Planes are public. You aren't.

Isoplanes for iPhone, Android and isoplanes.xeve.io, by Xeve. Last updated 5 November 2026.

What the app asks our server for

To draw the map, the app asks isoplanes-api.xeve.io for the aircraft in the area on screen. It asks in squares 2.5° across (about 275 km), so the request says which region you are looking at, not where you are. It also asks for details of an aircraft you select, such as its recent path. The widgets and Siri ask for the aircraft near you by sending your position rounded to 0.25° (about 28 km). Answers are not stored against you.

Each request carries a token that shows it comes from a genuine copy of the app, using Apple's App Attest. The token is tied to a random key made for this installation of the app, not to you, your Apple Account or your phone's identity. Our server counts requests per key so that one copy can't overload the service, and blocks keys that abuse it.

Tracked flights

When you track a flight, our server keeps the flight number or aircraft, its date and route, your time zone and language (to show times and write alerts your way) and the address your device gives it to deliver notifications: Apple's push token (also used to update the Live Activity), a Firebase Cloud Messaging token on Android, or a browser push subscription on the website. These are used only to send that flight's alerts and updates.

They are deleted when you stop tracking the flight, about 30 minutes after it lands, or within a day or so if it never departs. If you are signed in, the flight is also listed under your account until then (see below). Notifications are delivered by Apple's Push Notification service, Google's Firebase Cloud Messaging, or your browser's push service.

Accounts (optional)

You do not need an account to use the apps. The website needs a free account to show the live map. If you create one, so that your tracked flights and Passport follow you to another phone or browser, you can sign in with an email address and a password, with Sign in with Apple, or with Google.

• What we keep: the email address you signed up with (for Apple, the address or private relay address you chose to share, if any), your name if you gave it, an identifier from Apple or Google that is unique to Isoplanes, the flights you track while signed in, and your Passport (the flights you have taken: flight number, airports, times, distance). A password is never stored; only a salted one-way hash (scrypt) of it is.
• Signing in: your device keeps a long-lived sign-in key that you can end by signing out; it lasts 60 days and is replaced each time it is used. Signing out on one device signs out that device.
• Email: if you ask to reset a password, we send a six-digit code to your address through our email delivery service, ZeptoMail (Zoho). It sees your address and the message for that purpose only.
• Deleting your account: choose Delete account in the app (Settings) or on the website. It removes your sign-in details, your Passport and the link between you and your tracked flights straight away, ends those tracked flights and deletes their notification addresses and share links. You can also ask by email. Before deleting you can download everything we hold about you from the same place.

Isoplanes Pro (optional subscription)

If you buy Isoplanes Pro, Apple or Google takes the payment and keeps your payment details; we never see them. We receive a signed record of the subscription (which plan, when it ends, whether it renews and a purchase identifier). If you are signed in we keep it with your account so Pro works on your other devices, and Apple and Google tell us about renewals, expiry and refunds. We use it only to switch Pro on or off. It is deleted with your account, except for the purchase identifier that lets a later account claim the same subscription. Details of the terms are in the Terms of Use.

Using Isoplanes without an account

You can use the iPhone and Android apps without an account. The website asks you to create a free account or sign in before it shows the live map, and the apps may ask the same after a free day. This helps us keep automated traffic out. To count the day, our server remembers when your installation first asked for data: the random key made for the installation (or, on the website, a random identifier kept in your browser) and the time. It holds no name, email address or location.

Booked trips and your trip inbox

When you are signed in you can give us your flight bookings in two ways. Both are optional.

• Your private address: the app shows you an email address of the form [email protected]. If you forward a booking or e-ticket email to it, our server reads that one email, keeps only the flights in it (flight number, date, airports, departure time and booking reference) and throws the rest away: the message, its subject, its sender and its attachments are not stored. A log keeps only when each email arrived and how many flights were found. Mail to the address passes through Cloudflare (Email Routing and an Email Worker), which handles it for that purpose only. We reply, if at all, only to the email address of your account. You can replace the address at any time, which ends the old one.
• Your booked flights: the flights found are listed in the app under Account, Trip inbox. A few days before each one leaves we start tracking it for you and send alerts to the device you last used; you can remove any of them. They are deleted when the flight is over or when you delete your account, and they are included in the data you can download.

