flyit: Privacy Policy
- Status
- Current version
- Language
- English
- Effective date
- From publication on the website
- Last updated
- October 28, 2026
This policy covers the processing of personal data in the flyit mobile app for Android (in app stores it may be listed as MyFlty, package com.flyit.app) and its server (the “App”). The operator is Limited Liability Company “MAXOS” (INN 2635269311, OGRN 1262600004677), “LLC “MAXOS”” or “we”. The policy is issued under Article 18.1(2) of Russian Federal Law No. 152-FZ “On Personal Data” of 27.07.2006. The MAXOS website has a separate policy.
1.General
The policy covers the App, its server and the web pages the server creates at your request (the “follow my flight” link). The App is in development (alpha). When new features that process data appear, this policy is updated before they launch.
Where consent to personal data processing is required, it is given as a separate document, “flyit: Consent to Personal Data Processing”. This policy is not a consent in itself.
2.What data, why and on what basis
Bases under Article 6(1) of 152-FZ: “contract” is item 5 (performing the flyit Terms of Use), “consent” is item 1, “legitimate interest” is item 7, “law” is item 2.
| Feature | Data | Purpose | Basis | Where stored |
|---|---|---|---|---|
| Sign-in | short-lived Yandex ID or VK ID token; ID and name in the sign-in service; App session token | create an account and sign in without a password | contract | server; session token on the device |
| Profile details (optional) | first and last name, nickname, email, phone, date of birth | show you in the App and in notifications | consent | server |
| Profile photo (optional) | the image you chose | account avatar on your devices. The photo is not used to identify you and is not biometric data | consent | server |
| Tickets and flights | boarding pass barcode contents (passenger name in Latin letters, booking code, flight, date, seat, ticket number, loyalty number if in the barcode); flights added manually; trip plan, stage marks | store and sync your trips, show flight status, reminders, widgets | contract | server and device |
| Document import (PDF, image) | text recognised on your device. In e-ticket receipts it may include full name, date of birth, ID document number | find flights and booking code in the document | contract | text goes to the server only for parsing; only the flights found are kept |
| Flight statistics | number of flights, distance, countries, calculated from your tickets | “Statistics” section | contract | server |
| Friends (optional) | your friend code, requests, friend list. Friends you add see your name, nickname, number of flights, distance and number of countries | compare statistics with friends | consent | server |
| Flight chat (optional) | your messages, flight number and date, random alias, send time, reports. Other passengers see only the alias and text; your name and ticket are not shown | let passengers on one flight talk, handle reports, comply with law | consent; law for storage where required | server |
| “Follow my flight” link | flight, date, departure and arrival airports. Anyone with the link can open the page; it has no names or ticket data | show people close to you where your plane is | contract (you create and share the link) | server |
| Live flight, city guide, airport info | flight number, airport and city codes, aircraft coordinates (not yours) | show flight position and reference info | contract | server |
| Partner offers | destination airport code | pick offers for the trip. Partners do not receive your data; after you follow a link the partner’s rules apply | contract | server |
| Contacting us | email, name, message and attachments | reply, handle 152-FZ requests | contract; law for data subject requests | operator’s mailbox |
| Technical logs | IP address, date and time, request URL, response code, account ID | security, abuse prevention, fixing faults | legitimate interest | server |
3.Data kept only on your device
During ordinary use of these sections, the following data stays on the device and is not received by our server. A separate PDF or image import is an exception: recognised text is sent to the server for parsing as described in section 1.2. Storing the original file locally does not mean that recognised text also stays on the device.
- passport details (series, number, citizenship, issue date and authority, subdivision code, international passport expiry), encrypted with an Android Keystore key; screenshots of the passport screen are blocked;
- files in “Documents and boarding passes” (up to 25 MB each), encrypted with an Android Keystore key;
- booking code for online check-in, encrypted; the App does not send it to the airline site itself, the site opens in the browser;
- loyalty cards and cards imported from .pkpass files (name, number, barcode);
- approximate location (see 1.4);
- settings, game results, hidden chat users.
Android backup is turned off for the App. This data is deleted when you delete the account with the in-app button, uninstall the App or clear its data in Android settings. Widgets and notifications show the flight and time on the home and lock screen; you can turn them off. “Add to calendar” hands the flight to the calendar app you choose; from then on the calendar and its sync manage the event.
