Privacy Policy
Effective: May 11, 2026 -- AIVIATION LLC
Privacy at a Glance: WilcoAI streams your readback audio to AIVIATION servers for transcription and grading. Audio is processed transiently and discarded after the session ends. Transcripts and grading rubrics persist in our request logs for 30 days for quality and abuse-prevention purposes, then auto-expire. The free tier identifies a device via a non-reversible SHA-256 hash for rate limiting; no Apple ID, name, or email is collected.
1. Introduction
AIVIATION LLC ("we," "us") operates WilcoAI (wilcoai.app and the iOS app, bundle ID: app.wilcoai). WilcoAI is a voice-first ATC drill simulator that grades pilot radio readbacks against FAA phraseology. It is a training aid, not a flight tool. We minimize data collection at every tier.
2. Data We Collect
Free tier: To enforce the daily-challenge rate limit, AIVIATION servers compute and persist a non-reversible SHA-256 hash of the request's source IP and User-Agent header alongside an attempt counter (the "device hash"). The hash is not linked to your Apple ID, name, or email; it changes if your IP or device user-agent changes. We do not collect tracking identifiers, advertising IDs, or location data.
All tiers -- session audio and transcripts: When you start a drill, your microphone audio is streamed (PCM frames) to AIVIATION servers in AWS us-east-2. The stream is forwarded to Amazon Transcribe for speech-to-text and to Amazon Bedrock running Anthropic Claude Haiku 4.5 for grading. Raw audio is processed transiently and discarded when the session ends. Transcripts, grading rubrics, and aircraft profile metadata (callsign, type, equipment suffix, home base) sent with the session persist in our CloudWatch request logs for 30 days, then auto-expire. Bedrock and Transcribe do not retain customer prompts, transcripts, or audio for model training, per AWS policy.
Aircraft profiles, streaks, history: These live on your device. WilcoAI does not currently sync to iCloud.
3. AI Features
WilcoAI uses cloud AI for every drill: Amazon Transcribe converts your readback to text, and Anthropic Claude Haiku 4.5 on Amazon Bedrock grades the transcript against FAA standard phraseology and the current ATC simulation state. End-of-session debriefs may use Claude Sonnet 4.6. Both are hosted in AIVIATION's AWS account (us-east-2). AWS retains no customer data for training. AIVIATION's request/response logs retain transcripts and grading rubrics for 30 days, then auto-expire.
Grading and ATC controller responses are AI-generated and may contain errors. WilcoAI is a training aid only. Never act on simulated clearances.
4. Subscriptions
WilcoAI offers Free, First Officer, and Captain tiers, plus single-scenario consumable credits. All purchases are processed by Apple via StoreKit. We receive a record that your subscription or consumable purchase is active so we can unlock features; we do not receive your payment details. Apple's privacy policy applies to subscription processing.
5. App Store Privacy Nutrition Label
WilcoAI's App Store privacy nutrition label discloses, across all tiers: Audio Data (not linked to you, used for app functionality -- streamed to AWS for transcription and grading, discarded after the session), User Content (not linked to you, used for app functionality -- transcripts and aircraft profile metadata retained 30 days), Identifiers (not linked to you, used for app functionality and analytics -- the SHA-256 source-IP/User-Agent device hash described above), Product Interaction (linked, analytics), and Purchase History (linked, app functionality).
6. Your Rights and Data Deletion
On-device data (all tiers): aircraft profiles, streaks, and local session history live on your device. Delete the app to remove every local trace.
Free-tier device hash (server side): the SHA-256 hash and counter persist in DynamoDB to enforce the daily cap. Because the hash is not linked to your Apple ID, name, or email, we cannot identify which row belongs to you. The hash naturally rolls when your IP or device user-agent changes.
Session logs: transcripts and grading rubrics in CloudWatch persist for 30 days, then auto-expire. Because logs are not linked to your identity, we cannot tie a specific record back to you. For questions or requests, contact privacy@aiviation.dev.
7. GDPR (European Users)
Controller: AIVIATION LLC -- privacy@aiviation.dev
Data collected: Free-tier device hash (SHA-256 of source-IP/User-Agent) plus an attempt counter, persisted in DynamoDB until the hash naturally rolls. All tiers: session transcripts, grading rubrics, and aircraft profile metadata in CloudWatch logs for 30 days. Raw audio is processed transiently and discarded. No Apple ID, name, or email is stored. Apple processes StoreKit data independently.
Your rights: Access, rectification, erasure, restriction, portability, objection -- contact privacy@aiviation.dev. You may lodge a complaint with your local supervisory authority.
8. CCPA (California Residents)
We do not sell or share personal information for cross-context behavioral advertising. We collect only the data described in Section 2: a free-tier device hash for rate limiting, and session transcripts/rubrics in 30-day CloudWatch logs. California residents have the right to know, delete, correct, and opt-out of sale -- contact privacy@aiviation.dev with any requests.
9. Children's Privacy
WilcoAI is not intended for users under 13. We do not knowingly collect data from children under 13. The data we do collect (device hash, transcripts, grading rubrics) is never linked to identifying information.
10. Changes to This Policy
We may update this policy. Changes will be posted here with a new effective date. Continued use after the new effective date constitutes acceptance.