Last updated: [TODO: owner to fill — date this goes live]
Aeroster is a small tool that lets a pilot upload their own roster, read it back in a usable shape, and share it with the people they choose. This page says exactly what it holds, why, and for how long. It is short on purpose.
The two rules everything else follows from
1. Everything here was put here by the pilot it belongs to. Aeroster does not read airline systems, does not scrape anything, and has no source of roster data other than a pilot uploading their own roster. There is no way to add a colleague's roster, and nobody can be entered into the app by anyone but themselves.
2. What is kept, this page tells you. A roster tells you what is coming. Once a day has been flown it is history, and Aeroster does not want to be the place that history lives — but today nothing here deletes anything on its own. The table further down says, line by line, what is held and for how long, and says "indefinitely" wherever that is the truth.
Why the app exists
Personal, family and household planning. Knowing when you are home, when a colleague you already know is on the same flight, and being able to show your family where you are today.
Aeroster is not a crew-data service, not a rostering tool, and not run by or for any airline.
What is stored
Your account. Your email address, a hash of your password (never the password), your crew code, your rank, your home base if you set one, your airline, when you registered, when you last signed in, and whether the account is active.
Your roster. For each upload: the days, each day's duty, check-in and check-out times, and for flying days each leg — flight number, departure and arrival airport, and start and end times in UTC. Standby periods are stored the same way. The licence and recurrent-check codes printed on the roster, with their issue and expiry dates, are stored with the upload. The annual-leave summary table printed under the roster is deliberately not read at all.
What you uploaded, as you uploaded it. A photograph or a typed transcription, plus what the reader made of it, so that a bad reading can be checked against the original instead of guessed at. The photograph and the per-day crops cut from it are kept — today, nothing deletes them once you have confirmed the review, though that is meant to change.
Who you are connected to. Aeroster is invite-only. It records who invited whom, so a link between two pilots is traceable to a decision somebody made. It also records which of your connections you have chosen to hide from your own calendar.
Email addresses you invite. When you invite someone, the address you typed is stored with the invitation so the link can only be used by that address. If the invitation is never accepted, the address stays on record — today nothing removes it.
Nothing else. No location data, no device fingerprinting, no analytics, no advertising identifiers, no tracking of what you click.
What is not stored
Aeroster never holds another pilot's name, crew code, roster or contact details unless that pilot put them there themselves, from their own account. There is no import, no directory and no lookup. There is one thing a non-member can leave behind: if you type a colleague's email address or crew code into the Share form, it is recorded with the attempt before it is looked up, whether or not it turns out to belong to a member — tidied up first, an address lower-cased and a crew code upper-cased, rather than stored exactly as typed — and today nothing removes it. Nothing else about them is held. If an address belongs to nobody here and you are allowed to invite, it is also sent one invitation email naming your crew code, and the address stays on record with that invitation.
That is a deliberate design constraint, not a courtesy. Collecting colleagues' crew data is a matter for your employer and your contract, and Aeroster is built so it cannot become a way around that.
How long it is kept
Nothing described below as retained "indefinitely" is a design choice — it is the current, unfinished state. Purging what has stopped being useful is planned work, not yet built.
| What | Kept for |
|---|---|
| Account details | While the account exists |
| Roster days, legs and standby periods | Kept indefinitely today (meant to end once the day has passed) |
| Uploaded photograph and crops | Kept indefinitely today (meant to end once you confirm the review) |
| Typed transcription and the reader's output | Kept indefinitely today, alongside the upload |
| Licence and check expiry dates | Kept indefinitely today, alongside the upload they came from |
| Invitations | Kept indefinitely today, whether accepted or not |
| Family links you have made | Kept indefinitely today, including after you revoke one |
| Family devices that have passed the PIN | Until you sign that device out, revoke its link or issue a new one; an expired one is not swept today |
| PIN attempts on a family link | Kept indefinitely today, right or wrong. Each holds a daily-rotating hash of the visitor’s address, never the address itself |
| Password reset requests | [TODO: owner to fill — intended retention] |
| Server logs (web and mail) | [TODO: owner to fill — the real nginx and Postfix retention on the host] |
| Session cookie | Seven days, or thirty if you ticked “remember me” |
Who is responsible for it
The controller is [TODO: owner to fill — name or company, postal address, contact email]. Questions and requests go to [TODO: owner to fill — privacy contact address].
