Privacy and cookies
This notice covers the Drone Republic web application at dronerepublic.app and the Pilot Bridge app for Android. Last updated 8 August 2026.
Who is responsible
Drone Republic is operated by [operator legal name and registered address]. Questions about your data go to [data protection contact e-mail].
What we hold
- Account. E-mail address, display name, a hash of your password (never the password itself), which organization you belong to and your role in it. If you sign in with Google we receive your Google account e-mail, name and account identifier.
- Missions. Plans, waypoints, geometry, the checks a plan passed or failed, and the export files you generate.
- Flights. Telemetry recorded during a run — position, altitude, speed, battery, link quality — plus logbook entries, preflight checklists and which pilot flew.
- Fleet. The aircraft you add and their capabilities.
- Client outputs. Reports and share links you publish, and when a recipient opened them.
- Audit log. Who did what and when inside your organization, so the trail from briefing to report holds up.
- Technical records. Server request logs with IP address, user agent and timestamp, kept briefly for security and troubleshooting.
Why we are allowed to
- Performing the contract (GDPR Art. 6(1)(b)) — running your account and the service you signed up for.
- Legitimate interests (Art. 6(1)(f)) — keeping the service secure, preventing abuse and maintaining the audit trail.
- Your consent (Art. 6(1)(a)) — analytics cookies, and nothing else. You can withdraw it at any time.
Cookies
Necessary cookies are what makes signing in work; they need no consent and cannot be switched off. Analytics runs only if you allow it: until then the Google script is never loaded, so nothing is requested from Google at all. There are no advertising cookies, and Google Consent Mode is initialised with advertising storage denied.
| Cookie | What it does | Lifetime | Group |
|---|---|---|---|
dronerepublic_session | Keeps you signed in. In production it carries the __Host- prefix, so it is bound to this domain over HTTPS only. | 7 days | Necessary |
g_oauth_nonce | Ties a Google sign-in redirect to the browser that started it, so nobody else can finish your sign-in. | 10 minutes | Necessary |
dr_consent | Remembers the choice you made in the cookie banner. | 180 days | Necessary |
_ga, _ga_<id> | Google Analytics 4: counts visits and page views with a shortened IP address. Set only after you allow analytics. | up to 2 years | Analytics |
Change your mind whenever you like: .
Who else touches the data
- Google Ireland Ltd. Google Analytics 4, only with your consent. Google sign-in, only if you choose that way in.
- Cloudflare. Sits in front of the site as proxy and CDN, and therefore sees connection metadata such as your IP address.
- E-mail delivery. Invitations and verification messages are sent through a transactional e-mail provider once one is configured; until then they are not sent at all.
We do not sell data and we do not share it with anyone else. Where a provider processes data outside the EEA, it does so under the European Commission's standard contractual clauses.
How long we keep it
- Account, missions, fleet and audit log: until the organization is deleted.
- Telemetry: cleaned up automatically per plan — Hobby 30 days, Pro one year, Business kept until you delete it.
- Server request logs: short-term only.
Your rights
You can ask for access, correction, erasure, restriction, portability, and you can object to processing based on legitimate interests. Withdrawing consent is one click and does not affect what happened before it.
Two of these are built in: an owner can download the whole organization as JSON and delete it irreversibly under Team → Data & privacy. For anything else, write to the contact address above. You can also complain to your supervisory authority — in Slovakia that is the Office for Personal Data Protection (dataprotection.gov.sk).
Changes
When this notice changes we update the date at the top. If a change affects what you consented to, the cookie banner asks again.