# Flight Pinger Privacy and Security Notes

## Data Sent Off Device

- ADS-B feed lookup: rounded latitude and longitude, plus scan radius, are sent to ADSB.lol.
- ADSB.lol aircraft position data is licensed under the Open Database License 1.0.
- Remote route and aircraft-photo lookups are disabled in this build until separately licensed.
- ATC and radar buttons open external websites in the user's browser.

## Data Kept Local

- The user's exact saved latitude/longitude is stored only in browser localStorage inside the local app.
- Sighted-aircraft history is stored locally in browser localStorage.
- No account, email, payment, license, or analytics identifier is currently collected by the app.

## Local Server Hardening

- The server binds to `127.0.0.1` only.
- Cross-origin browser requests are blocked.
- CORS wildcard headers are not emitted.
- Only `GET` and `HEAD` requests are allowed.
- Static responses include no-sniff, frame-deny, no-referrer, and a restrictive content security policy.
- Outbound ADS-B feed coordinates are rounded before leaving the machine.

## Release Hygiene

- Do not ship `.DS_Store`, build logs, screenshots, backups, generation queues, or source prompts.
- Do not include local absolute paths in public release notes, documentation, or support screenshots.
- Before distributing, rebuild and sign/notarize from a clean release folder.