[TODO: owner to fill — whether a data protection officer is required; for an operation this size almost certainly not, but say so rather than leave it blank]
Where it is kept
On a single rented virtual server in the European Union, operated by Hetzner [TODO: owner to fill — confirm the datacentre country: the host's reverse DNS is a your-server.de address, so Germany is likely, but confirm before printing it]. Database, uploaded files and mail all live on that one machine. Nothing is copied to another country and no part of the service runs outside the EU.
[TODO: owner to fill — where backups go, how long they are kept, and whether they leave that machine; if there are none, say so instead]
Legal basis
- Your account and your roster: the contract between you and Aeroster. You asked for an account and uploaded a roster so the service could do the thing it does.
- Keeping the service secure and working — session handling, blocking abuse, server logs: legitimate interest.
- Invitations: legitimate interest in letting pilots bring in people they know, balanced against the fact that only an email address is held — kept indefinitely today, accepted or not, as the table above says — and the message says plainly who sent it.
No processing here relies on consent, so there is no consent to withdraw. An account can be deactivated, which stops it being used and takes it out of other pilots' views, but deactivating deletes nothing: there is no account deletion in the app today. See “Your rights” below.
What other pilots can see
Another pilot can see your flights only where the two of you have a share that is accepted. An invitation on its own is not that: a share is offered and accepted as its own decision — an invitation can carry an offer to share, and the person registering chooses whether to take it.
From the Shares screen you can decline an offer, cancel one you sent, revoke a share that is already running, or block a pilot so that no further share can be opened with them. Revoking or blocking takes effect immediately — you do not have to have refused the invitation in the first place.
Separately, you can hide any connection from your own calendar, but that changes what you see, not what they see. Revoking the share is the one that changes what they see.
Sharing with your family
You can give one long, secret web address to the people you live with. Anyone who opens it and knows the four-digit PIN you chose sees one page: what you are doing today, and the month around it. They never make an account, and they never see the rest of the app.
The link is the secret, and the PIN guards it. The address itself is unguessable, and the PIN is asked for the first time each device opens it. Wrong PINs slow down and then stop, which works because every attempt, right or wrong, is recorded on our server: a daily-rotating hash of the address it came from (never the address itself), whether the PIN was right, and, when the link was recognised, which link it was. Send the link and the PIN separately — a message with both in it is the whole thing in one place.
What they can see: your duty days — airports, flight numbers, times, days off — for one pilot, you, and the first name you chose to be called by on that page. Days already flown are never added, so months before the current one are empty — but a day that has passed since the roster was uploaded is still there until you upload over it.
What they cannot see: your crew code, your airline, your email address, the aircraft registration, and — this is the important one — any other pilot. Nobody you fly with appears on that page in any form, not as a name, not as a crew code, not as a mark on a day. It is your roster only.
You can take it back. From the Family screen you can set a new PIN (the link keeps working), issue a new link (the old address stops working immediately, everywhere), revoke the link entirely, or sign out one device and leave the others alone. Any of those takes effect on the next page load.
What that page fetches. When it shows a flight, our server — never the family member's browser — asks three outside services for three small things: Open-Meteo for the weather at a pair of coordinates, NOAA for an airport's published weather report by its ICAO code, and Google for a picture of the route between two pairs of coordinates. Those services see our server asking about an airport or a route. They do not see who is reading the page, and they are told nothing about you.
The page is marked not to be indexed by search engines, sends no referrer, and is not cached. Two cookies are set on the family member's device: one that remembers the device has passed the PIN, and one short-lived one that protects the PIN form itself. Neither carries anything about you or about them.
Cookies
One cookie on the signed-in app: the session cookie. It holds a random identifier that tells the server you are signed in. It is not read by anyone else, it carries nothing about you, and it is not used for tracking or measurement. (The family page is a separate address with its own two cookies, described in the section above; they are never set here.)
It lasts a week, or thirty days if you ticked "remember me on this device", counting from your most recent visit. Signing out ends it immediately. There is no advertising cookie and no analytics cookie, and nothing here measures or tracks you. One request does leave your browser for another company: the avatar picture described below, which your browser fetches from Gravatar. We do not set a cookie through it and cannot read one, but we cannot promise on Gravatar's behalf that it sets none.
