← Homepage

vNAAATS - privacy and data handling

Last updated 23 October 2026

vNAAATS is an independent, community project. It is not run, owned or endorsed by VATSIM. It is for flight simulation only and must never be used for real-world navigation or air traffic control.

Who runs it

vNAAATS Version 2 is maintained by Gary Thomas (original vNAAATS by Andrew Ogden). Gary Thomas is the person responsible for the personal data described on this page. Questions, corrections and requests about your data: info@vnaaats.com (or GitHub issues).

What this site and server handle

  • Public VATSIM data. Pilot callsigns, positions and flight plans, and online controller callsigns and frequencies, are read from VATSIM's public data feeds. Oceanic clearance information comes from natTrak (nattrak.vatsim.net).
  • Flight data that controllers enter. Level, Mach, track, route changes, SELCAL, notes and similar are stored on the server with the name and callsign of the controller who last changed them, and the time. Flights are removed some time after they stop being updated.
  • Sign-in (Flight Data Display). If you sign in with VATSIM, the server receives your name, VATSIM ID (CID) and controller rating, which it uses to decide whether you may make changes. If a password is used instead, you enter the name you want shown. Your sign-in lives in a session kept in the server's memory for up to 12 hours; it is dropped when you sign out or the server restarts.
  • Personal plugin keys and passwords. A certified (endorsed) Gander Oceanic controller can request their own key and password from the Gander Oceanic website. The server stores your CID, your name, when the key was made and when it expires (90 days), when it was last used, and a one-way hash of the key and of the password, so a copy of the database cannot reveal either. Whether you are certified is checked against the public Gander Oceanic roster (ganderoceanic.ca/api/roster), which also lists the oceanic controllers of VATSIM UK and Virtual New York ARTCC. Only oceanic controllers on that roster are checked, and your key stops working if you leave it.
  • Getting an API key (vnaaats.com/get-key). When you ask for a key the server stores your CID, the name and email address you type, your IP address at that moment, and when the key was made and when it expires (90 days). This is kept so that misuse of a key can be followed up with you, the VATSIM supervisors and your division. It is not shown to other controllers or shared otherwise. It stays with your key record until that record is removed.
  • FDD for Windows (the Windows app, optional). It opens this website in its own window and, only when you ask it to or when you choose your position, it can check and replace the plugin DLL and ICAO_Airlines.txt in the folder you choose, write your key into your own vnaaats.cfg, and start EuroScope and VACS from the paths you pick. The folder and program paths are kept on your own computer. If you choose "Remember me", your sign-in name and password are kept in the Windows Credential Manager on your computer, not on our server, and you can forget them from the sign-in screen. Links to natTrak and similar sites open in your normal browser. The app sends nothing to us beyond what the website itself does.
  • The EuroScope plugin. It sends flight plan changes, which aircraft you have selected and are tracking (kept in the server's memory for a few minutes so your aircraft can be re-tracked after a crash), and your controller callsign to this server, using your key.
  • CPDLC messages. Datalink messages sent through the server's CPDLC station (via the Hoppie network) are kept on the server so controllers can see the conversation. The Hoppie logon code you type is held in the server's memory only while you are signed in. It is never written to disk.
  • Position times for Concorde. Times typed in for Concorde flights are kept for 24 hours.
  • Cookie and browser storage. One sign-in session cookie, used only to keep you signed in. Your browser also stores a few settings on your own device (for example strips you have hidden, the time-window filter and whether you have been sent to sign in to natTrak). There are no advertising, analytics or tracking cookies.
  • Server logs. Like any web server, requests (including IP address, time and page) are written to the ordinary server logs for running and fixing the service. They are not shared or used for anything else.
  • Discord notices. The server and the build system post plain notices to a Discord channel when a new version is released. They contain no personal data.

Services the server talks to

VATSIM (public data feed and, once approved, VATSIM Connect sign-in), natTrak, the Hoppie ACARS network (CPDLC), the Gander Oceanic website (roster check) and GitHub (downloads of the plugin). Each has its own privacy policy.

What we do not do

  • We do not sell or give your data to anyone, and we do not use it for advertising or tracking.
  • We do not collect your VATSIM password or any other service's password. VATSIM sign-in takes place on VATSIM's own site.

Why the data is used, and how long it is kept

  • Why: only to run the tool: to show flight data, to let controllers make and share changes, and to make sure only the right people can. The basis is our legitimate interest in running a community flight simulation service, and your agreement when you sign in or ask for a key.
  • Flights are removed some time after they stop being updated. Sign-in sessions end after 12 hours. Concorde times are kept for 24 hours. Personal keys last 90 days and are withdrawn if you leave the roster; the record is kept until you ask for it to be removed. CPDLC messages are kept on the server until they are removed.
  • Where: the server is hosted in Germany (Hetzner). Because VATSIM is a worldwide network, your name and CID can be seen by other controllers using the display. Data is not otherwise sent outside the services listed above.

Your rights and choices

Whatever country you are in, you can ask us to tell you what is held about you, correct it, delete it, limit how it is used, or give you a copy, and you can object to how it is used. In the UK and the EU these rights come from the UK GDPR and the EU GDPR; we apply them to everyone. Email info@vnaaats.com and quote your VATSIM ID. We aim to reply within one month.

You can sign out at any time. If you are not happy with how we handle your data you can also complain to your local data protection authority (in the UK, the Information Commissioner's Office, ico.org.uk).

Back to vNAAATS