Privacy Policy
Effective date: [TBD — Effective Date: the date this document goes live]Last updated: September 3, 2026
Some publication details (effective date, mailing address, contact addresses) are still being finalized.
1. Who We Are and Scope
Aviation Learning Solutions LLC (a Michigan limited liability company) (“we,” “us,” or “our”) operates the Aviation Learning Solutions A&P study platform — a study-aid application that helps users prepare for the FAA Airframe & Powerplant (A&P) written knowledge tests (the “Service”). This Policy explains what personal information we collect, how we use and share it, and the choices you have. It applies to the Service’s website and web application, and to our mobile application when released. We currently offer the Service to users in the United States.2. Information We Collect
2.1 Information you provide
•Account information: your email address and password credentials (managed by our authentication provider), and an optional display name.
•Preferences: study settings such as default session length and question types.
•Communications: information you provide if you contact support or send feedback.
2.2 Information created as you use the Service
•Study and exam activity: your study and practice-exam sessions, the questions you were shown, your answers, whether they were correct, time spent, questions you flag, scores, and pass/fail results.
•Progress data: study streaks and the date you last studied.
•Lesson activity: the lessons you open, when you first and last viewed each one, and whether you have marked it complete.
•Saved study state: questions you bookmark, questions you flag for review, the spaced-repetition scheduling data that determines when a question is shown to you again, your saved custom-test definitions, and your study preferences.
•Entitlement records: which test(s) you have access to and the status and expiration of your subscription or lifetime purchase.
2.3 Payment information
When you start a trial or make a purchase, our payment partners collect and process your payment details. We do not receive or store your full payment-card number; we receive your subscription and entitlement status and related purchase events. See Section 4 (payment processors). Note: paid billing may be rolled out in stages; some payment functionality may not be active for all users at all times.2.4 Information collected automatically by our infrastructure
Our hosting and authentication providers automatically process certain technical information to deliver and secure the Service, even though it is not displayed in your account:•IP address, browser/device (user-agent) information, and request metadata (processed by our web host, Vercel, in server logs).
•IP address and device/browser information used by our authentication provider (Supabase) to operate sign-in, rate-limiting, and abuse prevention.
•IP address, and on sign-in and password-reset attempts the email address entered on the form, held briefly as rate-limit counters by our rate-limiting provider (Upstash) to detect and slow abuse of the authentication forms.
3. How We Use Information
•To provide, operate, and maintain the Service and your account.
•To deliver study and exam features and show your progress and results.
•To process trials, subscriptions, lifetime purchases, and entitlements.
•To secure the Service, prevent abuse, and enforce our Terms.
•To respond to your requests and provide support.
•To comply with legal obligations.
4. How We Share Information — Service Providers (Subprocessors)
We share personal information with the service providers below, who process it on our behalf to operate the Service. We do not sell personal information, and we do not share it for cross-context behavioral advertising.Service providerRole and data processed
Supabase (Supabase, Inc.)Hosted database, authentication, file storage (question images), and serverless functions. Stores your account email, profile, study activity, and entitlement records; its authentication service also processes your IP address and device/browser information to operate sign-in, rate-limiting, and abuse prevention.
RevenueCat (RevenueCat, Inc.)Subscription and entitlement management across web and (when released) mobile app stores. Receives your account identifier and purchase/subscription events. Does not share full card numbers with us. For web purchases, RevenueCat's hosted checkout collects your billing email address directly from you at checkout; the app itself passes RevenueCat only your account identifier, not your email.
Stripe (Stripe, Inc.)Payment processing for web purchases (via RevenueCat). Collects and stores your payment-card details directly; we never receive or store full card numbers.
Vercel (Vercel, Inc.)Web application hosting and content delivery. Processes your IP address, browser/user-agent, and HTTP request metadata in server logs to deliver and secure the web application.
Sentry (Functional Software, Inc. d/b/a Sentry)Error and performance monitoring for our web application. Receives error reports, stack traces, and request metadata generated when the application encounters a problem; authentication tokens and similar secrets are redacted before an error report is sent. Sentry may observe your IP address transiently at the point it receives an error report.
Resend (Resend, Inc.)Transactional email delivery for our authentication provider. Relays the account-confirmation and password-reset emails the Service sends to you, and therefore processes your email address and the delivery metadata of those messages (such as send status and timestamps).
