Privacy

What this website stores, and what the self-hosted app sends from the computer where you run it.

This website

skybossatc.com is a static site plus a download check. There is no user account. The pages do not ask for your name, email, or payment card.

Purchase

SkyBoss ATC is a one-time purchase of a self-hosted app. You run it on a Raspberry Pi, or on another Linux computer, next to your own ADS-B receiver. Lemon Squeezy is the merchant of record. Lemon Squeezy handles payment, tax, and the receipt email. The license key is in that email.

This website does not run the checkout and does not store your card number. What Lemon Squeezy collects is described in Lemon Squeezy’s privacy policy. The price is the amount shown when sales open. This page does not list a price.

License key at download

The installer sends the license key to this site (POST /api/download). That request is the key only. It does not include aircraft from your receiver. The download function sends that key to Lemon Squeezy at https://api.lemonsqueezy.com/v1/licenses/validate and checks the answer. That call does not use a Lemon Squeezy API key.

This website does not store the license key. It stores a download count for the UTC day in a private Vercel Blob file. The path is download-counts/ plus the SHA-256 hash of the key, plus the date (YYYY-MM-DD). The file is JSON with a count. The key itself is not in that file. A key can be used for 5 downloads per license key per UTC day. If the count cannot be read or written, the download is refused.

The short-lived download link carries that same SHA-256 hash, a random nonce, and a signature. It does not carry the key. The function does not log the private file link it redirects to. Its own access log is turned off.

On your Pi

The desk can activate and validate the license with Lemon Squeezy from the Pi. Activation sends the license key and the Pi’s hostname to https://api.lemonsqueezy.com/v1/licenses/activate. Validation sends the license key to https://api.lemonsqueezy.com/v1/licenses/validate. The app writes data/.license_cache.json on the Pi. That file can include the license key, whether it validated, a status, the customer name Lemon Squeezy returned, and the time of the check. It stays on the Pi. The app reuses a successful check for up to 7 days, including when Lemon Squeezy cannot be reached. This website does not receive that file.

Receiver data and SkyBoss

Your ADS-B receiver (dump1090-fa or readsb) is the source of positions on the desk. The installer starts backend/main.py and does not start any upload of that feed. The installed desk does not send your receiver’s aircraft list to SkyBoss. This website does not receive your flight tracks.

The repository also contains cloud/agent/skyboss_agent.py. A normal install does not run it, and the systemd service does not start it. If you run that script yourself, it reads your local receiver and posts the aircraft list, an airport id, and a timestamp to https://api.skybossatc.com/feed (or the host in SKYBOSS_API_URL). That default host is a SkyBoss host. The script also sends the email and password you give it to Amazon Cognito in us-east-1 to obtain a token for that post. That is the only code path that sends receiver aircraft to a SkyBoss-controlled host, and it runs only when someone starts it.

Today the installed app sends no receiver data to SkyBoss. If a future network feature collects receiver data, SkyBoss will announce it in advance and will provide an opt-out control before any collection starts. The terms include a license for aircraft and ADS-B data and for derived detections, stats, and coverage. That license is a grant of rights. It does not mean the desk uploads that data today.

What a normal install contacts

The installer writes data_source: auto, a 5-second refresh, and empty keys for ADS-B Exchange, FlightAware, and Mapbox. It does not write OpenSky credentials. With those defaults, the desk contacts the hosts below. The local receiver URL (usually http://localhost:8080/data/aircraft.json) stays on your machine.

airplanes.live

While data_source is auto and your receiver is returning aircraft, the Pi requests https://api.airplanes.live/v2/point/{latitude}/{longitude}/{radius} at most once every 10 seconds. The path contains your home airport’s latitude, longitude, and approach radius. The request does not upload your local tracks. Those requests identify themselves as the SkyBoss ATC app.

The on-screen fill control only hides those aircraft after the fetch. Turning fill off does not stop the request. The request still goes out in auto mode while the receiver is returning aircraft.

Choosing an airport other than the default airport also requests airplanes.live, on each refresh, and that path ignores data_source. A switch to another airport still sends that airport’s latitude, longitude, and radius.

OpenSky

If the receiver returns no aircraft or cannot be reached, and data_source is auto (or cloud), the Pi requests https://opensky-network.org/api/states/all with a bounding box computed from the airport latitude, longitude, and approach radius (lamin, lamax, lomin, lomax). A default install has no OpenSky client id or secret, so that call is anonymous. If you later add both, the Pi also posts those credentials to https://auth.opensky-network.org/auth/realms/opensky-network/protocol/openid-connect/token and sends the resulting bearer token. A rate-limit response backs off for 60 seconds.

The installed desk does not call OpenSky’s routes endpoint. An older Streamlit app in web/app.py can request https://opensky-network.org/api/routes with a callsign. The installer does not start that app.

