Tach & Go Privacy Policy

Tach & Go is software that flying clubs, flight schools, FBOs, boat and car clubs, and similar organizations use to share aircraft, boats, vehicles and other equipment, and to run their membership and their finances. Those organizations are our customers. This policy has three parts: one for organizations, about the information they keep in Tach & Go; one for the people whose information an organization keeps; and one for visitors to our own website.

Your data is yours. Each organization decides what it collects, how it uses that information, and how long it keeps it. It builds its own forms, keeps its own notes and sets its own rules. We run Tach & Go on your behalf, and we handle your organization's information only to provide the service to you, to keep it secure and working, and to help when you ask us to.

What we never do. We never sell or rent your organization's information. We never use it for advertising. We never share one organization's information with another. We do not use it to train artificial intelligence.

What Tach & Go can hold. Depending on what your organization chooses to collect, Tach & Go can hold: names and contact details; dates of birth and home addresses; employment details; licenses and certificates, such as driver's licenses, pilot certificates and boating licenses; ratings; experience, such as flight hours; medical class and dates; answers about accident history and enforcement by regulators such as the FAA or the U.S. Coast Guard; identity details such as driver's license and passport numbers; emergency contacts; uploaded documents; reservations, flight records, squawks and maintenance records; invoices, payments and account balances; and anything else your organization chooses to record, including notes and comments your administrators write, which can contain anything. Tach & Go does not ask for Social Security numbers and does not run credit or background checks.

Where it is kept. In the United States: in Amazon Web Services' US East (Northern Virginia) region, through our database provider, and our backups with Backblaze, also in the United States.

Who helps us run it. We use a small number of service providers, each only for its part of the service:

• Supabase: the database, sign-in and file storage (on Amazon Web Services)
• Vercel: hosting the website and the app
• Resend: sending email
• Twilio: sending text messages
• Backblaze: storing encrypted backups
• Railway: converting documents, for example Word files to PDF
• Cloudflare: protecting our public forms from automated abuse. Our sign-in, contact and application pages, and the directory's forms for adding or correcting a listing, run Cloudflare's human check as they load, to keep out automated abuse; Cloudflare's own privacy policy applies to what it collects there.
• GitHub: running our nightly backup, which passes a copy of the data through its computers on its way to Backblaze
• Microsoft: our own email, where messages to support@syncetc.com arrive

We choose our providers with care and require each to use your information only to provide its service to us. You can review each provider's own privacy policy on its website. If this list changes, we update it here before the change.

Who at SyncEtc can see it. Only the people at SyncEtc who need to, and only to help when you ask or to keep the service running and secure. The tools we use to build and maintain Tach & Go work on how the system is built, not on your organization's records.

Keeping it safe. Information is encrypted while it travels and while it is stored. Administrator tools can be used only after two-step verification. Every night we make a backup, lock it so it cannot be changed or deleted for 30 days (not even by us), and test that the database restores from it. Once a month we practice a full restore.

If something goes wrong. If we learn that your organization's information has been accessed without permission, we will tell you without undue delay, tell you what we know, and help you meet any duty you have to tell the people affected.

Requests from your users. If someone whose information your organization keeps asks us for it, or asks us to change or remove it, we will refer them to you, and help you respond if you need it.

Records that cannot be deleted while you use Tach & Go. While your organization uses Tach & Go, a few kinds of records cannot be deleted by anyone, because deleting them would make its books impossible to audit, or erase its proof of what people agreed to: posted invoices, payments and account entries (mistakes are corrected by a reversing entry, never erased), and the record of what a person agreed to, such as their application's agreement, their consent to text messages, and their permission to use a photograph. Your organization can still remove most of a person's other details at their request.

After you leave. You can export your organization's information at any time. If your organization stops using Tach & Go, we keep its information for 90 days so it can be exported or restored. After that, SyncEtc deletes all of it, including the records above. Copies in our backups are deleted as those backups age out, within 13 months. We keep only our own records of our dealings with your organization (its acceptance of our Customer Terms, our invoices to it and our correspondence) for as long as the law requires, and its short name within Tach & Go, which stays reserved so that no other organization can ever use it and old links never lead somewhere else. Your organization's own web address (domain) is yours, and we never take or keep it.

Your part. Your organization is responsible for what it chooses to collect, for having its own privacy notice for the people whose information it keeps, for any consent it needs from them (including any consent the law requires from the parents or guardians of minors), and for who it makes an administrator.

The organization you belong to, or applied to, decides what it collects about you and what it does with it, under its own privacy policy. Ask that organization if you want to see, correct or remove anything it holds.

Each organization keeps its own record of you, with information it gets from you or from other sources, and each is responsible for its own information. If you use Tach & Go with more than one organization, nothing you tell one reaches another. Some of what you write is seen by other members of your organization, such as a note on a reservation or a post on the message board. When you leave an organization, it keeps its record as it was, under its own privacy policy.

If you use the same email address with more than one organization, your sign-in works for all of them, and a menu lets you switch between them. That sign-in is the only thing they share. If you would rather keep them apart, use a different email address with each.

You manage your own sign-in. If you forget your password, you can reset it yourself by email, and you can change your sign-in email address yourself, too: we confirm that change with both the old and the new address. An organization's administrators cannot change your password or your sign-in email. If you have lost access to your email address, contact us at support@syncetc.com as a last resort: we will verify who you are and change it for you. Only SyncEtc can do that. If you lose the phone with your authenticator app and your recovery codes, contact us the same way: we will verify who you are and remove your two-step sign-in, and you set it up again the next time you sign in. An organization's administrators cannot remove it.

When you sign in, we keep your email address and a record of your sign-ins, such as the time, the browser and device, and the network address (IP address), to keep your account secure. The record of each browser you are signed in on is kept until you sign out of it there, and the time of your latest sign-in is kept with your account.

If you think an organization is misusing Tach & Go, tell us at support@syncetc.com.

Text messages. We send text messages only to people who turn them on in their profile. Message frequency varies with your own activity. Message and data rates may apply. Reply STOP to cancel or HELP for help. We do not sell or share your phone number, and we do not use it for marketing.

You can turn text messages off at any time from the same place you turned them on, in your profile.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. All the above categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.

Children. Tach & Go is not meant for children under 13. An organization whose users include minors, as the law where they live defines them, is responsible for any consent the law requires from their parents or guardians.

Emails sent to you through Tach & Go. Some emails come from SyncEtc, and some from the organization you belong to, sent through Tach & Go. When an email gives you a link (to apply, to sign in, to reset a password, to confirm your address or a message, to withdraw an application, to change your email, or an invitation), we keep a short record of it: the kind of link, your address, the organization, when it was sent, and whether it was delivered or why not. We delete that record after 30 days. If an email to you bounces or is marked as spam, the organization's administrators can see that, so they can correct your address.

When you write to us, through one of our forms or by email, we keep your message and your contact details to answer you. We record the network address (IP address) a form is sent from, to limit abuse. Our website uses only the cookies it needs to keep you signed in and to remember which organization you are working in. We do not use advertising or tracking cookies, and we do not sell information about visitors. Some pages can show a map from Google Maps, OpenStreetMap or OpenFreeMap, or a video from YouTube. Each loads from that company only when you choose to show it, and that company's own privacy policy then applies.

If we change this policy in a way that matters, we will tell organizations before the change takes effect, and an administrator of each organization must accept the new version within 30 days, as our Customer Terms explain. The date at the top shows when it last changed.

Questions about this policy: SyncEtc LLC, support@syncetc.com.