Privacy Policy

Last updated 13 November 2026

Who we are

VAROPS (“we”, “us”) runs the VAROPS platform at varops.net, including Cirrus, Stratus, the Uplink flight tracker and the vAROPS Discord bot. We're based in Guernsey (Bailiwick of Guernsey), and we're the data controller for the personal data described here. Our servers are in Germany, in the EU. We follow the Data Protection (Bailiwick of Guernsey) Law, 2017, which gives protections equivalent to the GDPR. If you live in the UK or the EU, UK GDPR or EU GDPR may also protect you. Questions about privacy go to help@varops.net.

VAROPS is for flight simulation. It isn't connected to any real-world airline, and nothing here relates to real flights.

What we collect

Your account

• Your name, email address and password. We store passwords only as a one-way hash; we can't see them.
• Any network IDs you choose to add, such as Discord, VATSIM or IVAO.

Your airlines and flights

• The airlines you join, your role, rank and pilot ID in each, and your status there.
• Bookings, flight reports (PIREPs), hours, points, awards and anything you or staff write about a flight.
• When you fly with Uplink: position, altitude, speed, heading, flight phase, fuel, landing rate and the flight log, plus your simulator, aircraft, livery and operating system. This is what builds your PIREP and the live map.

Live map

While you fly with Uplink, your aircraft can appear on the live map of the airline you're flying for. You can turn this off in Uplink's settings.

Discord bot and account linking

This policy also covers the vAROPS Discord bot. Its Terms of Service explain the rules for using it.

• When you link your account: Discord provides your Discord user ID and display name or username through its authorisation process. We store these against your vAROPS account to recognise you in linked airline servers. The linking process requests Discord’s identify permission, not your email address, private messages or password. An OAuth access token is used during the linking request; the current integration does not save your Discord OAuth access or refresh tokens in your account record.
• When an airline links a server: we store the server ID and name, the Discord ID of the administrator who linked it, linking time, selected notification channels and mention roles, rank-role mappings, nickname settings and connection or synchronisation results. Refreshing channels and roles stores a cache of their IDs, names and relevant configuration so airline staff can select them.
• When the bot runs: it receives slash-command interactions, including the invoking Discord user and server IDs and command options, and server-member join events. It reads the member roles and nickname needed to apply the airline’s settings. The bot does not request Discord’s Message Content intent or use ordinary channel conversations or private messages as a source of data.
• When roles or nicknames are updated: we use your linked Discord ID, pilot ID, name, airline rank and membership status to add or remove configured roles and, where enabled, set your nickname in the airline’s server.
• When notifications are enabled: the bot sends selected airline content and pilot activity to Discord. This can include first name and last initial, pilot ID, rank, bookings, flight routes, take-offs, landings and performance figures, accepted flight reports, promotions and badge awards. Staff channels may also receive application or PIREP-review notifications. Only people with access to the chosen channels should be able to see these posts, but recipients may copy or share them.

Airline notification settings are separate from individual Discord account linking: an airline can post activity recorded on vAROPS even if the pilot has not linked a Discord account. Contact airline staff to ask about its notification settings, or contact us to raise a privacy concern. We do not use Discord API data for advertising, data brokering or AI model training.

Payments

If you buy a platform plan through SumUp, we store the airline, plan, billing period, amount, currency, checkout reference, payment status and invoice record. SumUp processes the payment on its hosted checkout and receives the payment details you enter there. For recurring subscriptions, we also store a SumUp customer identifier, an encrypted payment-instrument token, the agreed price and interval, consent time, cancellation setting and renewal results. The SumUp card form collects card details and recurring-payment consent directly. We do not receive or store your full card number or security code. These records let us confirm payment, provide your paid service and maintain accounting records.

Newsletter

If you sign up for VAROPS news we keep your email address, when you agreed and when you confirmed. Every email has an unsubscribe link, and we record when you use it so we don't email you again.

Technical data

• Our servers keep standard logs (IP address, time, the page or API called and the browser's user agent) to keep the service secure and to fix problems.
• We keep a record of emails we send (who to, what kind and whether it was delivered).
• Uplink keeps its own log file on your computer to help with support. It stays on your computer unless you send it to us.

How we use it

What for	Lawful basis
Running your account, the airlines you join, bookings, PIREPs, the live map and Uplink	Contract: it's the service you signed up for
Processing payments and providing paid plans	Contract; accounting records are retained where required by legal obligation
Account emails such as confirmations, password resets and invites	Contract
Discord account linking and the role or nickname features you request	Contract: providing the optional integration you choose to use
Airline Discord notifications and server configuration	Legitimate interests in running the airline’s community integration and keeping members informed; you can contact us to object to processing based on these interests
News and launch emails	Consent, which you can withdraw at any time
Security, preventing abuse, fixing problems and support	Legitimate interests in keeping VAROPS safe and working
Meeting legal obligations	Legal obligation

