Privacy Policy

RampReady LLC (“RampReady,” “we,” “our,” or “us”) operates the RampReady™ platform, including getrampready.com, the FBO Dashboard, the RampReady app for iPhone and the RampReady Crew app for iPhone (together, the “Service”). This Privacy Policy explains what information we collect when you use the Service, how we use it, who we share it with, and the choices you have.

This policy applies to FBO operators and their staff (CSRs, line crew, administrators), to pilots who create a free account, to pilots who browse fuel prices without creating an account, to anyone who installs one of our iPhone apps, and to visitors to getrampready.com.

If you have questions, email hello@getrampready.com.

Information you give us directly

• Email address (required to create an account).
• First name, last name.
• Phone number, if you add one to your profile. It is optional. We share it with the FBOs you send requests to, in the app or by email, so they can reach you about your trip.
• A profile photo, if you choose one. It appears on your profile in the app. It is stored at a public web address made from your account ID. Your account ID is not secret: other people signed in to RampReady can see it, for example in a chat. So treat the photo as public: anyone who knows your account ID can open it.
• Reviews you write about an FBO you used: a star rating and an optional comment. Reviews are public (see “What FBOs see”).
• Password — stored only as a salted hash via Supabase Auth. We never see, log, or transmit your plaintext password.
• For FBO accounts: business name, ICAO airport code, fuel prices, ramp fee structure, hours, services offered, shift handoff notes, team member emails, and any content you post in the dashboard.
• For pilot accounts: home airport, and for each aircraft its tail number, make and model, fuel type and, if you add one, its operator (the company, school or club you fly it for). FBOs on RampReady see the operator (see “What FBOs see”).
• Rewards program numbers, if you add them: Signature TailWins, Atlantic Rewards, Avfuel AVTRIP and Phillips 66 WingPoints. They are optional. We send them only to the FBOs described in “What FBOs see”, so they can credit your points.
• Service requests you submit (arrival/departure times, fuel quantity, services selected, and any freeform notes).
• Messages sent through the pilot ↔ FBO chat.
• Payment information — collected and stored entirely by Stripe (see “Third-party service providers” below); card details never touch our servers. We store only your subscription status and billing email.
• Optional two-factor authentication secret (TOTP), stored encrypted.

Information collected automatically

• Session and authentication tokens, stored per-tab in browser sessionStorage (and in localStorage if you choose “keep me signed in”).
• IP address, used for rate limiting and abuse prevention.
• Browser and device information (user agent, screen size).
• Error and crash reports through Sentry (see below). We remove cookies and sign-in tokens. Reports from the iPhone app carry no name, email address, IP address or account ID.
• Approximate location that Mapbox, our map provider, may estimate from the network address of each map request. We never receive it.
• If you turn on notifications, we store what is needed to send them: your browser's push subscription on the website, or your phone's push token in the app. Either is kept with your account.
• If you sign up by scanning an FBO's QR code, or by telling us at sign-up which FBO sent you, we record which FBO referred you. That FBO can see how many pilots signed up through its code — a count only, not your identity.
• In the iPhone app, location only while you are waiting for fuel at an FBO on RampReady. The app checks it on your phone, when your place in the fuel line shows and each time you open the app, until it can tell you have landed. The reading is not sent to us or to anyone else, and it is not stored.
• Each time a map loads, the app sends Mapbox a short message that Mapbox uses to count monthly users. It carries an ID that Apple gives our apps on your phone, your device model and iOS version, and whether the app may use your location. The app switches off Mapbox's optional data collection, so Mapbox receives nothing else from the map beyond the map requests themselves.

Flight data

We retrieve aircraft position data from Flightradar24 to show FBO staff where the flights they are expecting are: our live tracking map, arrival cards, and automatic arrival detection. For an arrival an FBO has on its board, in the hours around its arrival time, we may send Flightradar24 the aircraft's registration (tail number), or the flight's callsign when that is what the FBO entered, and, to confirm a landing, Flightradar24's own ID for that flight. We send no name, email address, phone number or account details. US aircraft registration numbers can be linked to registered owners in public FAA records, so a tail number we send can identify an aircraft's owner. We store recent position history for about 48 hours, after which it is automatically deleted, and a short tracking record for each tail number we check (when we last checked it, where it last was, and whether it landed), which is deleted 7 days after the last check.

