1. Who we are

SkyYoke ("we", "us", "the app") is the developer and data controller of the SkyYoke iPhone application. You can reach us about privacy at support@menumeld.com or via ifkits.com.

This policy explains what information the app handles, how and why, who it is shared with, how long it is kept, and the rights you have. It covers the app only — not the third‑party simulators (Infinite Flight, Microsoft Flight Simulator) you connect it to, which are operated by their own companies under their own policies.

2. Information we handle

a. Data that never leaves your device

The following is processed only on your iPhone and is not collected, transmitted to us, or stored on our servers:

• Microphone audio & speech — used only by the optional AI Voice Copilot, transcribed on‑device by Apple's Speech framework (forced on‑device). Audio and transcripts are processed in real time and discarded.
• Device motion (accelerometer/gyroscope) — used to drive the tilt yoke.
• Flight data read from your simulator — aircraft position, heading, altitude, speed, traffic, weather, systems and ATC messages. This is read live over your local network for display and control, kept in memory, and not persisted.
• Your control inputs — sent over the local network only to the simulator device you are controlling.
• App settings — control‑tuning preferences, your last‑used connection (host IP address), selected simulator and display units, stored locally on your device (in iOS UserDefaults).

b. Account information (only if you sign in)

Signing in is optional and uses Sign in with Apple. If you sign in we receive and store, through our authentication provider (Supabase):

• your email address (you may use Apple's "Hide My Email" private relay),
• your name, if you choose to share it, and
• a randomly generated account identifier (a UUID) that links your subscription and settings.

Your authentication session/token is stored securely on your device (iOS Keychain).

c. Subscription & purchase information (only if you subscribe)

In‑app purchases are processed by Apple and managed via RevenueCat. We do not receive or store your payment card or full Apple Account details. We do store subscription metadata tied to your account identifier: active status, plan/entitlement, product identifier, store, environment (production/sandbox) and expiry date.

d. AI usage and AI assistant content (subscriber features)

• AI usage counters. For any AI feature that runs through our servers we record per‑day counts (number of requests and token totals) tied to your account identifier, to enforce fair‑use limits. We do not store the content of your prompts on our servers.
• Cloud AI assistant content. If you use a cloud‑based AI assistant feature, the text you type is sent through our secure proxy to Google's Gemini API to generate a response. That text is processed by Google subject to Google's terms; we do not retain it. (Note: the speech/voice copilot described above is separate and stays on your device.)

e. Technical & diagnostic data

Our backend providers may process standard technical information in server logs for security and to operate the service. When the app requests or downloads the optional Kokoro voice model, Supabase Storage and its CDN may process standard HTTP and network information, including your IP address, User-Agent, request time, response status, and related technical network and server logs, to authenticate the request, deliver the files, secure the service, and diagnose failures.

The checklist text used for speech, generated audio, and Kokoro inference remain on your device. The model download does not send checklist text or audio to Supabase, and it is not used for advertising or cross-app tracking.

f. Advertising measurement & attribution

To measure how our advertising performs — for example, to learn which campaigns bring people to the app — the app includes the TikTok and Meta (Facebook) attribution SDKs. These report a limited set of app events (such as first launch, app opens and completed purchases, including the purchase amount, currency, product identifier and transaction identifier), together with standard technical device information, to TikTok and Meta so an install or purchase can be matched to the ad you saw. TikTok and Meta may also use this data under their own privacy policies, including to help show you more relevant ads.

Because this counts as tracking under Apple's rules, the app shows the iOS App Tracking Transparency prompt. Your device's advertising identifier (IDFA) is shared only if you tap "Allow". If you choose "Ask App Not to Track" (or turn tracking off in iOS Settings), no advertising identifier is collected and attribution falls back to Apple's privacy‑preserving SKAdNetwork, which reports installs and conversions only in aggregate, without identifying you. These SDKs never read your flight data, account information or AI content.

