Last updated: 10 August 2026
The short version: SereniWings collects as little as possible. We show no ads, we run no advertising trackers, no analytics and no crash reporting, and we never sell or share your data — and never have. If you choose to create an account, your email and password are held by our sign-in provider Supabase (the password is stored only as a secure hash — we never see it). If you buy anything, your purchase is handled by Apple and managed through RevenueCat, and the weather feature sends only the coordinates of the airports you type to a keyless forecast service. Your name, flight details, feelings, journal, notes and progress stay on your device and are never uploaded.
Account with Supabase · purchases via Apple & RevenueCat · everything else on your deviceSereniWings ("the app", "we", "us") is published by Allan Fowler, an independent sole trader (entrepreneur individuel / micro-entreprise) established in France and subject to French law. For the purpose of the EU General Data Protection Regulation (GDPR), the data controller is:
Allan Fowler
27 rue de la République, 78470 Saint-Rémy-lès-Chevreuse, France
support@sereniwings.com
That email is also the single address for exercising your GDPR rights (access, rectification, erasure, restriction, portability, objection, and withdrawing consent).
SereniWings is a comfort companion for people who feel anxious about flying. It is a wellbeing tool and does not replace medical care. This policy explains what data the app handles and — mostly — what it deliberately does not handle.
The things you write and record in SereniWings — your first name, your flight details, how you're feeling, your worry note and anchor word, your calm journal, your Flight Passport and badges, your settings and your progress — are stored only on your device. There is no sync, no server copy, and no backup to us. We never receive this content, and neither does Supabase, RevenueCat, Apple or anyone else. It exists on your phone until you clear it in the app or delete the app. The only things that ever leave your device are listed in the table below.
SereniWings contains no advertising SDKs, no third-party analytics, and no crash-reporting service. We do not use the Apple advertising identifier (IDFA) and show no App Tracking Transparency prompt, because we do no cross-app or cross-site tracking. The app's own "analytics" is a placeholder that sends nothing off the device. Because of this, we can say plainly: we do not sell or share your personal information, and never have.
Here is everything that can leave your device, who receives it, and why. If a row isn't here, it doesn't leave your phone.
| Data | Recipient / processor | Why | Legal basis (GDPR Art. 6) |
|---|---|---|---|
| Email address; password (held only as a secure hash) | Supabase (sign-in provider) | To create your optional account, sign you in, and keep your subscription linked to you across devices | Performance of a contract, and your consent (the tick-box at sign-up) |
| Email address (to send account emails such as sign-up confirmation and password reset) | Resend (transactional email delivery) | To deliver the confirmation and password-reset emails for your account | Performance of a contract (delivering the account emails you request) |
| Purchase / receipt data, a RevenueCat app-user ID, and standard device identifiers such as the Apple identifierForVendor (IDFV). If you sign in with Apple, the RevenueCat ID is your stable Apple user ID; otherwise it is a random ID generated by RevenueCat. No name or email is sent to RevenueCat by us. | RevenueCat, Inc. (subscription & purchase management) | To validate purchases, unlock and expire the right access, restore purchases, and give us aggregate purchase analytics (e.g. how many people subscribed) | Performance of a contract, and our legitimate interest in operating and understanding the paid service |
| Your purchase and the payment itself (we never see or store your card details) | Apple (App Store / in-app purchase; Apple is the seller of record) | To take payment and deliver the purchase. Refunds are requested from Apple. | Performance of a contract. Apple processes this under Apple's Privacy Policy. |
| The coordinates of the airports you type in (departure, arrival and a mid-route point) and the flight date — never your name and never your device's GPS | Open-Meteo (keyless weather API) | To draw your route and show a calm weather outlook. The coordinates aren't stored or linked to you. | Your consent and our legitimate interest in a reassuring, useful feature |
All of these transfers happen over an encrypted connection (TLS). We use no advertising SDKs, no analytics SDKs of our own, and no crash-reporting SDK. The app's internal analytics is a no-op that never sends anything off the device.
Everything you enter or the app generates about you — apart from the account and purchase data above — is stored locally on your phone in the device's private app storage, and is never uploaded to us, Supabase, RevenueCat or anyone else:
This information is removed when you clear it in the app or delete the app.
The app does not use your device's location. It never asks for, reads, or stores your GPS position, and it requests no location permission. The only "location" involved is the coordinates of the airports you type, sent to Open-Meteo only to fetch the forecast (see the table above). If you turn on the live turbulence gauge, the app reads your phone's motion sensors to draw a calm gauge; those readings are processed on your phone and never leave it. You can decline the motion permission and the app still works. Offline, the app simply skips the weather and keeps working.
If you use the weather feature, the app sends the coordinates of the departure and arrival airports you typed (and one mid-route point) together with your flight date to Open-Meteo, a free, keyless forecast service, to show a calm outlook for your route. We want to be plain about this: a departure airport, an arrival airport and a date — seen alongside the internet (IP) address every web request carries — can reveal that you plan to travel, and roughly when. So you should know exactly what is and isn't sent:
Open-Meteo requires no API key and no registration (data minimisation by design) and routes requests, via GeoDNS, to servers in Europe and North America — so a given request may be answered from outside the EEA. See "Data residency & international transfers" below. Source: open-meteo.com/en/features.