ADS-B Exchange

No request is made until you put a key in adsbx.api_key. The installer leaves that key empty. With a key, the Pi requests https://adsbexchange-com1.p.rapidapi.com/v2/lat/{latitude}/lon/{longitude}/dist/{radius} and sends the key in the X-RapidAPI-Key header. That happens in two cases: as the cloud fallback when the receiver has no aircraft and the mode is auto or cloud (OpenSky is next if this call fails), and as a military overlay about every 30 seconds out to 30 nautical miles when the receiver did return aircraft. The overlay runs in both auto and local when the key is set, unless military_tracking.enabled is turned off. The setting defaults to on.

FlightAware AeroAPI

No request is made until you add a FlightAware AeroAPI key. With a key, the Pi requests https://aeroapi.flightaware.com/aeroapi/flights/{callsign} and sends the key in the x-apikey header. While a browser is connected, that lookup runs for the lead landing and the watched departure. With no browser connected, it runs for go-arounds, VIP aircraft, and notable aircraft. Results are cached in memory and in data/route_cache.json on the Pi. data_source: local does not stop these lookups.

Weather and FAA status

When the desk page is open, the browser asks the Pi for weather and FAA status, and the Pi fetches them. Weather is https://aviationweather.gov/api/data/metar?ids={icao}&format=raw, on load and about every 30 minutes. The query is the airport ICAO, not an aircraft list. FAA status is https://nasstatus.faa.gov/api/airport-status-information, the full document, on load and about every 5 minutes. The Pi filters it to your airport locally. Both still run when data_source is local.

Photos and airline logos

For the lead landing and the watched departure, until that aircraft’s hex is cached for the running process, the Pi requests https://api.planespotters.net/pub/photos/hex/{hex}. The request is the hex code. The browser then loads whatever thumbnail address Planespotters returns. That address is not fixed in the app.

The Pi does not request airline logos itself. When a card has an airline code, the page sets the image address to https://images.kiwi.com/airlines/64/{iata}.png, and the browser loads it.

Map

Map tiles load in the browser, not as a Pi upload. With no Mapbox token (the installer default), the style is https://basemaps.cartocdn.com/gl/dark-matter-gl-style/style.json and the Mapbox API address is cleared. Clearing that address also stops Mapbox usage events, so the page does not call api.mapbox.com or events.mapbox.com.

If you add a Mapbox token, the style is a Mapbox style, the API address is https://api.mapbox.com, and tile hosts follow that style. The desk also requests https://api.mapbox.com/map-sessions/v1 with that token. Mapbox GL JS 3.24, which this app ships, then posts usage events to https://events.mapbox.com/events/v2 and includes the token on that request. This app does not turn those events off. The events that version sends are a map load, a style load, performance and metrics, and a turnstile event about once a day when a Mapbox tile is requested. The map-load event includes the SDK name, the SDK version, a billing token, and an anonymous id stored in the browser and refreshed after 24 hours. Mapbox documents a map load as initializing a map, billed as a session of up to 12 hours.

The turnstile event in this library sets enabled.telemetry to false. Mapbox’s glossary uses telemetry for de-identified data about where and how people move, and documents an opt-out for the iOS and Android SDKs. This web library is not sending that movement data.

Voice model

If Piper is available and the voice model file is missing, the Pi downloads en_US-lessac-medium.onnx and its .onnx.json from https://huggingface.co/rhasspy/piper-voices/resolve/main/en/en_US/lessac/medium/. That is the model file, not aircraft. It does not run on every boot once the file is present.

data_source: local

Setting data_source: local in config/settings.yaml stops two things for the home airport: the airplanes.live gap-fill, and the OpenSky and ADS-B Exchange fallback that runs when the receiver returns nothing. Calls that still happen are weather, FAA status, Planespotters photos, Lemon Squeezy license checks, the voice-model download when the file is missing, and, in the browser, map tiles and airline logos. FlightAware AeroAPI lookups also still run when a FlightAware key is set. Two traffic calls also remain: airplanes.live when the desk is showing an airport other than the default, and the ADS-B Exchange military overlay when an ADS-B Exchange key is set.

Web Analytics

This site loads Vercel Web Analytics and no other tracker. Vercel documents it as cookieless: it does not use third-party cookies. Page views are aggregated. Vercel says a recorded page view is not tied to a person, a customer, or an IP address, and that the product does not build a personal profile or a cross-site browsing history. Visitors are distinguished by a hash of the incoming request. Vercel says that session is discarded after 24 hours.

Vercel’s privacy note lists what may be stored with a page view: the time, the page URL, the dynamic path, the referrer, filtered query parameters, location as country, region, and city, the device operating system and version, the browser and version, the device type, and the analytics script version. The note is Vercel Web Analytics privacy.

These pages do not send custom analytics events. There is no cookie banner, because this script is the only tracking on the site.

Request logs

The site is hosted on Vercel. Vercel request logs can include the IP address and the user agent of a request to the site, including the download check. The download function does not write its own access line, and it does not log the license key or the private download link. This page does not state how long Vercel keeps request logs.

Contact

Privacy questions: skyboss-support@agentmail.to.