Upstash (Upstash, Inc.)Rate-limiting store for sign-in, sign-up, password-reset, and password-change attempts. Processes your IP address, and — on sign-in and password-reset attempts — the email address entered on the form, held briefly as short-lived counter keys to detect and slow credential-stuffing and other abuse of the authentication forms.
Apple App Store / Google Play (future)If and when the mobile application is released, in-app purchases on iOS and Android are processed by Apple and Google (via RevenueCat). Not active today.
5. Payment Data
Payments are handled by our payment partners RevenueCat and Stripe (for web purchases) and, when the mobile app is released, by the Apple App Store and Google Play. These providers collect your payment-card or store-account details directly. We never receive or store your full card number. We retain records of your purchases and entitlement status so we can provide the access you paid for.6. Artificial Intelligence and Automated Decision-Making
The Service does not send your personal information or study content to any third-party artificial-intelligence or large-language-model provider as part of delivering the Service. We do not use your data to train AI or machine-learning models, and we do not make legally or similarly significant decisions about you through solely automated means. (Our team may use AI tools internally to help author practice questions; that process does not use your personal information.)7. Cookies and Similar Technologies
We use strictly necessary cookies set by our authentication provider to keep you signed in and to operate the Service securely. We do not use advertising cookies, third-party analytics trackers, or cross-site tracking technologies. Because we use only strictly necessary cookies, there is no advertising or analytics tracking to opt out of; you can control cookies through your browser settings, though disabling necessary cookies may prevent you from signing in.8. How Long We Keep Information
We keep your account and associated data for as long as your account is active. When you delete your account (see Section 9), we permanently erase your account and associated study data (your profile, preferences, study and exam sessions, attempts, lesson views, bookmarks, flagged questions, spaced-repetition scheduling data, saved custom-test definitions, and entitlement records). Certain limited records are retained in de-identified or anonymized form — for example, a marker that a one-time access code was redeemed (without identifying you) and security audit-log entries with your identifiers removed. We also delete payment-webhook records associated with your account as part of deletion.When you delete your account, we also direct our subscription-management provider to cancel any active auto-renewing subscription and remove your subscriber record there before your account is erased.9. Your Choices and Rights
•Access and update: you can view and update your profile and preferences in your account settings.
•Export your data: you can export your account data — study and practice-exam sessions, question attempts, lesson views, spaced-repetition scheduling data, bookmarked questions, flagged questions, question reports you submitted, saved custom-test definitions, study preferences, profile information, and subscription status — from your account. The JSON export contains all of it; the CSV export contains your sessions.
•Delete your account: you can permanently delete your account and associated study data from your account settings, as described in Section 8.
•Communication preferences: account- and security-related emails are necessary to operate the Service.
10. U.S. State Privacy Rights (California and Similar States)
Depending on your state of residence, you may have rights to know or access the personal information we hold about you, to request its deletion or correction, and to not be discriminated against for exercising these rights. To exercise a right, contact us at [TBD — privacy contact email]; we will verify your request as required by law.Do not sell or share: we do not sell your personal information and we do not share it for cross-context behavioral advertising. Because we do not engage in these activities, there is nothing to opt out of, but you may still contact us with questions.11. Children’s Privacy
The Service is intended for users 18 and older. We do not knowingly collect personal information from children under 13. We recognize that students under 18 may use the Service through a school or training institution (such as an FAA Part 147 program) or with a parent’s or guardian’s involvement. Where a school or institution enables access for students under 18, that institution is responsible for providing any notices to, and obtaining any consent from, parents or guardians required by applicable law. If you believe we have collected information from a child under 13, contact us at [TBD — privacy contact email] and we will delete it.12. Security
We use administrative and technical safeguards designed to protect personal information, including encrypted transport, access controls, row-level security on user data, and signed, time-limited URLs for images. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.13. Where Your Data Is Processed
We operate in the United States and our service providers process data in the United States. We do not currently target or knowingly offer the Service to users in the European Union or the United Kingdom.14. Changes to This Policy
We may update this Policy from time to time. If we make material changes, we will update the “Effective date” above and take reasonable steps to notify you. Your continued use of the Service after changes take effect constitutes acceptance.15. Contact Us
Aviation Learning Solutions LLCMailing address: [TBD — Company mailing address]Privacy contact: [TBD — privacy contact email]Back home