DronHang Privacy Policy

Last updated: 14 October 2026

English version. In case of any difference, the Polish version is the binding one. This translation is here so that pilots outside Poland know what happens to their data.

DronHang is the new name of the service previously called Dron Hub — the same app, the same operator, the same accounts and data.

1. Who processes your data

The data controller is Tymon Mikołajczak, ul. Iwana Kryłowa 4f, 64-100 Leszno, Polska. Contact: kontakt@dronhang.com.

2. What data we collect

Given by you when creating an account

When you sign in with Google, we receive your e-mail address, account identifier, and the first name, last name and photo address from your Google account. Our sign-in provider (Supabase) stores those last three with the account — the app does not use them and shows them nowhere; you set the name and photo on your profile yourself. We do not receive your Google account password.

When you sign in with Apple (iPhone only), we receive your account identifier and e-mail address from Apple — your real one or, if you choose so, an Apple relay address that forwards messages to you without revealing the real one. On the first sign-in Apple also gives us your first and last name if you allow it: we store it with the account and fill it in as a suggested display name, which you can change or delete before creating your profile. We do not receive your Apple ID password.

Given by you later

Display name, profile description, profile photo, drones and their parts, posts, photos, video clips, comments, likes, pilots you follow, flight log entries, saved flying places, messages in private chats, training plans and notes, notes sent to us from the app, content reports and blocks. All of it is given voluntarily — without it the account simply stays empty. Messages, notes and trainings have their own paragraphs below.

Location

You can attach a place to a flight log entry. There are three ways: point at the map with your finger, pick a place saved earlier, or read the phone's position with the "my location" button.

The last one needs your permission and we ask for it only when you press that button. The reading is one-off: we save the coordinates of the point you confirm, and nothing else. The app does not track your location in the background — it has no permission for that and does not ask for one. Refusing blocks nothing: you can still point at the map or skip the place entirely.

A saved place is private — only you see it. You can submit it as public, but it appears on other pilots' maps only after our manual review. Until then it shows as pending on your side, and we may reject the submission — the place then stays private. We review them so that nobody's private land gets broadcast.

When you share a flight in the feed, you decide separately whether to show the place. We ask every time the place is not public yet. If you refuse, the post shows the flight alone — name and date — and the coordinates stay in your log. If you agree, the place name lands on the post card and anyone can open that point on the map.

The flight log on your profile is a separate matter. It shows the place name next to each flight, but never the coordinates — you cannot open a map or read the point from a profile. Names of places that are not approved public spots can be switched off in Profile → Menu → Settings → Private spots in the log. A place approved as public is always visible: it already stands on the map for everyone, so hiding it in the log would protect nothing. The whole log goes off with the switch next to it.

Map tiles come from OpenStreetMap. With each fetch the OpenStreetMap servers see your IP address and the fragment of the map you are looking at. We pass them neither your account nor the coordinates you save.

Location saved inside photos and clips

Phones often record inside a photo or a video the place where it was taken. Before the file reaches the server, we remove that data: EXIF metadata from photos, the coordinates stored inside video clips. A photo that cannot be prepared this way is not sent at all — the app shows a message instead of uploading the original.

Private messages

Chats with other pilots are stored in the database: the message text, who sent it, to whom and when. We also store when you last opened the chat — only to show the unread counter. The app does not show that time to the other person.

A chat is visible only to its two participants. Policies on the database side enforce it, not just the app. We do not read chats and the moderation panel does not show them. Messages are not end-to-end encrypted, though, so technically the database administrator has access to them. We would reach for them only where the law requires it.

When you delete a message, its text goes immediately — the chat keeps only the information that a message was deleted, and the time. Blocking a pilot stops messages in both directions. Live delivery of messages uses the Realtime service of the same provider that hosts the database (Supabase).

A post sent to a pilot ("Send" next to a clip) is an ordinary message in your chat: we store which post it is and any note you add. The other person sees the post only while it is still in the app — one deleted by its author leaves a "post unavailable" trace in the chat.

Saved posts

A post saved with the bookmark button goes to your "Saved" list: we store which post and when. Only you can see the list — the author does not know who saved their post and there is no save counter on the post. The entry goes when you remove it from the list, when the author deletes the post, and together with your account.

Notes sent from the app

In Profile → Menu → Send us a note you can report a bug or an idea. We save the note, the photo if you attach one, the app version, the date and the account it came from. The photo goes to private storage: it has no public address, and the administrator views it through a link valid for fifteen minutes. Only the administrator reads the notes, and they serve only to fix bugs and develop the app. We accept up to ten notes from one account within seven days.

A screenshot may show other people's data — a piece of a chat, say, or someone else's profile. Cover up whatever you do not want to show us before you send it.

Trainings and notes

The training plan (name, description, day, repetition, the reminder time if you turn reminders on) and post-training notes (text, a rating from 1 to 5, the tick) are private — only you see them. We do not show them on the profile, in the feed or in the moderation panel.