SereniWings does not track you across other apps or websites, and does not use the Apple advertising identifier (IDFA) or the App Tracking Transparency prompt. The device identifiers RevenueCat uses (such as the IDFV) are used only to manage your purchases for this app, not for advertising or cross-app tracking.
We never sell or rent your personal data and we never share it for advertising. Your data is shared only with the processors named above — Supabase (accounts), Resend (account emails), RevenueCat and Apple (purchases), Open-Meteo (weather) and Netlify (this website) — each only for the purpose described, and each under its own terms and the safeguards set out under "Data residency & international transfers" above.
The good news first: your account data stays in the European Union. Your email and hashed password are hosted by Supabase in the Paris region (eu-west-3), within the EU. We chose an EU region on purpose — your sign-in data is not transferred outside the EEA at rest.
A few processors are established outside the EEA. For each, here is the safeguard relied on for the transfer:
Where required, additional safeguards apply on top of these mechanisms. We have data-processing agreements (DPAs) in place with Supabase, RevenueCat, Netlify and Resend: each vendor's DPA is incorporated by reference into the standard terms of service we accepted, so it applies automatically, as a matter of contract, by our use of the service (Supabase — supabase.com/legal/dpa; RevenueCat — revenuecat.com/dpa; Netlify — netlify.com/gdpr-ccpa; Resend — resend.com/legal/dpa). You can ask us for more detail on any transfer, or for a copy of the relevant safeguards, at support@sereniwings.com.
Under the GDPR you have the right to access, rectification, erasure, restriction, data portability, and objection, and the right to withdraw consent at any time.
You can also email support@sereniwings.com to exercise any of these rights. We aim to respond within one month, as the GDPR requires (extendable by two further months for complex requests, in which case we'll tell you).
Right to complain. If you believe we've handled your data unfairly, you have the right to lodge a complaint with the French supervisory authority, the CNIL (Commission Nationale de l'Informatique et des Libertés):
CNIL — 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France
www.cnil.fr
You may also complain to the data-protection authority in your own EU/EEA country of residence.
We are a small independent publisher in France and do not meet the thresholds that make a business subject to California's CCPA/CPRA. Even so, if you are a California resident, we grant you the following rights and treat your data in line with them.
We do not sell or share your personal information, and never have — no data is disclosed for money, for cross-context behavioural advertising, or to data brokers. There is nothing to opt out of, but the right to opt out is granted below regardless.
Categories of personal information we collect (only if you create an account or buy something — the free app collects none):
| Category | Examples | Purpose | Retention |
|---|---|---|---|
| Identifiers | Email address; first name (if entered, kept on your device); account user ID; a device identifier (IDFV) used by RevenueCat | Create and secure your account; link and restore your purchases | While your account exists; deleted when you delete it (typically within 30 days). Purchase-linked identifiers follow the retention below. |
| Commercial information | Purchase history (what you bought and when) | Manage entitlements; meet Apple's and our legal/tax/accounting obligations | As long as needed for those obligations (French accounting records: up to 10 years) |
| Account credentials (sensitive) | Your password — stored only as a secure hash by Supabase; we never see it | To sign you in. We do not use it for anything else. | While your account exists; deleted with your account |
We do not collect precise geolocation, health data, biometric data, or your browsing across other sites, and we use no personal information for profiling. We do not knowingly collect data from anyone under 16.
Your rights. You have the right to know / access the personal information we hold, to delete it, to correct it, to opt out of sale or sharing (we do neither), to limit the use of sensitive personal information (we already use it only to sign you in), and to be free from discrimination for exercising any of these rights — the app works the same either way.
How to exercise them. The fastest route is in the app: Menu → Your account → Delete my account deletes your account and wipes your on-device data. For any other request — to know, access, or correct — email support@sereniwings.com.
How we verify a request. Because the account is keyed to your email, we verify a request by confirming you control that email address (the in-app deletion is self-verifying — you are already signed in). We ask only for what we need to match you to your account. You may use an authorised agent to make a request; we may ask the agent for proof of your written authorisation and still ask you to verify your identity.
Our response time. We aim to confirm receipt within 10 business days and to respond within 45 days, extendable once by a further 45 days for complex requests, in which case we'll tell you.
The free experience needs no account and processes no personal data, so anyone can use SereniWings locally on their device. Creating an account requires you to be at least 16 years old. We use 16 — the GDPR default age of digital consent — so the same simple rule applies in every EU/EEA country and we never have to process your age or track a different consent age per country. If you are under 16, please use the free experience without an account, or ask a parent or guardian to set up an account for you. The only personal data used for an account is an email and password.
This app is not a substitute for professional care. SereniWings is not a medical device. It does not diagnose, treat, cure or prevent any condition, does not provide medical advice, and does not collect health data. It offers comfort and calming techniques only. If anxiety is affecting your life, please speak with a qualified doctor or mental-health professional, and in an emergency contact your local emergency services.
This website (where you're reading this policy) is a set of static pages hosted by Netlify (United States). It carries no cookies, no analytics and no third-party trackers. Like any web host, Netlify processes the standard technical data every request sends — your IP address and browser user-agent — to serve the pages and for security. If you join the waitlist for future one-to-one sessions, the email address you submit is sent to Netlify Forms and used only to email you once when that service opens; you can ask us to delete it at any time at support@sereniwings.com. Netlify's transfer safeguards are described under "Data residency & international transfers" above.
If this policy changes, we'll update this page and the "last updated" date above.
Questions about privacy? Email support@sereniwings.com.