Privacy

Last updated: 23 October 2026

You can read missileer.watch and listen live without an account. Signing in is optional. Here is everything we keep, why, and how to delete it.

Reading and listening

• Your volume setting is saved in your own browser, nowhere else. So is whether you have closed the front page's “New here? Start here” link or seen the guide it opens, whether you have seen or closed its aircraft-emails tips, and, when you sign in from an aircraft-emails link, which aircraft to tick for you on your account page (kept at most a day).
• Visits to the front page, the sources page and the aircraft page are counted with Cloudflare Web Analytics, a script from Cloudflare that sets no cookies. It is the one script on the site that is not ours. There are no ads.
• Listening now. While LISTEN LIVE plays, your browser sends a random number every 30 seconds so we can show how many people are listening. It is made fresh in each tab, is not linked to you, is kept only in our server's memory, and is forgotten 75 seconds after you stop. With it our server holds a keyed fingerprint of your network address, only to count at most five tabs from one address.

Notifications in your browser

Only if you tap NOTIFY ME OF NEW MESSAGES and allow notifications. No account is needed.

• What we keep: your browser's push subscription, when we got it, and which notifications it gets (your Settings). The subscription is an address at your browser's push service and two keys to encrypt with. Nothing else: no email address, no account, no network address.
• Who carries it: your browser's own push service: Google's for Chrome and most Android browsers, Apple's for Safari, Mozilla's for Firefox, Microsoft's for Edge on Windows. We send one notification for each new copied message. It is encrypted in transit, so the push service delivers it but cannot read it.
• When it is deleted: when you tap Turn off, or when your browser drops the subscription (blocking notifications for this site or clearing its data does that). Its push service then tells us it is gone, and we delete it.
• How to turn it off: Turn off under LATEST EAM, or block notifications for missileer.watch in your browser's site settings. Settings, beside it, chooses which notifications this browser gets.

If you sign in

If you sign in, we keep these six things about you, plus your sign-in session (described below):

• Your email address, to send you a sign-in link and to know it is you. The link works once, for 15 minutes; we keep only a fingerprint of it (a hash), never the link. The same email carries a 6-digit sign-in code, which we keep only as a keyed fingerprint (a hash made with a secret key), never the code itself, for exactly as long as the link: using either one uses up both.
• Your consent records, only if you tick the box for launch emails, the one for the daily summary or an aircraft type (below).
• Your “I heard it too” taps: which messages you tapped, and when. Only the total for each message is public, never who.
• Your aircraft emails, only if you tick a type: which types, and a record of each email (below).
• Your corrections and your listener name, only if you correct a copy, with the safety records that go with them (below).
• Your feedback, only if you send some (below).

Signing in sets one cookie, from our server (api.missileer.watch), only to keep you signed in, for up to 60 days or until you sign out. It holds a random code and nothing else. On our side we keep the matching session record until you sign out. Once it expires it stops working, and we delete it the next time anyone asks for a sign-in link.

We don't accept sign-ins from temporary inbox services, using a public list of their domains. The check reads only the part of your address after the @, and keeps nothing.

Launch emails

Signing in never puts you on a mailing list. Only the box “Email me about the Missileer device launch and site news.” does, and you can untick it before you send. It comes ticked only for visitors in the United States, going by the country Cloudflare reports for your connection; everywhere else it starts unticked.

If you tick it, we keep a consent record: when you did, the exact words you saw, whether the box came ticked, and the country that was based on. We have not sent any launch email yet. Before the first one, we will update this page to name the service that sends it.

The daily summary

Only if you tick “Email me a daily summary of copied messages” on your account page. It is a separate box from launch emails, and it starts unticked for everyone.

• What we keep: your email address (you are signed in) and the record of your choice: when you ticked or unticked it, the exact words you saw, and that the box started unticked. We also keep, for 14 days, a record of each day's summary to you: the day and whether it was sent.
• What you get: one email a day at 13:00 UTC, only on days when messages were copied: each message's first six characters, when it was heard, and a link to it. It is sent through Resend (below).
• How to stop it: the unsubscribe link in every email (one click), your mail program's own unsubscribe button, or untick the box on your account page. Each stops it before the next email.

Aircraft emails

Only if you tick an aircraft type under Aircraft emails on your account page. None is ticked until you tick it.

• What we keep: which types you ticked; a record of each time you ticked or unticked one, when, and how (on your account page, with a stop link in an email, or with your mail program's unsubscribe button); and a record of each aircraft email we sent you or tried to: which sighting it was about (the type, the aircraft's transponder code and callsign, the region and the time) and when. We also count your aircraft emails each day, for the daily limit.
• What you get: one email when a type you ticked shows up on public receivers after at least 6 hours with none of that type seen, whichever aircraft of that type it is. Gaps during a flight don't send another, and you never get two about the same type within 6 hours. At most 10 a day (UTC). Each says the type, the region and the time, with a link to follow the aircraft on the map. It is sent through Resend (below).
• How to stop it: Stop that type's emails, or Stop all aircraft emails, with the links in every email (they work signed out); your mail program's own unsubscribe button, which stops all of them; or untick the type on your account page. Each stops them before the next email.