A training reminder is set by the phone itself — we do not send it from the server and it does not pass through Google or Apple. With the training we only store the time you chose, so it is not lost if you reinstall the app.

Challenge progress

Badges and challenge progress are counted from what you do in the app anyway: flights in the log, posts, followers and drones in the hangar. Only you see the result. To others we show only the badge you pick yourself to sit next to your profile photo.

Competitions

When signing up for a competition you give the details the organiser asks for: the ones they picked from the list — first name, last name, nickname, date of birth, e-mail address, phone, city, country and team — the answers to their questions, and the drone you start with.

Those details go to the competition organiser. The organiser is a separate controller of that data: they decide how to use it to run the competition (start list, contact, settling the entry fee) and answer to you for it. Your entry is visible to you and to that competition's organiser — nobody else. The organiser can download the list of entries as a file; that copy is not under our control.

At the end of the sign-up we ask whether to remember the details for future competitions. If you agree, we keep them with your account and only you see them. You change or delete them in Profile → Menu → Competitions → My sign-up details.

When organising a competition you give its name, date, place, description, entry fee, payment method and contact. After our review that information, together with your pilot name and the number of taken slots, is public on dronhang.com and in the app.

Translating content

There is a "Translate" button under posts and comments. Until somebody presses it, nothing goes anywhere. After a press we send DeepL the text alone — no account name, no photos and no information about who asked for the translation. We store the finished translation next to the content in our database, so the next reader does not send the same text again.

A translation disappears with its content: a deleted post or comment takes it along, and edited content invalidates the previous translation. We also count how many translations an account ordered within a day — only so that one script cannot burn through the package. The counter is deleted with the account.

We translate public content only: posts and comments. Private messages, training notes and competition sign-up details are never sent anywhere.

What you have already seen in the feed

When a post stays on your screen for about a second, we record with your account which post it was and when you saw it. What for: so that the "Discover" tab does not show you the same post twice, and so it knows when all that is left is what you have seen. A quick scroll does not count.

Only you can see these records. The author of a post does not know who viewed it. With the post itself we keep only the total number of views, without names — and for now we show it nowhere. We do not record how long you looked, we do not build an interest profile from it and we show it to no one. Records older than eight days are deleted automatically every night, and all of them disappear with the account.

In-app notifications

When someone comments on your post, replies to your comment, mentions you, likes your post or starts following you, when something changes in a competition you are signed up for, or when we review your spot or report, we store a notification with your account: what it is about, who did it and a short excerpt (up to 140 characters) of the comment or post. Only you see it, under the bell in the app.

When we remove your post or comment, the notification contains the reason, any note from the moderator and an excerpt of the removed content — so it is clear what the decision concerns and how to appeal it.

Notifications are deleted automatically after 90 days, earlier together with the content they concern (a deleted comment takes its notification with it), and together with the account. We also store your notification settings and the badges we have already notified you about — so we don't notify you twice.

Notifications on your phone (push)

If you allow notifications, some of them — new messages, comments, replies, mentions, competition changes, moderation decisions and announcements — will show up on your phone's screen, also when the app is closed. For that we store with your account this phone's notification identifier (a Firebase token), the app's language and the system (Android or iOS). Until you allow notifications, the app does not ask for such an identifier.

Push notifications are delivered by Google (Firebase Cloud Messaging) and, on an iPhone, further by Apple (Apple Push Notification service). The content of the notification passes through their servers: who did something, an excerpt of a comment, a competition name and, for a message, its text. You can hide message text in the settings ("Message text in notifications"); the notification then only says who wrote. You can withdraw consent in your phone's settings or with the switches in the app.

We delete the identifier when you sign out, together with the account, when Firebase considers it outdated (e.g. after the app is uninstalled) and after 270 days if the app has not been opened on that phone in that time.

Collected automatically

Your IP address and device information reach the logs of our provider (Supabase). They serve only to detect abuse and diagnose failures.

Protection against bots at sign-in

When you sign in, create an account or set a new password — in the app and in the organiser panel — Cloudflare Turnstile checks in the background that you are a person and not a password-guessing program. It sees your IP address and technical details of your phone or browser. It sets no tracking cookies, is not used for ads and does not receive your sign-in details.

Crash reporting

When the app crashes, we send Sentry the error trace: the app name and version, the place in the code where the crash happened, technical details about the phone (model, Android version, language, time zone, memory, battery level) and a random installation identifier — the same for later crashes on that phone, not linked to your account. We deliberately do not send your IP address, account data, a screenshot or information about which screens you open. It serves only to fix bugs.

The dronhang.com site

The site has no analytics, no ads and no tracking cookies. It stores two things in your browser, both only when you ask for them:

• the jezyk cookie — when you switch the site language, or open the terms or this policy from the app (the site then takes the app's language); it remembers that choice for a year,
• your sign-in session to the competition organiser panel — when you sign in there; it disappears when you sign out.

