Privacy & data handling

vCareer is a career tracker built on top of a public network. We store only what we need to make progression auditable and to verify mission completion. No advertising, no third-party trackers, no profile selling.

What we store

• VATSIM identity. Your cid, callsign, and country, returned by VATSIM Connect OAuth on sign-in.
• Game state. Classes you've entered, tier and XP per class, type ratings you've earned or purchased, your declared simulator and hangar.
• Mission history. Every offered, accepted, completed, expired, or abandoned mission. We keep these for audit and for the "first-time at airport" bonus calculation.
• Position samples. While you have an accepted mission, we sample your live VATSIM position every 15 seconds and persist it. Samples are how we verify takeoff, landing, diversion, and disconnect server-side.
• Economy ledger. Every ∀Cred credit and debit (rewards, type-rating purchases, fees) — the source of truth for your balance.

What we don't store

• Your password. Authentication is OAuth via VATSIM Connect. We receive a short-lived token; we never see the password you typed.
• Anything from your sim. vCareer doesn't read MSFS, X-Plane, or P3D. We don't install anything. We work entirely from the public VATSIM feed.
• Web analytics, of any kind. No Google Analytics, no Plausible, no Segment, no Mixpanel, no tracking pixels, no ad SDKs, no session replay. We don't fingerprint browsers and we don't collect ad IDs. The only counters we keep are first-party game-state counters (mission count, XP, balance) that the game logic needs to function.
• Your real name or email, unless you optionally provide one for support contact. The VATSIM record on file is sufficient.

Where it lives

Production runs on Cloudflare. The application database is Cloudflare D1 (managed SQLite), accessed by a single Cloudflare Worker. Data does not leave the Cloudflare network in normal operation.

• Authentication. Sessions are HTTP-only cookies signed with a Worker-side secret.
• Position pipe. A scheduled Worker polls the VATSIM public data feed every 15 seconds and writes samples to D1. Only known users (sign-ins with at least one accepted mission) are sampled.
• Backups. D1 snapshot retention follows Cloudflare's defaults.

Retention

• Game state and economy ledger: kept as long as your account exists.
• Mission history: kept as long as your account exists. Old missions are how "first-time at airport" stays meaningful and how leaderboards stay honest.
• Position samples: kept for 90 days after the related mission's terminal state, then deleted. The mission's outcome (completed / diverted / failed) is retained without the raw samples.
• OAuth tokens: stored only for the duration of the session; refreshed via VATSIM Connect, never long-lived in our database.

Your rights

• Export. A signed-in pilot can request a full JSON export of their account from Settings.
• Delete. A signed-in pilot can request account deletion from Settings. Game state, mission history, and position samples are removed within 30 days; the economy ledger keeps a zero-balance audit record for the same retention window then is purged.
• Questions. Privacy questions: open an issue on the public repository or email the address listed in the footer.

vCareer is not affiliated with VATSIM.net. We use the network's public OAuth and data feeds in accordance with VATSIM's published terms. Pre-launch we are in contact with VATSIM staff for explicit OK on storing OAuth'd user data.