Sofly Privacy Policy

Effective date: October 15, 2026

Sofly: Track Flight Status helps people search, save, and track flight information. This policy explains what information Sofly processes and how it is used.

Information we process

If you use Sign in with Apple, we store your Apple sign-in identifier and the name and email address provided during sign-in, when available. We associate these details with your Sofly account to identify your account and provide account-based features.

We also process flight searches, saved flights, preferences you confirm in the app, account and installation identifiers, notification tokens, app interactions, crash and performance diagnostics, and subscription status and transaction information from Apple. We use analytics and advertising attribution information from partners such as AppsFlyer and Meta to understand app usage and measure campaign performance.

AI flight search

Sofly uses Google Gemini, a third-party AI service, to interpret flight searches that its regular parser cannot understand. For these searches, we send your search text, language context and the current date to Google Gemini without a separate AI search permission prompt. We do not add your Sofly account identifier or authentication token to this AI request. Search text is not redacted before AI processing and may include personal or itinerary details you enter. Please use search for flight details and avoid entering names, contact details or booking references. Flight-number, airport and other supported deterministic searches can work without sharing the search text with Google Gemini.

Forwarded-email AI processing remains off by default and requires a separate permission saved to your Sofly account. Using flight search does not grant booking-import permission. You can revoke booking-import permission in Settings. Revocation stops new booking-import requests to Google Gemini, including queued retries; it cannot undo information already sent or a request already in flight. Declining booking-import permission does not opt you out of flight search, hosting, flight-data providers or diagnostics described elsewhere in this policy.

Forwarded booking emails

If you forward a booking email to Sofly, the original message is stored in Amazon Web Services (AWS) S3 cloud storage. This includes the email headers, such as sender, recipients and subject, the message contents, and any attachments. We match the sender's email address to your Sofly account. Only for a uniquely matched, Apple-verified email identity with separate forwarded-email AI permission, we send text extracted from the message and supported PDF attachments to Google's Gemini AI service to identify flight details. Flights found through this process may be saved to your account.

Forwarded messages are not automatically deleted after processing and currently have no automatic expiry, including when a flight cannot be imported or the sender does not match an account. The seven-day limit for failed-search diagnostic samples described below does not apply to forwarded emails or their attachments. You can request deletion using the contact details below. Only forward information you want Sofly to process for this feature.

Failed-search diagnostics

To investigate unsuccessful searches, we may retain a sample of the search text in a dedicated diagnostic store. Detected email addresses, phone numbers and web URLs are redacted before the sample is encrypted. Redaction does not make a sample anonymous: it may still contain flight or itinerary information. The diagnostic record also includes a pseudonymous account identifier, search-attempt identifiers, failure details, and app version and environment information.

Access to these samples is restricted to an authenticated diagnostic report. Samples expire no later than seven days after their original capture; a retry does not restart this period. Expired samples are excluded from reports and removed by an independent cleanup process. This limit applies to failed-search diagnostic samples, not to saved flights, account records, purchases or forwarded booking emails.

Notification-open analytics

When you open Sofly by tapping one of its notifications, we record the notification's title, subtitle and message, notification and flight identifiers, delivery and opening timing, and associated account, installation, app-version and diagnostic identifiers. We use this to understand which alerts are useful and investigate notification navigation. This does not give Sofly access to notifications from other apps.

Notification text is sent to our backend, not to AppsFlyer. Detected email addresses, phone numbers and web URLs are redacted before the text is encrypted for storage. Redaction does not make the record anonymous; it can remain linked to your account and flights. Access to notification text is restricted to our authenticated diagnostic reports. Notification interaction events without this text may also be sent to our analytics provider under the analytics practices described above.

Notification-open reports cover the most recent 90 days. Backend diagnostic records older than 90 days after receipt are removed during diagnostics collection. Undelivered diagnostics may remain temporarily in device-protected app storage for retry, for no more than seven days. Account deletion also removes associated notification-open diagnostics.

Shared flight links

If you share a flight, Sofly creates a private link (sofly.to/f/…) that anyone you send it to can open without an account. The page shows only that flight's information, such as flight number, airline, route, times, gates, status and an estimated position, and never your name, email or account details. We store which account created the link, for which flight, when it was created or stopped and why, how many times the page was viewed and when it was last viewed. We do not link viewers to accounts. Like any website, our web server keeps standard access logs (IP address, browser and time) without the link itself.

A link stops working about six hours after the flight lands, when you tap Stop sharing, or when you delete the flight or your account. People who open a link load the map from OpenFreeMap and the map software from cdnjs (Cloudflare), which receive their IP address as part of normal web requests.

How we use information

We use information to provide flight tracking, sync saved flights, deliver notifications, manage subscriptions, respond to support requests, improve the app, measure campaign performance, and prevent misuse of the service.

Sharing

Sofly does not sell personal information. We share information only with service providers needed to run the app, including AWS for hosting and email storage, Google Gemini for interpreting flight searches and forwarded booking text, flight-data providers for finding and updating flights, Apple for sign-in, notifications and purchases, and analytics and attribution providers such as AppsFlyer and Meta. We may also disclose information when required by law.

Data deletion

You can request deletion of your Sofly account and associated personal data, including forwarded booking emails, by contacting info@sofly.to. We may retain limited records when required for security, legal, accounting, or fraud-prevention reasons.

Contact

Questions about this policy can be sent to info@sofly.to.