When you create a PiLNK account, we collect:

• Your callsign (chosen by you)
• Your email address
• A hashed (encrypted) password — we never store your password in plain text
• Optional: location, bio, and profile details you choose to provide

When you use the PiLNK platform, we also collect:

• Forum posts, replies, and messages you send
• Watchlist items and alert preferences
• Node registration details (if you register a Pi node)
• Aircraft telemetry data received by your node (ADS-B position reports)
• Your last seen timestamp for online status
• Basic usage data (page visits via Google Analytics)

If you sign in with Google, we receive your name and email address from Google. No other Google account data is accessed.

Your data is used to operate the PiLNK platform and nothing else:

• To create and manage your account
• To display your callsign, posts, and profile within the community
• To send watchlist alerts when tracked aircraft enter your coverage area
• To contribute your node's ADS-B coverage to the shared network map
• To send account-related emails (verification, password reset)
• To display anonymous usage statistics (Google Analytics)

We do not sell your data. We do not share your data with third parties except as required to operate the service (e.g. email delivery). We do not serve advertising.

ADS-B aircraft telemetry data received by your node is shared with the PiLNK community network. This data originates from publicly broadcast radio signals and does not contain personal information.

When you install PiLNK on a Raspberry Pi, you provide your station's latitude and longitude. We use this in two distinct ways:

• On your own dashboard — your exact coordinates are used to draw range rings, calculate distances to aircraft, and compute coverage statistics. These are private to you and never exposed.
• On the public network map — your coordinates are jittered by a stable per-node offset within a 5 km radius before being sent to other users' browsers. A 5 km approximation ring is drawn at city and street zoom levels. The result is that no one else can locate your station more precisely than within roughly a 10 km area.

The jitter is deterministic per node, so the displayed position is identical across page loads — it cannot be triangulated by averaging multiple requests. Your real coordinates never leave the server in response to public API queries.

If you wish to share your exact location publicly (some operators choose to), an opt-in toggle will be added to your profile in a future release. Until then, all nodes default to the privacy-preserving approximate mode.

You can delete your account at any time by contacting us. Upon deletion, your personal data will be removed from our systems within 30 days.

You can update or correct your profile information at any time from your profile page.

We retain forum posts after account deletion in anonymised form to preserve community discussions, unless you specifically request full removal.

PiLNK uses a session cookie to keep you logged in. No tracking cookies are used beyond Google Analytics, which collects anonymous page view data to help us understand how the platform is used.

We use Google reCAPTCHA v3 on the signup, sign-in, and password recovery forms to block automated abuse. reCAPTCHA is invisible — there is no checkbox or puzzle — but it does send a small amount of data to Google about your interaction with the page (a browser fingerprint, mouse movement signals, and your IP address) so Google can score the request from 0 to 1. We use that score only to allow or block the form submission. We do not see your interaction data; we receive only the score. Use of reCAPTCHA is subject to Google's Privacy Policy and Terms of Service.

PiLNK products are ad-free. No advertising networks or data brokers receive your information.

Passwords are hashed using bcrypt. All connections are encrypted via HTTPS. We use CSRF tokens to protect against cross-site request forgery. We do not store payment information — all transactions are handled by third-party processors.

Remote Assist lets you share read-only diagnostic information from your node with PiLNK support so we can help you troubleshoot a problem. It is built privacy-first, and the most important points are guarantees built into how the system works — not promises we ask you to take on trust:

• We can never connect to your node. By design, there is no inbound path for us to reach your node at all. Your node only ever reaches out to PiLNK — the same way it sends its normal data — so there is simply no door for us to open.
• You must start every session yourself. The only way a support session can begin is if you press "Request Assist" on your own node's dashboard. We cannot start one, schedule one, or re-open a previous one. No action by you means no access — without exception.
• It is strictly read-only. During a session we can request only a fixed, published list of diagnostic readings (such as your node's aircraft counts, decoder status, software version, and recent log lines). The system is not capable of changing settings, running arbitrary commands, accessing your files, or making any modification to your node or network.
• It is time-limited. A session automatically closes itself after 30 minutes.
• You stay in control. While a session is open you can see that it is active, and you can end it yourself at any moment.
• It is logged. Every diagnostic reading taken during a session is recorded, so there is a complete record of exactly what was accessed and when. Nothing happens silently.

What a session can expose: the diagnostic readings listed above relate to the technical health of your node and its software. They do not include your password, your account credentials, or the contents of personal files. The aircraft data your node handles is already publicly broadcast radio signal and contains no personal information.

Retention: diagnostic results from a session are kept only to support the troubleshooting it was opened for, and session records are routinely cleared on a rolling basis (currently within 7 days). Only PiLNK support (the site operator) can view session results.

Remote Assist is entirely optional. If you never open a session, it never does anything — it sits dormant on your node unless and until you choose to use it.