Privacy Policy
Version 1.5 · 8 October 2026
The short version. We hold what you put into the product so we can provide it. We do not sell it, we do not train models on your safety content, and our support console cannot read your hazard reports, risk assessments or manual — that limit is enforced in the database, not just written here.
What we hold
| Category | What it is |
|---|---|
| Account | Name, email address, the operator you belong to and your Part 5 role. Your password is handled by our authentication provider; we never see it. |
| Operator | Legal name, trading name, base, state, certificates and certificate numbers, fleet registrations, declaration target date. |
| Safety content | Hazard reports, risk assessments, corrective actions, audits and findings, training records, documents and signatures — everything you enter to run your SMS. |
| Activity | An append-only audit log of who did what and when, including when a member of our staff opens your account. Sign-in timestamps. |
| Billing | Plan, status, period dates, and identifiers from Stripe. We do not hold card numbers. |
| Diagnostics | Errors the product hits, with the page, the message, a stack trace, and — if you are signed in — your email address and operator, so we can fix them. |
Anonymous reports
When a report is filed anonymously, no reporter identity is recorded at any point. There is no hidden field, no IP address stored against it, and nothing to recover later. Neither your management nor we can identify the reporter, because the information was never collected. This is a design decision in support of a working reporting culture, and it is not reversible on request.
What we do not do
- We do not sell personal information. We do not share your safety content, your reports or your account details for advertising. The one thing we do send an advertising network is described under Measuring our advertising, and it contains none of those.
- We do not use your safety content to train artificial-intelligence models, and we do not send it to any service that would. See Automated analysis of reports.
- Our support console shows counts, activity and billing — never the content of your reports or documents. Reading content requires a time-boxed support grant that you issue from your own account, that you can revoke, and that is logged where you can see it.
Measuring our advertising
We advertise on Google. When somebody arrives from one of our ads, Google adds an identifier of its own making to the web address — a long string called a click id. It identifies the ad that was clicked. It does not identify you, and we cannot turn it into anything that does.
Our public pages keep that string in your browser's own storage for up to 90 days. It is not a cookie, it is not sent anywhere as you browse, and no other website can read it. If you then create an account and start a free trial or subscribe, we send Google three facts: the click id, the time you started, and what the plan costs. That is the whole transmission. Google learns that one of its clicks worked. It does not learn who you are, what operator you run, or anything you have put into the product.
We chose this deliberately over the usual advertising tag, which would have placed a Google script and an advertising cookie on our pages — including the pages where crews file hazard reports. We were not willing to do that. It is also why this site has no cookie banner: there are no advertising or analytics cookies to ask you about.
If you would rather not be counted, clearing this site's data in your browser removes the stored click id, and nothing further is sent.
Counting how the site is used
Our public pages and the signup page count a few anonymous steps, so we can see where people stop: a page opened, a button pressed, how far down a page was read, a signup step reached. Each count carries the page, whether the visit came from one of our ads (yes or no, never the click id), and a random number your browser keeps only until you close the tab. We store no name, email, IP address or device details with it, and it uses no cookie.
The free readiness check
The readiness check at squawksms.com/readiness works in your browser and needs no account. If you ask us to email the report, we keep the address you give, the company name if you add one, and your answers, so we can send it and see how the check is used. You get the report once. We email you again only if you tick the box for deadline reminders, and you can ask us to delete all of it at any time. A one-way hash of your IP address is kept for an hour or so of rate limiting; the address itself is not stored.
Who processes data for us
| Processor | Why | Where |
|---|---|---|
| Supabase | Database, authentication, file storage | United States |
| Cloudflare | Serving the web application | Global edge network |
| Stripe | Payments and subscriptions | United States |
| Google Workspace | Email we send you | United States |
| Google Ads | Ad click id and sale value only — see Measuring our advertising | United States |
If we add a processor that handles your safety content, we will list it here and tell account administrators before it starts.
Automated analysis of reports
We have built an assistant that would read a hazard report and draft a risk classification and a risk assessment for a person to accept, amend or reject. It would never be the decision-maker: a named person signs off, as Part 5 requires.
It is switched off, and no customer content has been sent to any such service. We have not enabled it for any account, and the product has no credentials to reach one. We are holding it deliberately: the free text of an anonymous report can identify the person who filed it even with every name removed, and we are not willing to send that anywhere until we are certain the anonymity promise above survives it.
If we enable it, it will be something an operator switches on rather than something that happens to them, we will name the provider and list exactly what is sent in this section first, and we will tell account administrators before it starts.
How long we keep it
Safety records are append-only while your account is live: corrections supersede records rather than replacing them, so the history stays intact. That is what makes the record credible to an inspector, and it means individual records cannot be deleted on request.
Aviation recordkeeping obligations under 14 CFR § 5.97 are yours, not ours. We will not delete your account's records without your instruction, and when you instruct us to delete an account we do so permanently. Diagnostics are kept only as long as they are useful for fixing the problem.
Your rights
- Access and export. You can export your data from the product at any time while your account is active.
- Correction. You can correct account and operator details yourself. Safety records are corrected by superseding them, which preserves both versions.
- Deletion. Ask us to delete your account and we will, permanently. Tell us first if you have retention obligations that depend on it.
- Depending on where you live you may have further rights, including under the California Consumer Privacy Act. Write to us and we will honour them.
Security
Every table is protected by row-level security, so one operator's data is unreachable from another's session — a property we test rather than assume. Access to your content by our staff requires a grant you issue. We are not SOC 2 certified today; if that matters to your procurement, ask us where we are with it and we will tell you honestly.
Children
SquawkSMS is a business product and is not directed at anyone under 18.
Changes
If we change this policy in a way that materially affects you, we will email the account's accountable executive before it takes effect, and the version and date at the top of this page will change.