Other companies
Aeroster is built to avoid third parties: every page, font, icon and script is served from its own server, and the one thing your browser fetches from anywhere else is the Gravatar avatar picture below. The exceptions are these:
Email. Invitations, password reset links and notifications are sent from Aeroster's own mail server. Once a message leaves, it is handled by whoever runs the recipient's mailbox — Google, Microsoft, or an airline's own mail system. They see the recipient address, the sender, the subject and the message. Aeroster does not put roster contents in email.
Avatars. Where a pilot has a picture registered with Gravatar, Aeroster shows it — and your own browser fetches it from Gravatar directly, using a hash of that pilot's email address, so Gravatar sees the request arriving from whoever is reading the page rather than from our server. Where there is no picture, Gravatar answers with nothing and your browser shows initials instead — the request is still made.
Maps and weather on the family page. Three requests leave our server when a family page shows a flight, and all three are made by our server, never from the family member's browser: Open-Meteo gets a pair of coordinates — an airport's — and returns the weather there; NOAA gets an ICAO airport code and returns that airport's published weather report; Google gets two pairs of coordinates and returns a picture of the route between them. None of them is told who asked, when the page was opened, or anything about the pilot. See the section above for the rest of how that page works.
Google Calendar. Your profile can issue one fixed URL that a calendar app subscribes to. Nothing is sent anywhere until you do that; once you do, whoever runs that calendar — Google, Apple, or whatever you subscribed with — fetches and stores the feed on their own schedule, and once your roster is there this page no longer governs it. That is your decision to make, and unsubscribing and revoking the URL undo it. The feed carries the last two days and everything ahead of them; days older than that stop being sent, so they leave the subscribed calendar on its next refresh. That deletes nothing here — the roster itself stays in Aeroster, and what the retention table below says still holds. Anyone who has the URL can read the feed, which is why it is shown once and can be regenerated or revoked at any time. The only thing in it about another pilot is a first name, and only where you share a roster with them and they have filled one in.
Aeroster does not sell anything, shares nothing with anyone for their own purposes, and has no advertising.
Your rights
Under the GDPR you can:
- See what is held about you.
- Correct anything wrong. Most of it you can edit yourself; for crew code and rank, ask.
- Have it deleted. [TODO: owner to fill — the honest sentence here depends on what closing an account actually does once thread I and account deletion exist; today no account can be deleted, only deactivated]
- Take it with you. Ask for your rosters as a file you can use elsewhere.
- Object to anything relied on as a legitimate interest.
- Complain to a data protection authority — your own country's, or [TODO: owner to fill — the authority for the controller's country].
Write to [TODO: owner to fill — contact address]. An answer within a month, usually much sooner: this is a small service and there is not much to look up.
Security
Passwords are stored as hashes, never as passwords. The site is HTTPS-only. Uploaded images are re-encoded on arrival, so a file that is both a picture and something executable does not survive the trip, and they are stored outside the web root where no URL can reach them. The session directory belongs to this application alone.
This is a small service run by one person on one server. It is not certified, not audited, and makes no claim beyond doing the ordinary things properly.
A note for pilots
Your employer very likely has rules about crew data — Ryanair Group's own June 2026 memo is explicit that collecting or sharing colleagues' names, crew codes or rostered flights outside your role breaches your contract, and it names photographing such data specifically.
Aeroster is built to sit on the right side of that. It holds your roster, uploaded by you, about you. It has no way to hold anybody else's. Your own photograph of your own roster remains a matter between you and your employer's policy, and this app cannot and does not advise you on it.
Changes
If this page changes, the date at the top changes and anyone with an account is told by email before anything material takes effect.
Terms of use, in one paragraph
Aeroster is provided as-is, free, with no guarantee of availability or accuracy. The reader gets rosters wrong sometimes, which is why every upload is shown to you for review. Never use Aeroster as the source of truth for a duty. Your airline's own roster is the only roster that counts. Do not upload anyone's roster but your own.
[TODO: owner to fill — whether a fuller terms page is wanted, and under which country's law]