1. Introduction
BlueSky Applications LLC ("we," "us," or "our") operates the 5-by-5 mobile application (the "App"). This Privacy Policy describes how we collect, use, store, and share your personal information when you use our App and related services.
By creating an account or using 5-by-5, you agree to the collection and use of information as described in this policy. If you do not agree, please do not use the App.
2. Information We Collect
2.1 Account Information
When you create an account, we collect:
- Full name
- Email address
- Password (stored in hashed form; we never have access to your plaintext password)
2.2 Member Profile Information
When you join or create a group, you may provide:
- Phone number
- Emergency contact name, phone number, and relationship
- Profile photo
- Country of residence (for localization)
2.3 Pilot Certification and Currency Data
To support pilot currency tracking, you may provide:
- Pilot certificate or license type (e.g., Private Pilot, Commercial, ATP / PPL, CPL, ATPL)
- Pilot ratings (e.g., Instrument, Multi-Engine)
- Medical certificate type and expiration date
- Flight review expiration date
- Instrument proficiency check date
2.4 Flight and Activity Data
- Flight records: date, departure/arrival airports, tach times, hours flown, landings, instrument approaches
- Flight comments and notes
- Currency event tracking data
2.5 Aircraft and Group Data
- Group/partnership name
- Aircraft registration (tail number), year, make, model, and category
- Home airport
- Aircraft photos
2.6 Booking and Scheduling Data
- Booking dates, times, destinations, routes, and estimated hours
- Trip names and comments
2.7 Maintenance and Squawk Data
- Maintenance item descriptions, due dates, and tach readings
- Squawk reports: title, description, priority, status, and associated photos
2.8 Billing Information
Payment processing is handled entirely by Stripe, Inc. We do not collect, store, or have access to your credit card number or payment card details. We store only:
- Stripe customer ID (a reference identifier)
- Subscription tier, billing period, and expiration date
2.9 Bank Account and Transaction Data (Optional)
5-by-5 offers an optional bank account integration powered by Plaid. If you choose to connect your bank account, we collect and store:
- Your bank institution name (e.g., "Chase", "Wells Fargo")
- Transaction records: date, merchant/description, and amount — for the connected account
- Current account balance (fetched on demand)
We do not collect, see, or store your bank login credentials, account numbers, routing numbers, or any other sensitive account identifiers. Your credentials are entered directly into Plaid's secure interface and never transmitted to or stored by 5-by-5.
Bank transaction data is used solely to display your group's actual expenses alongside planned expenses on the Finances page. It is not used for advertising, credit assessment, or any purpose beyond aircraft expense tracking.
Transaction data is stored only while the bank connection is active. If you disconnect your bank account (available in the web dashboard), all cached transaction data is permanently deleted from our systems.
2.10 Device Permissions and Local Data
With your consent, the App may access:
- Camera and Photo Library: To take or select photos of aircraft, profiles, and squawks
- Calendar: To sync bookings to your device calendar
Authentication tokens are stored securely on your device using encrypted storage (device secure enclave). Calendar sync preferences are stored locally on your device.
2.11 Website Analytics
Our website uses Plausible Analytics, a privacy-friendly analytics service, to collect aggregate, anonymous usage statistics. Plausible does not use cookies, does not collect personally identifiable information, and does not share or sell data to third parties. The data collected is limited to:
- Page URL visited
- Referrer (the URL you came from, if any)
- Browser, operating system, and device type (e.g., "Chrome on macOS")
- Country (derived from IP address — your full IP address is never stored)
- Anonymous click counts on outbound links, file downloads, and form submissions
All data is aggregated and cannot be used to identify individual visitors. For more information, see Plausible's data policy.
2.12 Ad Click Measurement
We advertise 5-by-5 on Google Search. When you arrive at our website by clicking one of those ads, the web address includes a click identifier that Google generates (and, for some links, campaign tags such as utm_source). Our website saves that identifier and those tags in your own browser's local storage for up to 90 days. This is not a cookie, nothing is sent to Google or anyone else from our website, and no Google advertising script runs on our pages.
