AirParcel
Privacy Policy
Last updated 11 October 2026
The short version
AirParcel flies messages between real airports. To do that we need to know who you are, who you are sending to, and what you are sending. We keep that and little else.
We do not sell your data. We do not run advertising. We do not track you across other apps or websites.
Your messages and attachments are private between sender and recipient. The exception is moderation: a moderator can read a parcel — and every time one does, it is recorded with their name and their reason.
What we collect
Location
If you allow it, the app reads your approximate location once, to sort the airport list so the nearest ones are at the top. It is sent to our server for that one request, used to order the list, and never stored — no record anywhere keeps it. Refusing it costs you nothing but a longer scroll.
Other pilots never see where you are. They see a city, because that is where an airport is.
Who else sees it
We use other companies to run AirParcel. Each one gets only what it needs.
We do not sell or rent your data to anybody, for any purpose.
People under 18
AirParcel asks everybody their date of birth before the app opens, and it cannot be changed afterwards.
If you are under 18, Discover and the pilot map stay switched off. You can send parcels to people you already know, and people you do not know cannot find you through them.
Two further rules apply to everybody, and they are the reason most of this never has to be moderated at all:
- Searching a partial name only finds people your own side of eighteen. Typing a few letters cannot produce a list of children. Somebody's exact, complete username still works, so a relative or a friend who was told it can still be found.
- The first message between two people carries no files. Photos, voice notes and documents unlock only once the other person has sent a parcel back and it has landed. Nobody can open a conversation with a picture.
Every profile can be blocked and reported. Blocking is immediate and silent to the person blocked.
If you believe a child's data is here and should not be, write to us at the address below and we will remove it.
Moderation, and the one time somebody reads your parcel
When a parcel or a profile is reported, a moderator can open it — the message, and any photo or voice note attached — to decide what to do.
A moderator can also open a parcel that nobody has reported — to investigate a complaint that arrived another way, or a pattern across several accounts. They cannot do it quietly. Every opening requires a written reason, and every one is recorded: who looked, at which parcel, why, and when. That record is permanent and we can produce it if you ask.
Nothing else reads your messages. No advertising system, no recommendation system and no model sees what you write unless a report brings it to a moderator — and when a report is made, only the reported text is sent for sorting, never your photographs or voice notes.
The one automatic check, and its exact limits
While a parcel is in the air, each attached file is fingerprinted and the fingerprint is compared against a list of files already confirmed to be illegal. If it matches, the parcel is stopped before it lands and a moderator is told.
What that is not, precisely:
- Nothing looks at your photograph. The check is arithmetic on the file's bytes. It cannot tell a face from a sunset, and it has no opinion about either.
- No model is involved and nothing is sent anywhere. The file is read, fingerprinted and dropped, inside our own systems. No third party receives it — which is why this adds nobody to the table above.
- A fingerprint is not a copy. It cannot be turned back into your file, and we do not keep one for anything else.
- It can only recognise a file it has already been told about. It cannot judge a picture it has not seen before, and it never tries.
How long we keep it
- Your account and parcels — until you delete your account. We do not expire your correspondence on a timer.
- Delivered notifications — 30 days.
- Reports and moderation records — two years after a case is closed. A pattern across several reports is the point of keeping them: one report a year looks like bad luck until you can see four. An open report is never deleted at any age.
- Notification tokens — deleted when you sign out, and in any case after 180 days without the app being opened, because a lost or wiped phone never signs out.
- Invite link clicks — 90 days, expired automatically by Cloudflare. We do not record who clicked.
Your rights
Wherever you live, you can ask us to show you what we hold about you, correct it, or delete it. Write to the address below and we will act within 30 days.
Deleting your account is immediate and has no undo. It removes your name, username, photo, date of birth, Fuel, fleet and connections, and unlinks your sign-in for good. If you signed in with Apple, it also tells Apple, so AirParcel disappears from your Apple ID's list of apps using Sign in with Apple.
Two things survive, and you should know both before you do it. Parcels you have already sent stay with the people who received them, without your name on them — they are that person's correspondence as much as they were yours, the same way an email you sent sits in somebody else's inbox. And safety reports about the account are kept: if deleting an account erased the reports against it, then deleting your account would be a way to erase your own record, and the people who most needed that would be the first to find it.
Changes
If we change this policy in a way that matters, we will tell you in the app before it takes effect — not by quietly editing this page.
Contact
Email info@airparcel.app.
AirParcel USA