Your data

The short version

• We only keep what aerodromes ask for on their own forms, plus your flights and requests.
• Nothing is sent to an aerodrome by us. You read every request and send it yourself.
• Nothing is sold, shared for marketing, or used for advertising. There are no tracking cookies.
• It is stored on a server in the United Kingdom.
• You can download everything we hold, or erase your account and all of it, from the Account page at any time.

Who we are

DronePermit is run by We Are One Apps, which is responsible for your data. Questions or requests: info@weareoneapps.com.

What we keep

Your account. Email address and password. The password is stored only as a scrypt hash, so nobody, including us, can read it back.

Operator and pilot details. Name, company, addresses, phone numbers and email, CAA Operator ID and Flyer ID, operational authorisation and insurance notes, their expiry dates, and the remote pilot's date of birth. NATS asks for the date of birth and home address on its form, which is the only reason those are here. Leave out anything the aerodromes you use don't ask for.

What you add. Drones (model, serial number, mass, class mark), venues, flights (place, date, times, height), and the permission requests prepared for them, including the completed Word forms some aerodromes need.

How the service is used. A simple activity record: when you sign in, add a flight or drone, prepare, send or print a request, and view or complete a payment. It shows us how DronePermit is used so we can improve it.

Anonymous counts. The website also sends a few anonymous counts to We Are One Apps' own statistics page: that the homepage was visited and the name of the site you came from, that the free postcode check was used, and that an account was created, a request prepared, a request marked as sent or a purchase made. It sends only those fixed words, never the postcode, your email or anything you typed, and it sets no cookie.

Server logs. Like every website, the server records the IP address and browser of each request, to keep the service secure and working. These logs are deleted after 14 days.

Payments. Card payments are taken by Stripe. We never see or store card details. We keep only Stripe's reference for your payment and whether your account is paid.

Why

To provide the service you signed up for: checking airspace, preparing permission requests in each aerodrome's own format, remembering them across your devices, and reminding you before deadlines and before your registrations run out. That is the legal basis for almost everything above. The activity record and server logs rely on our legitimate interest in running a secure, working service. Stripe keeps its own records of payments, as the law requires.

We email you only about your account: confirming your address, resetting your password, and reminders about your own flights. No newsletters unless you ask for them.

Where it is stored

On DronePermit's own server in Manchester, United Kingdom, provided by Hostinger. Connections are encrypted. The database is backed up nightly and backups are deleted after 30 days.

Who else sees any of it

Only the services that DronePermit cannot work without, and only the part each one needs:

• The aerodromes you apply to, but only when you send the request yourself.
• Hostinger runs the server and sends DronePermit's emails.
• Stripe takes card payments.
• postcodes.io turns a postcode you type into a location, and OpenStreetMap does the same for an address without one. They receive the postcode or address, not who you are.
• Open-Meteo receives a venue's coordinates and date to show the wind forecast.
• OpenStreetMap map tiles and Google Fonts load in your browser, so like any website they see your IP address.
• We Are One Apps' statistics page (weareoneapps.com) receives the anonymous counts described above. Like any website it sees your IP address, but the counts themselves don't record it or anything else about you.

The restriction zone and temporary restriction data comes from NATS, the UK air traffic service. We download it; nothing about you is sent to them.

How long we keep it

For as long as you have an account. Erase your account and everything goes at once: your details, drones, venues, flights, requests, completed forms and activity record. Copies in the nightly backups disappear within 30 days. Stripe keeps its own record of any payment, as payment and tax law requires.

Your rights

From the Account page you can download everything we hold about you, and erase your account. Correct your details on the Profile page. For anything else, such as asking us to stop using your data for a particular purpose, email info@weareoneapps.com and we will reply within a month. If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office at ico.org.uk.

Cookies

One cookie, which keeps you signed in for up to 30 days. There are no advertising, analytics or tracking cookies, so there is nothing to accept or decline.

Worth knowing

The airspace check is a guide, not an authority. It is built from published aeronautical data and is approximate near a boundary. Confirm on the NATS airspace restrictions map or in the aeronautical information publication before you fly, and remember that permission from an aerodrome is not permission to break any other rule.

Last updated 18 September 2026. If this changes in a way that matters, we will tell you by email.