3. How we use information and our legal bases

Purpose	Data	Legal basis (GDPR/UK GDPR)
Provide the controller (connect to your simulator)	Local network, control inputs, settings	Performance of a contract; legitimate interests
Create and maintain your account	Email, name, account ID	Performance of a contract
Provide and verify subscriptions	Purchase/subscription metadata	Performance of a contract; legal obligation (records)
Provide AI features and enforce fair use	AI usage counts; prompt text (cloud AI)	Performance of a contract; legitimate interests; consent
On‑device voice control	Microphone, speech	Consent (device permission); processed on‑device
Deliver the optional on‑device voice model	IP address, User-Agent, model-download network/server logs	Performance of a contract; legitimate interests
Security, abuse prevention, debugging	Technical/server logs	Legitimate interests; legal obligation
Measure advertising performance (attribution) and show more relevant ads	App events (install, purchase); advertising identifier (only with your consent); technical device info	Consent (ATT / advertising identifier); legitimate interests (aggregate measurement)

4. Who we share information with

If you allow tracking, the app shares a limited set of advertising data — your device's advertising identifier and app‑event data such as installs and purchases — with our advertising partners TikTok and Meta. They act as independent third parties and use this data under their own privacy policies to measure ad performance and, as noted in the App Tracking Transparency prompt, to help show you more relevant ads. We do not sell your personal information for money; however, under some U.S. state privacy laws (such as California's CCPA/CPRA) this advertising activity may be treated as a "sale" and/or "sharing" for cross‑context behavioral advertising, and you can opt out at any time by declining the tracking prompt or turning tracking off in iOS Settings. Apart from that advertising, we do not share your personal information for cross‑context behavioral advertising. The companies we work with — our backend processors and our advertising partners — are:

• Apple — Sign in with Apple, App Store purchases, on‑device speech and Apple Intelligence. (Apple Privacy)
• Supabase — authentication, backend hosting, and optional Kokoro voice-model delivery through Storage/CDN (account, subscription and usage records; standard model-download network/server logs). (Supabase Privacy)
• RevenueCat — subscription management. (RevenueCat Privacy)
• Google — the Gemini API, only when you use the cloud AI assistant. (Google Privacy)
• TikTok — advertising partner (independent third party); ad attribution, measurement and more relevant ads, only if you allow tracking. (TikTok Privacy)
• Meta (Facebook) — advertising partner (independent third party); ad attribution, measurement and more relevant ads, only if you allow tracking. (Meta Privacy)

We may also disclose information if required by law, or to protect our rights, users, or the public.

5. International data transfers

Our providers (Apple, Supabase, RevenueCat, Google, TikTok, Meta) may process data on servers located in the United States and other countries. Where required, such transfers rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.

6. Data retention

On‑device and live flight data are not retained by us. Account, subscription and AI‑usage records are kept for as long as your account is active and for a reasonable period afterwards to meet legal, tax and accounting obligations, then deleted or anonymized. You can request deletion at any time (see Section 8).

7. Security

Connections to our backend use HTTPS/TLS. Server secrets (AI and payment keys) are held only on the server and never in the app. Database access is restricted by row‑level security so each signed‑in user can read only their own records. No method of transmission or storage is 100% secure, but we take reasonable measures to protect your information.

8. Your rights and choices

Depending on where you live (e.g. the EEA/UK under the GDPR, or California under the CCPA/CPRA), you may have the right to access, correct, delete, port, or restrict/object to the processing of your personal information, and to withdraw consent. California residents have the right to know, to delete, to correct, and to not be discriminated against for exercising these rights; we do not sell or share personal information.

• Delete your account & data: use the in‑app "Delete Account" option where available, or email support@menumeld.com. We will delete your account and associated records (subscription and AI‑usage data) within 30 days, subject to any records we must keep by law.
• Permissions: you can turn off Microphone, Speech Recognition, Local Network or Motion access at any time in iOS Settings; the related features will simply be unavailable.
• Advertising & tracking: decline the App Tracking Transparency prompt, or turn tracking off any time in iOS Settings → Privacy & Security → Tracking; the app will then not collect your advertising identifier and ad measurement falls back to Apple's aggregate SKAdNetwork.
• To exercise any other right, contact us at the address above. We will respond within the time required by applicable law.

9. Children's privacy

The app is not directed to children under 13 (or the equivalent minimum age in your country, such as 16 in parts of the EEA) and we do not knowingly collect personal information from them. If you believe a child has provided us personal information, contact us and we will delete it.

10. Third‑party simulators

SkyYoke is an independent, unofficial app and is not affiliated with, sponsored by, or endorsed by Infinite Flight LLC or Microsoft. When you connect the app to a simulator, you are communicating with software you run on your own device over your own network; that software is governed by its own publisher's terms and privacy policy.

11. Changes to this policy

We may update this policy from time to time. We will change the "Last updated" date above and, for material changes, provide a more prominent notice. Your continued use of the app after an update means you accept the revised policy.