for the Service and do not require consent.

We use Google Analytics to understand how the Service is used — which pages are visited and which game features are used — so we can improve it. Google Analytics sets cookies and receives your IP address and device and browser information, and Google processes this data on our behalf. We do not currently show third-party advertising; if we do, our partners may use cookies or similar identifiers to serve and measure ads, including interest-based (profiling) ads.

What happens before you choose depends on where you are:

EU/EEA, UK, Switzerland, Turkey, Brazil, Canada, South Korea, China and India — or if we cannot tell where you are: we ask for your consent before setting any analytics or advertising cookie.
Everywhere else: analytics and advertising cookies are on until you turn them off. You can do so at any time from Cookie settings at the bottom of the page. We also treat the Global Privacy Control signal from your browser as an opt-out.

We work out your region from your IP address when you visit; the result is kept only in your browser for that session. You can change or withdraw your choice at any time from Cookie settings. The Service may also contain links to third-party sites, which have their own privacy practices that we are not responsible for. We keep a record of the cookie choices you make (including the time and your IP address) so we can honour them and demonstrate your consent.

10. Changes to this policy

We may update this policy from time to time. If we make material changes we will take reasonable steps to let you know, such as a notice in the Service.

11. Contact

For any privacy question or request, use the Contact us page. Airline Legend is operated by Object IT Limited (NZBN 9429031476065).