Privacy Policy

What I store, and where

Your records (health readings, doctor visits, medications, medical history, Special Issuance profiles, documents, and certificates) are stored on your device and sync only through your own iCloud private database. I operate no server that holds this data and cannot query it.

Apple Health

If you connect Apple Health, the app requests read-only access to the metric types you choose. It never writes to Health, never uses health data for advertising, and never sends it to any server. It flows only: Apple Health → your device → your own iCloud.

Location

If you tap "Use Current Location" in the AME Directory, your location is used only on your device to sort AMEs by distance. It is never stored or sent anywhere.

Documents you scan

Scanned documents are turned into PDFs on your device, encrypted at rest, and synced only through your iCloud private database. On-device text recognition (OCR) never leaves your device.

Safari Web Extension (MedXPress autofill)

When you enable PMG's optional Safari extension, it runs only on medxpress.faa.gov. The extension reads your already-saved records (medications, doctor visits, medical history answers) from the same on-device storage as the main app, through Apple's shared App Group mechanism. Your data never transits any server. It writes those records into MedXPress's form fields so you don't have to retype them at every renewal. You can disable the extension any time in Safari's settings; the main app keeps working without it. The extension itself uses no analytics, sends nothing to me, and connects to no third-party service. It only reads your already-saved records and writes them into the MedXPress form fields.

FAA reference content

The app downloads public FAA reference data (thresholds, medications, requirements, AME data) as anonymous static files. These requests carry no identifier and no health data. They look like any other file download. Nothing about you is ever sent back.

No tracking, no ads, no selling in the app

There is no analytics SDK on your health data, no advertising in the app, and I never sell your data. Not now, not ever. The app does use a subscription provider, RevenueCat, to run the Guardian Pro subscription: it receives an anonymous "is this device subscribed?" signal (never any health content, and nothing that identifies you) so Pro unlocks, renewals work, and I can see anonymous, aggregate subscription numbers. That's the one thing the App Store lists as collected. See "Subscriptions & payments" below for exactly what it is and isn't.

This website, separate from the app, counts page views using Cloudflare Web Analytics. It's cookieless, doesn't follow you across other sites, and doesn't build a profile of you. It tells me which pages get read and roughly what country a visit came from; nothing that identifies you, and it has no access to anything in the app.

I'm also running a small paid-search test to see whether ads are a sensible way to reach pilots, so this website currently loads Google's advertising tag as well. I'd rather tell you than have you find it. Unlike the Cloudflare counter, it does set cookies and it does let Google connect a visit here to an ad click. That is ordinary ad measurement, and it is the one thing on this site that follows you across sites. It sees pages and clicks on this website only. It has no access to anything in the app, and there is nothing about your health, medications, conditions or documents on this website for it to see: those live on your device and your own iCloud and never reach any web page. If I stop the test, the tag comes off and this paragraph goes with it.

Subscriptions & payments

Guardian Pro is a paid annual subscription. Apple processes the payment and is the seller of record. Apple, not I, handles your money and card details. To manage the subscription itself (unlock Pro, track renewals), the app uses a subscription provider called RevenueCat. This is part of how the subscription works. It isn't a separate feature you opt into.

Here's exactly what that involves. The app checks whether this device is subscribed at launch, and when you subscribe or renew. Each time, it sends RevenueCat an anonymous app-user ID (a random string, not your name or your Apple ID) and your subscription status ("is this device subscribed, and when does it renew"). That lets your Pro features unlock, keeps renewals working, and gives me anonymous, aggregate subscription numbers (how many people subscribe, renew, or cancel) so I can run the business. That is the entire extent of it.

RevenueCat never receives your health readings, conditions, medications, doctor visits, medical history, Special Issuance data, documents, Apple Health data, your name, your email, or your real identity. None of that is ever sent to it.

This is why the App Store's privacy label lists exactly one collected data type (Purchases, Purchase History), marked Not Linked to you and not used for tracking. Your health and medical data stay Not Collected. RevenueCat's own privacy policy is here: revenuecat.com/privacy.

Your control

You can archive or permanently delete any record, and "Erase All Data & Start Over" removes everything from your device and iCloud. Because your data lives in your iCloud, it is also governed by your Apple account security.

Contact

Questions about this policy or how the app handles data can be emailed to support@pilotmedicalguardian.com. You can also send feedback right from the app (About → Send feedback).