Connection: privacy

Connection privacy
Effective 27 October 2026.
Provided by Moola. Support: https://project-moola-401d0.web.app/support

You can try Connection without an account. Flights you add before unlocking stay on your phone only. Signing in creates a Connection account so your trips can follow you to your other phones once you unlock. Account data includes your Firebase account identifier and the sign-in details you choose: with Sign in with Apple, an email address (which can be an Apple private relay address); with Google, your Google account email, name and profile photo link, which Firebase Authentication stores with the sign-in; or your mobile number if you sign in with a text-message code. After you unlock, your trips are stored in your account: flight numbers, airports, booked times, gates, seats, whether your flights are on one ticket, and the walking and passport times you set.

Connection learns flight times from its travellers, so the next person adding the same flight gets them filled in. When a flight in your unlocked account has times you set from your booking, its flight number, route, date and times (rounded to five minutes) are added to a shared table of flight times. Our server also adds the times it saw a followed flight leave and arrive. Nothing in that table identifies you, and anyone using Connection can look up a flight's times in it. Your account keeps a note of what each of your flights added, so a correction replaces your earlier times; that note is deleted with your account, and the anonymous times stay in the table.

Google Firebase supplies authentication, Firestore, Cloud Functions, Cloud Messaging, app attestation and hosting. Apple's Push Notification service delivers alerts and Lock Screen updates to iPhones. We use these services to keep your trips across phones, recover your account, send change alerts, prevent unauthorized access and process deletion. Firestore and Cloud Functions run in the Netherlands (Google Cloud europe-west4); other Google services may process data outside your country under the providers' terms and safeguards. Device and app integrity checks and service infrastructure may process technical identifiers, IP addresses and diagnostic request information. We do not claim end-to-end encryption. Apple and Google provide their sign-in services under their own policies, and Firebase Authentication sends phone sign-in codes by text message to the number you enter. Connection has no advertising, analytics or crash-reporting service and no external AI.

Live flight positions come from open aircraft data published by adsb.lol. While Connection is open, your phone asks adsb.lol for the flights you follow, by callsign or by the area around an airport. Those requests carry your phone's IP address but no account information. Our server makes the same kind of request for flights in unlocked accounts. Airport, airline, route and usual-time tables are public files downloaded from Moola's hosting and kept on your phone for a week.

If you allow location, Connection uses your phone's GPS while you are on a flight to keep your arrival estimate and connection current with no wifi, and to show what is out your window. Those readings stay on your phone. The latest flight's readings are kept so that a restart at the gate still knows when you landed; they are replaced by your next flight and removed when you sign out. You can turn this off in Settings or for a single flight. If you turn on "Share my flight's position" (off unless you choose it), Connection sends readings for a flight in your own trip (time, position, altitude and speed, with no name or account identifier) to a shared flight record that other Connection users following the same flight can read. Shared records are deleted automatically a week after the last update.

If you allow notifications, your phone's push tokens are stored in your account so we can send alerts when a time or your connection changes: a Firebase Cloud Messaging token and, on iPhone, its Apple push token and whether the app is a test or store build. Alerts reach iPhones through Apple's Push Notification service and Android phones through Firebase Cloud Messaging. While a flight shows on your Lock Screen, that Live Activity's push token and which flight it shows are stored too, so we can keep it current while the app is closed. Signing out removes these tokens. Alert history used to avoid repeats is deleted automatically 14 days after its last change.

Apple or Google processes purchases and payment details under its own policies. Connection receives product, environment, transaction or purchase-reference information and an opaque account association to verify the one-time unlock, restore access, prevent duplicate ownership and handle refunds. We do not receive your full card details. Store test transactions do not grant normal purchase rights.

Your phone stores your preview trips, preferences, a random install identifier for alerts, a week-long copy of the public tables and, after you unlock, an offline copy of your account's trips. Signing out clears the offline copy of your account's trips from this phone; your preview trips and preferences stay until you delete the app. Android app backup is disabled; other platform backups follow your device settings.

Your trips remain until you remove them or delete your account. Deletion removes Connection's live account records: trips, devices, alert history, notes of the flight times your trips added, purchase status and the billing-account mapping, and your Connection membership. Your shared Firebase sign-in is removed only if no other Moola app uses it. Completed deletion records and inactive membership markers are scheduled to expire after 30 days. Minimum detached store references may be retained for up to 90 days after deletion for refund and fraud reconciliation, then scheduled for removal. The original store keeps its own transaction records under its policies. Removal by expiry is asynchronous. A purchase linked to a deleted account needs support to recover; it is never silently transferred to a new account.

Our deletion completion confirms removal of the live application records. It does not claim instant erasure of provider infrastructure backups: Firebase describes authentication removal from live and backup systems within up to 180 days after its customer initiates deletion. Scheduled Firestore backups and infrastructure retention follow their configured and provider periods. We cannot remove exports, device backups or copies on phones that stay offline; a phone must reconnect to learn that access has been revoked. Operational cloud logs are intended to keep only technical request and error information, not trip contents or credentials, for the configured 30-day period.

You can export your trips, correct them and delete your account in the app, all without paying. If you cannot use the app, request deletion from Moola support (https://project-moola-401d0.web.app/support) using the email address or mobile number linked to your account. We confirm ownership without asking for a password or sign-in code and aim to resolve such requests within 30 days. Support correspondence is kept for 12 months after the issue closes, unless an unresolved dispute or legal obligation requires longer. Request access, correction or removal the same way. Your statutory rights and complaint routes remain available. Connection is not directed at children under 13.

Provider information: https://firebase.google.com/support/privacy, https://www.apple.com/legal/privacy/, https://policies.google.com/privacy and https://adsb.lol. Changes to collection or purpose will be reflected here before the changed service is released.