Feedback

Only if you send some, with Send feedback at the foot of a page. You need to be signed in.

• What we keep: your note, its kind (an idea, something broken, or other) and the page you sent it from, with your account.
• Who reads it: Daniel, on his own account page and in one email a day to hello@missileer.watch. Both show your account number and listener name, never your email address. Daniel reads every note; nothing you send is shown to other visitors or published on the site.
• When it is deleted: with your account, when you choose Delete my account.

Who else sees it

Resend, which sends the sign-in emails, the daily summary and aircraft emails if you ask for them, the one email a day that brings us new feedback (no email address of yours is in it), and an email to us when corrections are paused automatically and one when that is over (only times and counts, nothing about any listener). It gets your email address only to deliver them, and keeps its delivery log, which includes the sign-in link and code, for 30 days. The link and the code stop working after 15 minutes either way.

Render, which hosts our server and its database. It keeps the server's logs, which hold no email addresses.

If you turn on notifications in your browser, your browser's push service carries each one, encrypted (above).

Your email address is never in our public files (archive.json, status.json) or our logs. It is kept in our database, which Render hosts (with its backups, below), and Resend receives it only to deliver the emails you asked for. We do not sell it or share it with anyone else.

How long

• Your account, until you delete it. If you leave the mailing list, we keep the record that you left for as long as you have an account, so we don't email you again by mistake. Deleting your account deletes that record too, with your address.
• A sign-in link and its code, until one of them is used. Unused, they stop working after 15 minutes and are deleted the next time anyone asks for a sign-in link.
• A browser's push subscription, until you turn notifications off or your browser drops it.
• The daily summary's consent record, until you delete your account. If you stop the summary, we keep the record that you did.
• The record of each day's summary to you, for 14 days, or until you delete your account.
• Which aircraft types you ticked, and the record of each time you ticked or unticked one, until you delete your account. If you stop a type, we keep the record that you did.
• The record of each aircraft email, for 30 days after the sighting it was about. The day's count, until the next day.
• Your feedback, until you delete your account.
• A network fingerprint, until 30 days after your last correction from that network.
• The record of a refused correction, for 30 days.
• The record that an account stopped counting, until the account is deleted or we lift it.
• Our database host's backups keep deleted data for up to 7 days.

How to delete it

On your account page: untick the box to leave the mailing list, untick the daily summary or an aircraft type, or choose Delete my account. Deleting removes your email address, your consent records, your aircraft emails' records, your feedback, your taps, your network fingerprints, your refused-correction records and the record that your account stopped counting, at once. Every count you added to drops by one. Your corrections stay (below).

If an account is blocked for abuse, by us or automatically after many refused corrections, its live corrections are rolled back and it can no longer correct copies or send feedback. We keep a salted fingerprint (a hash) of its email address so it can't sign up again, even after the account is deleted; never the address itself.

Browser notifications are not part of an account: Turn off under LATEST EAM deletes the subscription.

Corrections

A correction you make signed in is saved with your account: what you changed, on which message, your note if you add one, and when. On missileer.watch, other visitors see only how many listeners suggested a correction to a message (“N listeners suggested corrections”), never the correction itself or a name. You see your own, and we (the site's admin) see them all.

Each time you save a correction, whether the checks below accept it or refuse it, we also keep a fingerprint of the network it came from: the first three parts of an IPv4 address, or the first 56 bits of an IPv6 address, run through a keyed hash with a secret key. We never keep the address itself. We record it only for saves that reach us through Cloudflare, as saves from missileer.watch do, and never when you sign in. We use it only to stop one person using many accounts. A nightly job deletes each fingerprint 30 days after your last correction from that network, and deleting your account deletes them all.

Nobody reads every correction as it comes in, so the site checks each one when you save it. A correction that fails a check isn't saved. We keep a record that it was refused: which message, which kind of check, and when, never what you typed. A nightly job deletes these records after 30 days. An account with several corrections refused for what they say stops counting toward other listeners' totals; its corrections are still saved, and it still sees them. An account with many is blocked (above). So are accounts that stopped counting, once three or more of them have used the same network within 30 days.

Your listener name is a nickname you choose, or listener-xxxx (a random handle) until you do. For now, missileer.watch shows no list of listeners.

If you delete your account, your corrections stay in the archive, no longer tied to anyone, and your listener name is deleted.

Our working archive page took corrections and “not an EAM” flags without an account until 14 October 2026; since then it takes them only from us. Each change made there is stored with the network address it came from, to stop abuse. A nightly job deletes each address once it is 90 days old; the change itself stays.

Contact

Questions: hello@missileer.watch

Ideas or bugs? Send feedback (sign in first).