Who can see it

• Airline staff. Staff of an airline you join can see your profile in that airline and your activity there. Each airline is run by its own staff, separate from us, and other airlines can't see it.
• Other pilots. Things like your name, rank, flights and live map position may be shown to other members of the same airline.
• Public airline pages. If your airline has a public page on VAROPS, it can show your pilot ID, your first name and last initial, your recent accepted flights and your hours this month, including in widgets on the airline's own website. Your position on its live map only appears if you've left live map visibility on in Uplink.
• Airline Discord servers. If an airline you fly for links its Discord server to VAROPS, our Discord bot can post there about your activity at that airline: your first name and last initial, pilot ID and rank, plus your bookings, take-offs, landings, accepted flights, promotions and badges. If you link your Discord account, the bot can also give you that airline's roles and set your nickname in its server.
• Airlines' own tools. An airline's owners and admins can give their own website, Discord bot or tools read access to the airline's data through our API: your pilot ID, name, rank, totals and flights at that airline. Your email address is never shared this way.
• VAROPS support. Our platform admins can open an airline to help with support or problems. Every support session is limited in time.
• Service providers. Our servers and email are hosted in the EU with Hetzner Online. Maps load tiles from OpenStreetMap, and some pages load fonts from Google Fonts and map data from jsDelivr and country flag images from FlagCDN, which means those services see your IP address when your browser fetches them.
• SumUp. If you choose to pay through SumUp, it processes your payment information under its own Privacy Policy.
• Discord. Discord receives the API requests, member identifiers, role and nickname changes and notifications needed to operate the integration. It processes information under its own Privacy Policy. Server owners and moderators manage access to their channels independently of vAROPS.
• Links you choose to use. Links to services such as SimBrief or Flightradar24 take you to their sites, under their own privacy policies.

We don't sell your data, and we don't share it for advertising. Apart from the sharing described above, we disclose personal data only where legally required or otherwise lawfully necessary to protect the service or people's rights.

International transfers

Our servers are in Germany, in the EU. Guernsey law treats EU member states as giving adequate protection, and so does the UK, so your data stays within jurisdictions recognised as safe. Discord and some of the other providers above may process information outside your country, including in the United States. Their privacy notices explain their processing locations and transfer arrangements. Where we transfer personal data internationally, we use the safeguards required by the law that applies to that transfer.

How long we keep it

• Account and flight data: while your account is active. When you delete your account (or ask us to), we delete it and the personal data linked to it, except where we need to keep a record for legal reasons, such as billing.
• Discord account identifiers: while your account remains linked. Disconnecting through your Cirrus profile clears the Discord ID and stored username from your vAROPS profile and stops future account-based synchronisation. The integration attempts to remove managed roles where synchronisation is enabled, but removal can fail if permissions or server access have changed; your server nickname is not automatically restored.
• Discord server configuration and cached channel or role data: for as long as needed to operate the server integration. Unlinking is not an account-erasure request and may leave some configuration in place. Contact us to request deletion of retained Discord data. We delete Discord API data promptly when it is no longer necessary for the integration, when required by Discord or applicable law, or following a valid deletion request, except where retention is legally required.
• Messages already posted to Discord: unlinking or deleting a vAROPS account does not automatically erase those messages, copies made by recipients or records held by Discord. Contact us and the relevant server staff for help with removal; Discord’s own privacy processes also apply.
• Closed airlines: operations lock at trial or paid-access expiry. After 30 unpaid days, airline operational records are deleted. Personal VAROPS accounts remain separate. Accounting records may remain and backup copies expire under our retention processes.
• Payment and invoice records: for the paid service and as long as required for accounting, tax, disputes and other legal obligations.
• Newsletter: until you unsubscribe. We keep a note that you unsubscribed so we don't email you again.
• Server logs and email records: only as long as needed for security and support.

Discord controls and deletion requests

You can disconnect your Discord account from your Cirrus profile. Server administrators can use /unlink, disable notification channels in Stratus, change permissions or remove the bot. These controls stop the relevant future integration activity but do not by themselves delete your vAROPS flight records.

To request access, correction or deletion of Discord-related personal data, email help@varops.net with your vAROPS account details and the relevant server or airline. Never send passwords, OAuth tokens or airline linking tokens. We may verify your identity before acting on a request. We will explain any information we must retain and why.

Your rights

You can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or move it to another service. Where we rely on consent you can withdraw it at any time.

Ask for a copy, or anything else: sign in to Cirrus and open Account settings → Your data & GDPR. When you ask for a copy, we collect all the personal data we hold about your account straight away; a member of the VAROPS team checks it and then emails it to your confirmed address as a JSON file, free of charge. You can also ask us there to correct your data, or to restrict or stop a particular use of it, and follow the progress of each request. We reply within one month. For your security the copy never includes your password, two-step sign-in keys or sign-in links, and it leaves out the identity of staff who reviewed or wrote records about you.

Delete your account yourself: on the same page, choose Delete my account and data. After you confirm with your password, your account and the personal data linked to it are deleted straight away, at every airline you fly with, and you're signed out. This can't be undone. If you own an airline, hand it over or close it first. Records that belong to other people, such as a flight report you reviewed, are kept without your name.

For anything else, email help@varops.net from the address on your account; we'll reply within one month.

If you're unhappy with how we've handled your data, please tell us first. You also have the right to complain to our regulator, the Office of the Data Protection Authority (ODPA) in Guernsey, at odpa.gg. If you live in the UK you can also complain to the Information Commissioner's Office at ico.org.uk, and if you live in the EU, to the data protection authority in your country.

Children

VAROPS is not meant for children under 13, and we don't knowingly collect their data. Discord features also require users to meet any higher minimum age required by Discord or applicable local law. If you think a child has given us their data, contact us and we'll delete it.

Security

We use encrypted connections, hashed passwords, encrypted storage for sensitive settings and access limits for staff. No system is perfect, but if something goes wrong that affects you we'll tell you as the law requires.

Changes

If we change this policy we'll update the date at the top, and for important changes we'll let you know by email or on the site.