The Cloudflare servers hosting the site see visitors' IP addresses (see section 5).

What we do not collect

We do not collect contacts, data from other apps or the contents of your gallery — beyond the files you pick to send yourself. We do not track your location: we read it only at your request, for a specific flight log entry (see above). We have no ads and no advertising tracking.

3. What is public

This matters more than the rest of this document:

• public to everyone, including people without an account: your username, display name, profile description, profile photo, all your posts with photos and clips, comments, likes, follow lists
• public by default, can be switched off: the flight log on your profile — flight name, date, drone, place name and the clip thumbnail, never the coordinates or the clip itself. The whole log, or just the names of private places, can be switched off in Profile → Menu → Settings
• public only if you turn it on yourself: drones in the hangar — a new drone is private and only you see it until you switch it to public; saved flying places — a new place is private, and one submitted as public becomes visible only after our review; full flight log entries (description, clip, coordinates) — the log is private, and a flight reaches the feed only when you share it; the place of a shared flight — we ask about it separately with each share; the badge next to your profile photo — we show only the one you pick
• public after our review: the competitions you organise — name, date, place, description, entry fee, payment method, the contact you give, your pilot name and the number of taken slots
• visible only to the other person: your messages in a private chat
• visible only to the organiser: your competition sign-ups with the form details and the chosen drone
• never public: your e-mail address, your content reports, your block list, trainings and notes, notes sent from the app, challenge progress, the details saved for competition sign-ups

4. Why we process data and on what basis

The order of posts in the "Discover" tab is set automatically: it depends on how fresh a post is, how many reactions it has, how popular its author is, whether you follow them and whether you have already seen the post. We use nothing else about you for it. We make no decisions about you based solely on automated processing that produce legal effects or similarly significantly affect you (art. 22 GDPR).

5. Who we entrust data to

Supabase, Resend and Sentry are US companies. They keep your data on servers in the EU, and in case of access from outside the European Economic Area it is protected by standard contractual clauses approved by the European Commission — just as with Cloudflare.

Law enforcement. When someone breaks the law — especially where child exploitation is involved — we report the case to Dyżurnet.pl (NASK) and the Police and provide the data they lawfully request. Details: Child safety standards.

We do not sell data and do not share it for marketing purposes.

6. How long we keep data

Until the account is deleted. Deleting the account is immediate and irreversible — we erase the account, profile, drones, flight log entries, saved places, posts, photos, clips, comments, likes, chats with their messages, trainings and notes. Data from a deleted account may remain for at most 7 days in the automatic database backup — then it disappears from there too. We do not restore individual accounts from backups.

A chat belongs to both sides, but disappears entirely when either of them deletes their account — on the other side as well.

Your competition sign-ups and the details saved for sign-ups disappear with the account. Withdrawing from a competition does not delete the entry — the organiser sees it as withdrawn. When an organiser deletes their account, their competitions disappear together with all the sign-ups. The copy the organiser downloaded earlier as a file is beyond our reach.

Notes sent from the app stay after the account is deleted, but with no link to it: we no longer know who sent them. They usually describe a bug in the app and we still need them to fix it. If you want those gone too, write to kontakt@dronhang.com — ideally before deleting the account, because afterwards we will not be able to recognise them.

Files from individually deleted posts, flights and drones are erased from storage during regular clean-up, usually the following night.

In-app notifications disappear after 90 days. The phone's notification identifier — when you sign out, or at the latest after 270 days without the app being used on that phone.

Our providers' logs (Supabase, Cloudflare) with IP addresses and crash reports in Sentry disappear automatically — after one to 90 days, depending on the service.

You delete the account yourself, in the app: Profile → Menu → Settings → Delete account. You do not have to write to anyone or ask for anything.

Keep in mind that other people's comments under your posts disappear with your account too — they go along with the post. Your comments under other people's posts disappear as well: we leave no "ghosts" behind deleted accounts.

7. Your rights

You have the right to: access your data, rectify it, erase it, restrict processing, port it, and object to processing based on legitimate interest.

Most of it you do yourself in the app: you edit the profile in Profile → Edit profile, you delete the account in Profile → Menu → Settings → Delete account. For anything else write to kontakt@dronhang.com.

You can also lodge a complaint with the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw, Poland).

8. Age

The app is meant for people who are 16 or older. We do not knowingly collect data of younger people. If such an account appears, we delete it after a report to kontakt@dronhang.com.

9. Security

Access to data is guarded by policies on the database side (Row Level Security) — not only by the app's code. That means even if someone went around the app and hit the API directly, they would not see other people's private drones or comment on a post of a person who blocked them.

No system is a hundred per cent secure. We will notify you of a data breach that may threaten your rights in line with art. 34 GDPR.

10. Changes

We will warn about important changes in the app before they take effect. The date of the last update is at the top of this document.