Privacy policy

• Account data — name, email and login details (if you create an account).
• Training data — your practice sessions, scores, radio-call transcripts and progress.
• Preferences — settings like your callsign and home airfield, stored in your browser.
• Payment data — handled by Stripe; we never see your full card details.
• Usage/technical data — basic logs needed to run the service.
• Consent records — whether you opted in to marketing email, when, from where (e.g. signup or settings), and the exact wording you were shown.
• Email records — which lifecycle emails we sent you and when, and whether you unsubscribed.

We send two different kinds of email, and they follow different rules.

• Service (transactional) email — things you need in order to use what you’ve asked for: account confirmation and password resets, lesson bookings and changes, invitations you or your instructor triggered, receipts, and notice that paid access is about to end. These are sent on the basis of our contract with you and our legitimate interest in running the service. You can’t unsubscribe from these while you hold an account, because without them the service doesn’t work.
• Marketing email — optional nudges, training tips, product news and offers. These are opt-in only. The box is never pre-ticked, and if you don’t tick it you will never receive one. Our sending code checks your consent on every single marketing send, so withdrawing consent takes effect immediately rather than at the end of a queued campaign.

Withdrawing consent. Every marketing email carries a one-click unsubscribe link that works without logging in. You can also turn marketing email off at any time in your account settings, or email us. Unsubscribing adds your address to a suppression list and invalidates the unsubscribe link you used, so it can’t be re-used by anyone else. Withdrawing consent doesn’t affect the lawfulness of anything we sent beforehand, and doesn’t stop service email.

We don’t sell or rent your email address, we don’t share it with other advertisers, and we don’t use it to build advertising profiles on other platforms.

When you join a school or instructor on TowerTalk, they can see your training work so they can teach you — your practice sessions, scores and phraseology history. Radio debriefs stay private unless you share them individually.

Two limits worth knowing. If you book a tutor yourself through our public directory, they see only the work you do from the date you booked them onwards, not your whole history. And a school may bring in a covering instructor to teach you — that instructor can see your training history for as long as they are teaching you, on the school's behalf.

You can see which schools or instructors you are linked to in your account, and ask us to remove a link at any time.

• UK / EU / EEA: under UK & EU GDPR you can access, correct, delete, restrict, port or object to processing, and complain to your supervisory authority (in the UK, the ICO).
• California (US): under the CCPA/CPRA you can know, delete, correct and opt out of “sale”/“sharing” of personal information; we don’t sell your data.
• Other countries: you keep any data-protection rights granted by your local law, which we honour where they apply.