If you then create a 5-by-5 account on our website, the saved identifier and tags are stored with your account. When that account confirms its email, starts a free trial, or starts a paid subscription, we report to Google Ads only the click identifier, the type of event, and when it happened, so Google can tell us which of our ads are working. We never send Google your name, email address, or anything about your aircraft, flights, or finances.
If you didn't arrive from one of our ads, nothing is saved. You can clear the saved identifier at any time by clearing your browser's site data for fly5by5.com.
2.13 Cookies
Our website uses cookies only for strictly necessary purposes — primarily, authentication. When you sign into the web dashboard, we set cookies that keep you signed in as you navigate between pages (sb-access-token, sb-refresh-token) and that remember which group you are currently viewing (sb-active-group). These cookies are essential for the dashboard to function; without them, you would need to sign in on every page load.
We do not use cookies for analytics, advertising, or cross-site tracking. Plausible Analytics and ad click measurement, described above, both operate without cookies.
3. How We Use Your Information
We use the information we collect to:
- Provide, maintain, and improve the App's core features (scheduling, flight logging, maintenance tracking, currency tracking)
- Authenticate your identity and manage your account
- Facilitate group management and communication between co-owners/members
- Process subscription payments through Stripe
- Send transactional emails (e.g., group invitations)
- Generate calendar feeds for booking synchronization
- Display bank balance and transaction data on the Finances page (only when you opt in to the Plaid bank integration)
- Respond to support requests
We do not use your data to target advertising at you, and we do not sell your personal information to third parties. The only advertising-related use is the ad click measurement described in section 2.12, which tells Google that a click on our ad led to a sign-up, trial, or subscription. Bank transaction data is used exclusively for aircraft expense tracking within the App and is never shared with or sold to any third party.
4. How We Share Your Information
4.1 Within Your Group
Certain information is visible to other members of your aircraft group, including your name, profile photo, phone number, pilot certifications, bookings, shared flight records, and squawk reports. This sharing is essential to the App's purpose of coordinating shared aircraft use.
4.2 Third-Party Service Providers
We share data with the following service providers, solely for the purpose of operating the App:
| Provider | Purpose | Data Shared |
|---|---|---|
| Supabase | Backend database, authentication, file storage | All app data (encrypted in transit via HTTPS) |
| Plaid | Optional bank account integration (read-only) | Bank institution selection; Plaid returns transaction data and balances to us — we never share your data back to Plaid beyond what is required to establish and maintain the connection |
| Stripe | Payment processing | Email, group name, member count, subscription details |
| Anthropic (Claude) | Ask AI answers; reading photographed logbook pages and documents into text; reading oil-analysis reports | Only the content of the question or the page being read, plus the records from your own group needed to answer it. Never used to train models, never used for advertising |
| RevenueCat | Managing App Store subscriptions | Your group's identifier, the subscription's status, product and renewal dates, and basic technical context such as platform, app version and country. We do not enable RevenueCat's advertising-identifier collection. No name, email or payment details |
| Sentry | Crash and error reporting | Device model, operating system version, app version, and the technical details of a crash |
| Resend | Transactional email delivery | Recipient email, group name, inviter name, invite codes |
| Plausible Analytics | Privacy-friendly website analytics (no cookies, no PII) | Aggregate, anonymous page views and click events from website visits |
| Google Ads | Measuring which of our search ads lead to sign-ups (section 2.12) | Only for accounts that arrived from one of our ads: Google's own click identifier, the event type (email confirmed, trial started, or subscription started), and its time. No name, email, or app data |
| Expo (EAS) | App distribution and updates | Anonymous app performance data |
| Apple / Google | App store distribution | Standard app store analytics |
4.3 Artificial Intelligence Features
Three features send data to Anthropic's Claude API for processing: Ask AI, which answers questions about your aircraft and your group's records; document scanning, which reads a photographed logbook page or aircraft document into text you can correct; and oil report import, which reads a laboratory oil-analysis report into structured results for your review.
