Cookies and browser storage
Effective: 31 October 2026, version 1.0 · Hungarian version: Sütik és böngészőben tárolt adatok
Short version: ChockOps uses no tracking, analytics or advertising cookies, on the website or in the app. We store only what is needed to log you in, keep the session secure, remember settings you explicitly choose, and let the app work offline. This storage is strictly necessary, or necessary for a service you explicitly asked for, so under EU and Hungarian rules it needs no consent (ePrivacy Directive 2002/58/EC, Art. 5(3); in Hungary Act C of 2003 (Eht.) § 155(4)). That is why there is no cookie banner. Convenience settings (theme, language, layout, a dismissed install banner) are chosen by you and stay in your own browser; they are not sent to us. If we ever add anything that is not strictly necessary, we will ask for your consent first and update this notice.
Website (chockops.io)
| What | Type | Purpose | How long |
|---|---|---|---|
| No cookies | |||
chockops.theme | browser local storage | remembers your display setting (light/dark) | until you clear it |
The fonts are served from our own server (no Google Fonts), and the site loads no third-party scripts. The only request the site makes to another address is sending the early-access form to the app server (app.chockops.io), if you fill it in; see the waitlist privacy notice.
App (app.chockops.io)
Cookies (all first party)
| Name | Attributes | Purpose | How long |
|---|---|---|---|
flyops_access | HttpOnly, Secure, SameSite=Strict, path / | keeps you logged in (short-lived access token, JWT) | 15 minutes |
flyops_refresh | HttpOnly, Secure, SameSite=Strict, sent only to /api/auth | renews the login without a password (rotating; the server stores only its hash) | 30 days |
flyops_csrf | Secure, SameSite=Strict, not HttpOnly (read by the app) | protects against cross-site request forgery | 30 days |
All three are deleted at logout, and the refresh token is revoked on the server. The names come from the service's earlier working name, "FlyOps"; this does not affect how they work.
Local storage
| Key | Purpose | At logout |
|---|---|---|
flyops.theme | theme (light/dark) | kept |
flyops.locale | interface language | kept |
flyops.session | marker (user ID and expiry) that lets the app start offline | deleted |
flyops.ws.<user ID> | last workspace you chose | deleted |
flyops.installBanner | whether you dismissed the install banner | kept |
flyops.entryMode, flyops.techlogLayout | your chosen form and techlog layout | kept |
flyops.logbook.instructor.certificate | when countersigning as an instructor, the certificate number you last entered (so you need not type it again): personal data | deleted |
flyops.academy.prefs | Academy preferences | deleted |
flyops.academy.offline.<subject> | version of downloaded offline course material | kept |
academy.exam.flags.<exam ID> | questions you flagged during an exam | deleted |
chockops.legacy.push-prompted | whether the notice about moving from the old address (flyops.dataedge.io) was shown | kept |
flyops.sw | developer switch for the service worker (normally absent in production) | kept |
Session storage (cleared when you close the tab)
| Key | Purpose | At logout |
|---|---|---|
flyops.aircraftWs | aircraft workspace chosen in this tab | deleted |
saas2.medical-question.<ID> | whether you postponed the medical-consent question for this session | deleted |
flyops.template.ai_disabled | the AI template feature is unavailable in this session | kept until the tab closes |
Offline data (IndexedDB and Cache Storage)
| What | Content | How long |
|---|---|---|
IndexedDB flyops-offline, outbox store | changes recorded offline and not yet sent (e.g. techlog entries, defect photos, G1000 CSV files) | until synced, at the latest until logout |
IndexedDB flyops-offline, academyQueue store | offline Academy answers, linked to your user | until synced, at the latest until logout |
Cache Storage flyops-shell-<version> | the app's own files (HTML, JS, CSS, icons), no personal data | until the next version |
Cache Storage flyops-api-v1 | copies of data you opened, for offline reading: account, aircraft, techlog, defects, maintenance, trips (including emails and names of people on board), airports, logbook, tracks, Academy | cleared at logout |
Cache Storage flyops-academy-v1 | downloaded Academy material (no personal data) | until the next version or cleared |
| Push subscription | held by your browser's push service; we keep the endpoint and the browser's user agent | until you turn it off in the app or the browser, the push service expires it, or your account is deleted |
At logout the app clears the offline data cache, the offline queue and the personal keys listed above. Entries recorded offline that have not been sent yet are deleted too, so sync before you log out (the app shows pending items). If your session merely expires (you do not log out), this data stays in the browser so that it can be sent at your next login. On a shared device, therefore, always log out.
Third parties that see your browser
- Map tiles: when you open a map, your browser loads it from the OpenStreetMap tile servers (
tile.openstreetmap.org, OpenStreetMap Foundation, UK). It sends them your IP address, user agent, the referring page and the map area you view; the OpenStreetMap Foundation is an independent controller for this. We use this provider during the beta (with the attribution shown on the map) and will review the choice of map provider before public launch. See the privacy policy. - Web push: if you turn on push notifications, your browser's push service (for example Google, Mozilla, Apple or Microsoft) delivers them. The message content is end-to-end encrypted.
- There are no other third-party scripts, fonts, analytics or error trackers (e.g. Sentry).
Your control
You can delete cookies and site data in your browser at any time. If you do, you are logged out, and entries saved offline that have not synced yet are lost. Sync first (the app shows pending items).
Contact: privacy@chockops.io.