• To provide the Service — creating and managing your account, fulfilling service requests, routing messages between pilots and FBOs, processing payments.
• To communicate with you — transactional email about account changes, service requests, and billing.
• To improve the Service — aggregated, de-identified usage patterns (e.g. which screens are used most, what errors recur).
• To protect the Service — fraud prevention, abuse detection, rate limiting.
• To comply with legal obligations — tax, accounting, and valid law-enforcement requests.

We do not sell, rent, or share your personal information for advertising purposes. We do not run third-party advertising on the Service.

When you send a request to an FBO that is not on RampReady, we email it to that FBO's front desk, at the address we have on file or one you give us, through our email provider, Resend. The email includes your name, your phone number if it is on your profile, your tail number and aircraft type, your arrival or departure time and route, the fuel and services you asked for, and your notes. It gives your email address as the reply address, so the desk can answer you directly. These FBOs are independent businesses that have not agreed to our terms; once they have your request, their own privacy practices apply.

When you send a request to an FBO that is on RampReady, its staff see it in their dashboard and on their phones: your name, your phone number if it is on your profile, your aircraft's operator if you have added one, your tail number and aircraft type, your arrival or departure time and route, the fuel and services you asked for, and your notes. They can message you in the app.

If you save rewards program numbers, we add the right ones to your requests so the FBO can credit your points. Your Signature TailWins number goes only on requests to Signature locations, and your Atlantic Rewards number only on requests to Atlantic locations. Your Avfuel AVTRIP or Phillips 66 WingPoints number goes on a request only when the request form shows it going with that request: on its own for an FBO that tells us it honors that program, or when you add it yourself. The FBO sees the number in the request email, or on the request in its dashboard if it is on RampReady. No other FBO sees it.

An FBO on RampReady with a live account can also learn who you are without a request from you. When its staff put your tail number on their board (for a walk-in, a phone call, or a flight another FBO on RampReady sends on to them), RampReady matches the tail to your account. They then see your name and your aircraft's operator, and can message you in the app. If more than one pilot has added the same tail number, they see each of those pilots' names and operators, so they can choose whom to message.

Reviews are public. Anyone, with or without an account, can read your rating and comment on that FBO's page. They are shown with your first name and last initial, next to any reply from the FBO.

Where GDPR or equivalent law applies, we rely on the following legal bases:

• Performance of a contract — operating the Service you signed up for.
• Legitimate interest — security, abuse prevention, and product improvement, where that interest is not overridden by your rights.
• Consent — for anything that requires it; you may withdraw consent at any time.
• Legal obligation — tax, accounting, and law-enforcement compliance.

We share data with the following providers strictly to operate the Service. Each provider that processes your personal data for us is bound by its agreement with us to protect it at least as well as this policy does.

• Supabase (Supabase Inc.) — hosts our database and authentication. Stores account, profile, and service-request data.
• Stripe (Stripe, Inc.) — processes subscription payments and stores your card details. Card data never touches our servers; we hold only your subscription status and billing email.
• Stream Chat (Stream.io Inc.) — stores messages sent between pilots and FBOs via our in-app chat.
• Mapbox (Mapbox, Inc.) — serves the maps on our website and in the iPhone app. Mapbox may log approximate location from map requests, and the app's maps send Mapbox the short message described above.
• Sentry (Functional Software, Inc.) — error and crash monitoring for the website and the iPhone app. We remove cookies and sign-in tokens from reports, and reports from the app carry no name, email address, IP address or account ID.
• Upstash (Upstash, Inc.) — stores rate-limiting counters keyed on IP or user ID; auto-expires within 24 hours.
• Anthropic (Anthropic, PBC) — powers AI-generated aircraft briefings shown to FBO staff. Requests contain the aircraft tail number (which may be linked to a registered owner in public FAA records), aircraft type, and airport metadata — never your name, email, or account details.
• Resend (Resend.com Inc.) — delivers our email: sign-up codes, password resets, invitations, contact form submissions, our own internal notices, and pilots' requests to FBOs that are not on RampReady (see “What FBOs see”).
• Vercel (Vercel Inc.) — hosts and delivers the web application, and counts page visits on the website without cookies.
• Push services — Expo (650 Industries, Inc.) and Apple's push notification service deliver the iPhone app's notifications; Apple, Google and Mozilla deliver browser notifications. They receive your device's push token or browser subscription and the text of each notification. Expo also receives a random ID for your install of the app when the app checks for updates.
• Flightradar24 (Flightradar24 AB) — provides the live positions of the flights FBOs are expecting. We send it the tail numbers or callsigns of arrivals FBOs have on their boards, and its own flight IDs to confirm landings (see “Flight data”). A tail number can be linked to the aircraft's registered owner in public FAA records. We send it no name, email address or account details.