Only the data needed for that specific request is sent — the question itself, the page being read, and the relevant records from your own group. Nothing is sent from other groups. Your data is not used to train AI models, is not used for advertising, and is not sold. You can avoid sending anything to Anthropic by not using these three features; the rest of the App works without them.
4.4 Legal Requirements
We may disclose your information if required by law, regulation, legal process, or governmental request.
5. Data Storage and Security
- All data is transmitted over HTTPS (TLS encryption in transit)
- Backend data is hosted on Supabase (cloud infrastructure with encryption at rest)
- Authentication tokens are stored in your device's secure enclave via encrypted storage
- Passwords are hashed using industry-standard algorithms; we never store plaintext passwords
- Row-level security policies restrict database access so users can only view data within their own group
- Payment card data is handled entirely by Stripe (PCI DSS Level 1 compliant) and never touches our servers
6. Data Retention
We retain your data for as long as your account is active. If you delete your account (available in Settings), we delete:
- Your member profile and all associated data
- All flights, bookings, currency events, and squawk reports you created
- Your authentication account
- If you are the last member in a group: all group data, including aircraft records, maintenance items, and all associated member data
Uploaded photos may take up to 30 days to be fully purged from storage backups after account deletion.
7. Your Rights
Depending on your jurisdiction, you may have the right to:
- Access the personal data we hold about you
- Correct inaccurate data (editable in Settings)
- Delete your account and associated data (available in Settings)
- Export your data in a portable format
- Object to or restrict certain processing
- Withdraw consent for optional features (e.g., calendar sync, camera access via device settings)
To exercise any of these rights, contact us at support@fly5by5.com.
7.1 California Residents (CCPA)
If you are a California resident, you have the right to know what personal information we collect, request deletion, and opt out of the sale of personal information. We do not sell personal information. To make a request, contact us at the email above.
7.2 European and International Users (GDPR)
If you are located in the European Economic Area, United Kingdom, or other jurisdiction with similar data protection laws, our lawful basis for processing your data is:
- Contract performance: Processing necessary to provide the App services you signed up for
- Legitimate interests: Improving the App, preventing fraud, ensuring security
- Consent: For optional features such as calendar access, camera access, and marketing communications
7.3 Australian Users (Privacy Act 1988)
If you are located in Australia, we handle your personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). Specifically:
- Access and correction. You may request access to the personal information we hold about you (APP 12) and request correction of any information you believe is inaccurate, out of date, incomplete, irrelevant, or misleading (APP 13). To make a request, contact us at the email in Section 11.
- Cross-border disclosure. Your personal information is stored on Supabase infrastructure, which may host data in the United States or other jurisdictions outside Australia (APP 8). By using the App, you consent to this transfer. We take reasonable steps to ensure overseas recipients handle your information consistently with the APPs.
- Complaints. If you believe we have breached the Privacy Act or an APP, please contact us first at the email in Section 11 so we can attempt to resolve the matter. If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or by calling 1300 363 992.
8. Children's Privacy
5-by-5 is not intended for use by anyone under the age of 18. We do not knowingly collect personal information from children under 18. If we learn that we have collected information from a child under 18, we will delete it promptly.
9. Calendar Feed Disclosure
5-by-5 offers an optional ICS calendar feed that allows external calendar applications (e.g., Apple Calendar, Google Calendar) to display your group's bookings. This feed is accessible via a unique URL containing your group's identifier. Anyone with this URL can view booking information (dates, times, trip names, and the name of the member who booked). Share this URL only with trusted individuals.
10. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy in the App or on our website. Your continued use of the App after changes are posted constitutes acceptance of the updated policy.
11. Contact Us
If you have questions about this Privacy Policy or our data practices, contact us at:
BlueSky Applications LLC
Email: support@fly5by5.com
Website: fly5by5.com