Gmail (optional)

You can connect your Gmail so the app finds your airline tickets. This happens only if you tap Connect Gmail and agree on Google's screen, and it asks for read-only access to your Gmail. The app searches your mail on your own phone or browser for messages that look like flight tickets, reads them there, and shows you the flights it found. Only the flights you choose to add (flight number, date, airports) are sent to our server. Your Gmail messages and the access Google gives the app are never sent to or stored on our server. You can disconnect at any time in the app, which also withdraws the access at Google, or at myaccount.google.com/permissions.

Isoplanes's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use Gmail data only to find your flights, never for advertising, and no person at Isoplanes reads your mail.

Share links

You can share a tracked flight as a link. Anyone who has the link can see that flight's route, status and weather until you stop sharing, delete the flight or account, or six hours after it ends. The link does not say who shared it, and we keep no list of who opened it.

Server logs

Like any web server, ours sees your IP address. It is written, with the request (such as the map area asked about), to a rolling log that is overwritten within a few days, and used only to keep the service running and protect it. An address that breaks the rate limits is recorded in an abuse log so it can be blocked.

Other services

• Route and aircraft lookups: to show where a flight is going, the app asks adsbdb.com about the flight's callsign. Our server also asks adsbdb for the type of an aircraft that our feeds do not describe, by the aircraft's public radio address. adsbdb sees those requests; the app's request also shows your IP address.
• Flight schedules, gates and delays come from AeroDataBox, and the aircraft behind a flight number from Flightradar24. Our server asks them, with a flight number, a date or an aircraft registration, never with anything about you.
• Airport weather comes from the US National Weather Service's Aviation Weather Center and, in India, Weather Union. Our server asks them for an airport, never for you.
• Aircraft positions come from community ADS-B networks (adsb.fi, adsb.lol and the OpenSky Network) and our own receiver. Our server fetches them; your phone never contacts them.
• The website uses Cloudflare to deliver it and Cloudflare Turnstile to check that a browser is genuine before the map loads. Cloudflare processes signals from your browser to do that, and may count page loads without cookies, under its own privacy policy. The home page and the policy pages (not the map, and not the apps) also use Google Analytics, which sets cookies and sends page views and a rough location to Google, under Google's own privacy policy. Sign in with Google and Sign in with Apple are run by Google and Apple, who see that you signed in to Isoplanes.

Permissions

• Location, while using the app: to open the map over you, find the aircraft nearest you, place aircraft in the sky in Sky AR, and for the widgets. Your precise position stays on your phone; the widgets and Siri send only the rounded position described above.
• Camera: for Sky AR, which labels aircraft through the camera. The picture is processed on your phone and never recorded or sent anywhere.
• Notifications: for alerts about flights you track.
• Gmail (only if you tap Connect Gmail): read-only access to find flight tickets, as described above. The mail stays on your phone.
• Calendar (only if you tap Import from Calendar): to find flight numbers in your calendar events. They are read on your phone, you choose which to track, and the calendar is never sent to us.

What stays on your phone

Your settings, the list of flights you track, your Passport (unless you are signed in, when a copy is kept for you) and the last place the map opened over (so widgets can show what's nearby). Deleting the app deletes them from the phone.

What we don't do

We don't sell or share data, don't follow you across other companies' apps or websites, don't build advertising profiles and don't show ads. The map and the apps set no cookies of their own; the home page and policy pages set Google Analytics cookies as described above.

Anonymous usage statistics

The apps and the website count simple events, such as opening the app, tracking a flight, seeing the Pro page or starting a purchase. Each event carries the app version, the system version, the language, whether you have Pro and a random identifier made on your device. It carries no name, email address, account identifier, location, flight number or advertising identifier, and it is not linked to you. The counts go to a PostHog server that we run ourselves (posthog.doteosde.com), not to an advertising or analytics company. We use them only to find what is broken or confusing. In the iPhone app you can turn this off under About, Settings, Share anonymous usage. The website does not read the Do Not Track setting, because these counts hold nothing personal; to opt out of them, write the value off in the browser storage key iso.analytics, or ask us at the support address.

Children

Isoplanes is not directed at children and doesn't knowingly collect personal information from them. Accounts are for people aged 13 and over.

Changes and contact

If this policy changes, the new version will appear on this page with a new date. Questions: [email protected].