Privacy

Last updated: 2026-10-07

Open Checklists is run by Allen McGhan (contact details on the contact page). This page says plainly what the site collects, why, and who else sees it. If something here is wrong, tell us and we will fix the site or the page.

Without an account

You can use every checklist, airport page, the planner and the training pages without signing in. In that case:

• Your browser keeps your work. Checklists you write or fork in the editor, and the boxes you tick, are saved in your browser's local storage on your own device. They are not sent to us unless you choose to publish, email or save them to an account. Clear your browser's site data to delete them.
• Flight plans you generate are stored on our server so the briefing link works. Anyone with a plan's link can open it, so do not put anything private in a plan. Plan ids are long and random and are not listed anywhere.
• Usage counts. When you open a checklist we add one to its public "uses" counter. To count each visitor once a day we keep a one-way hash of your IP address; it stops being used after 24 hours and is deleted by a daily clean-up job. The address itself is not stored.

With an account

Accounts are optional. Sign-in is handled by our identity service at auth.keylinkit.net (Zitadel), which holds your email address, name and login factors. Our database then stores, against an internal account id:

• the username, display name and leaderboard preference you choose;
• aircraft and favorite airports you save;
• your flight logbook entries, saved flight plans and training progress;
• checklist completion logs (kept for six months, then deleted automatically);
• points earned, and checklists and reviews you publish. Published checklists and reviews are public, shown with your display name or username.

Checklist requests

If you request a checklist for your aircraft, we store the aircraft details you enter. If you also tick "email me when it's available", we keep that email address only for that purpose and delete it once we have told you (or on request).

Email

If you ask the site to email you a briefing, a checklist log or a PDF, we send it to the verified email address on your account — never to an address typed into the page — and keep only that account address. To stop abuse, emailing needs an account and is limited per account and per network; the limit counters store a one-way hash of your IP address, deleted daily once expired.

Automated review of published checklists

When you publish a checklist, its content is sent to Anthropic's Claude API for an automated safety and copyright check before it appears publicly. The aircraft registration field is removed automatically when you publish; do not put a registration or anything else personal in titles or notes.

Advertising and cookies

The site is free and is paid for by advertising. We use Google AdSense on some pages (airport, training, search and catalogue pages; never on checklist, editor, planner or account pages). Google and its partners may use cookies and similar technologies to show ads based on your visits to this and other websites, and to measure ad performance.

• How Google uses this data: policies.google.com/technologies/partner-sites.
• Turn off personalised ads from Google: adssettings.google.com, or for many ad networks at optout.aboutads.info.
• Visitors in the EEA, the UK and Switzerland are asked for consent through a Google-certified consent message before any personalised ads or ad cookies are used, and can change that choice at any time from the "Privacy and cookie settings" link the message adds to the page.

Analytics

To learn which parts of the site pilots actually use, we measure visits without cookies:

• Cloudflare Web Analytics — page views and page-load speed, collected by our host without cookies or fingerprinting.
• Umami, run by us at analytics.keylinkit.net — page views, the referring site, browser, device type and country, plus a few anonymous events (for example "checklist downloaded" or "plan generated"). No cookies; visitors are counted with a one-way hash that is rotated regularly, and IP addresses are not stored.
• If we add Microsoft Clarity (heatmaps and anonymised session replay) to public pages, it runs without cookies, masks text you type, and never runs on checklist, editor, account, sign-in or plan-briefing pages. We will list it here before it is turned on.

Our own pages use your browser's session storage only to keep you signed in, and local storage for your work as described above.

Other services your browser contacts

Some pages load live data or libraries straight from other providers, who therefore see your IP address: aviationweather.gov and the FAA (weather, NOTAMs, charts), Open-Meteo and RainViewer (forecast and radar), Esri/ArcGIS and OpenStreetMap (map tiles), Windy (embedded wind map), and unpkg.com and cdnjs (Leaflet map and PDF libraries). The site is hosted on Cloudflare, which processes ordinary request logs (IP address, time, page) to serve the site and protect it from abuse.

Your choices and rights

• See, export or delete your data: most of it is visible and deletable on your profile page. To delete your account and everything stored with it, email the address on the contact page; we do it within 30 days.
• US state privacy rights (including California): we do not sell your personal information for money. Personalised advertising may count as "sharing" under California law; you can opt out using the Google settings above, by emailing us, or by enabling Global Privacy Control in your browser — when it is on, our pages ask Google for non-personalised ads only.
• EEA/UK: you have rights of access, correction, deletion, objection and portability, and may complain to your data protection authority.

Children

The site is not directed at children under 13 and we do not knowingly collect their personal information. If you believe a child has created an account, contact us and we will delete it.

Changes

If this policy changes, the date above changes and the previous version stays in the site's public git history.