4.Device permissions
| Permission | Why | Required? |
|---|---|---|
| Camera | scan barcodes of tickets, boarding passes and loyalty cards. The image is recognised on the device (Google ML Kit); only the decoded barcode string goes to the server | only for scanning |
| Approximate location | “You’re at the airport”: if enabled, 4, 3, 2 and 1 hours before departure the App compares the phone’s approximate position with the departure airport and notifies you of terminal and gate. The comparison happens on the device; coordinates are not sent to the server | no |
| Notifications | flight reminders and change alerts | no |
| Exact alarms, start after reboot | so reminders arrive on time and after a reboot | no |
| Internet, network state | talk to the server, warn when offline | yes |
The App gets photos and files only through the system picker or “Share”, and only those you choose. You can revoke permissions in Android settings; a system permission is not consent to personal data processing.
5.Processing operations
Collection, recording, systematisation, accumulation, storage, clarification, retrieval, use, transfer (provision, access) in the cases in 1.6, blocking, deletion and destruction are automated. No decisions with legal effects for you are made solely by automated processing. We do not request special category or biometric data; do not post them in chat or your profile. Local storage of an original document does not imply that recognised text remains on the device: when you separately start PDF or image import, recognised text is sent to the server for parsing as described in section 1.2.
6.Who receives data
We do not sell data or pass it to ad networks. Data goes only to:
- Yandex and VK at sign-in: the server sends them the token for verification, and they learn of the sign-in under their own rules;
- hosting provider operating the server in the Russian Federation, which stores server data on our instruction (Article 6(3) of 152-FZ) and must keep it confidential;
- other users, only what you make visible: friends see name, nickname and statistics; flight passengers see alias and messages; link recipients see the flight and its position;
- public authorities, as and when the law requires.
For schedules and flight positions the server queries external sources (for example the Yandex Schedules API); these requests carry flight number, date and airport codes, not data about you.
Some features load material directly from third-party sites: the Sheremetyevo map (svo.su and 801705.selcdn.ru) and city photos (commons.wikimedia.org). The recipient sees the IP address and technical HTTP request information, which may constitute personal data depending on context. Profile data and ticket contents are not specifically included in these requests. Accessing a foreign resource may involve processing technical data outside Russia; its owner determines its policies and infrastructure.
7.Where data is stored
Recording, systematisation, accumulation, storage, clarification and retrieval of personal data of Russian citizens use databases located in the Russian Federation. Our server does not transfer personal data across borders.
8.Retention
| Data | Period |
|---|---|
| account, profile, photo, tickets, statistics, friends | while the account exists; after deletion no longer than 30 days, including backups |
| imported document text | used only for parsing and not saved |
| flight chat messages | while the account exists; for reports and where the law requires, as long as needed to handle them and comply with the law |
| “follow my flight” links | while the account exists |
| technical logs | no longer than 30 days |
| correspondence | 1 year after the reply |
When the purpose is achieved or consent is withdrawn, data is destroyed within 30 days unless the law requires longer storage (Article 21(4)–(5) of 152-FZ).
9.Security
The App communicates with the server over HTTPS. The encryption measures in section 1.3 apply to passport details, document files and the booking code; this does not mean that every local setting or data item is encrypted. Server access is restricted to people who need it for their work. On discovering an incident covered by Article 21(3.1) of 152-FZ, the operator notifies Roskomnadzor within 24 hours and reports investigation results within 72 hours.
10.Your rights
You may get information about the processing of your data; ask us to correct, block or destroy it; withdraw consent; and complain to Roskomnadzor or a court.
- You can edit your profile and delete tickets, friends, documents and passport details yourself in the App.
- You can delete the account in the App (“Profile” → “Delete account”) or by email, see “flyit: Account Deletion”.
- You can withdraw consent in the App (“Profile” → “Documents” → “Withdraw consent”) or by writing through the contact form on the Contact page or by email to support@maxossoftware.com. After withdrawal we delete data processed on consent (profile, photo, friends, chat messages); the account and tickets remain until you delete them.
- We reply to requests within 10 working days; this may be extended by up to 5 working days with reasons.
11.Age
The App is for people over 14. If you learn that a younger child uses the App, tell us and we will delete the account.
12.Changes
A new version is published on this page with a date. We announce material changes (new data, purposes or recipients) in the App before they take effect and ask for new consent where needed.
13.Operator
Limited Liability Company “MAXOS”, INN 2635269311, OGRN 1262600004677, address: 18 Selskaya St., Stavropol, Stavropol Krai, Russian Federation, 355021. Personal data requests: through the contact form on the Contact page or by email to support@maxossoftware.com or by post to the company address.