We use browser sessionStorage and localStorage to hold authentication tokens (so you stay signed in, including across visits if you choose “keep me signed in”) and to remember device preferences like your theme. We do not use analytics cookies, advertising cookies, or cross-site tracking technologies. Our website counts page visits with Vercel's cookie-free analytics.

• Account data — retained while your account is active. Deleted within 30 days of account deletion, excluding data we are required to retain for legal, tax, or accounting purposes. Records of past visits (tail number, arrival details, and operational notes) may be retained in the relevant FBO's history after your account is deleted, with the link to your account removed.
• Reviews — shown on the FBO's page while your account exists, and deleted when you delete your account.
• Profile photo — deleted when you delete your account, or as soon as you remove it.
• Payment records — retained by Stripe per their retention policy and by us for tax and accounting (typically 7 years).
• Messages — retained while your account is active. When you delete your account, messages are removed from our database; copies held by our chat provider (Stream) are deleted through their data-deletion process, which may take up to 30 days.
• Flight position data — automatically deleted after about 48 hours. The tracking record for each tail number is deleted 7 days after its last check.
• Error events (Sentry) — retained 90 days by default.
• Rate-limiting data (Upstash) — expires automatically within 24 hours.
• Database backups — encrypted backups are retained for up to 12 weeks and rotated out. Deleted data may persist in those backups until they rotate.

• TLS 1.2 or higher on every network connection.
• Row Level Security (RLS) on every database table, scoped to your authenticated identity so one user can't read another user's rows at the database layer, except what is public by design, such as reviews, FBO listings and profile photos.
• Strong password requirements — minimum 10 characters with lowercase, uppercase, digits, and symbols; checked against known-leaked passwords at signup and reset.
• Optional two-factor authentication (TOTP) with one-time recovery codes.
• Encrypted backups with weekly off-site rotation.
• Security headers on every HTTP response: Content-Security-Policy, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy.
• Automated error monitoring so issues are detected and fixed quickly.

No online system is 100% secure. If we learn of a breach affecting your personal data, we will notify you and any applicable regulators as required by law.

Depending on where you live, you may have the right to:

• Access the personal information we hold about you.
• Correct inaccurate or incomplete information.
• Delete your account and associated personal data.
• Export your data in a machine-readable, portable format.
• Restrict or object to certain processing.
• Opt out of sale or sharing of personal information (we do not sell or share for advertising).
• Withdraw consent where we rely on it.
• Lodge a complaint with a supervisory authority.

To exercise any of these rights, email hello@getrampready.com. You can also delete your account at any time: in the RampReady app for iPhone, open the Profile tab and tap Delete account at the bottom; on the website, go to Settings and use Delete account.

Categories of personal information we collect: identifiers (email, name, phone number, account ID, IP address, device push token, rewards program numbers), commercial information (subscription records), internet or network activity (pages visited, error reports, browser and device details), geolocation (approximate, from map requests), professional information (tail number, aircraft operator, FBO role), and content you provide (profile photo, requests, messages, reviews).

We do not sell or share personal information as those terms are defined under the CCPA / CPRA. California residents may exercise the rights listed in the “Your rights” section above. We will not discriminate against you for exercising these rights.

The Service is not directed to individuals under 16. We do not knowingly collect personal information from anyone under 16. If you believe a child has provided us information, email hello@getrampready.com and we will delete it.

RampReady is based in the United States. If you access the Service from outside the US, your information may be transferred to, stored, and processed in the US or in other countries where our service providers operate. By using the Service you consent to such transfer.

We may update this Privacy Policy from time to time. Material changes will be announced by email to your account and by updating the “Last updated” date at the top of this page. Your continued use of the Service after an update constitutes acceptance of the revised policy.

RampReady LLC
hello@getrampready.com