Cordaxis Universal RC Controller
Privacy policy
Version of 25 October 2026 (private messages, end-to-end encrypted, in sections 2, 3, 5, 6 and 10). This is the version recorded against your account when you accept it at sign-up. If it changes in a way that affects you, we will let you know in the program.
1 Who handles your data
The controller is the owner of Cordaxis. For anything to do with your data, write to cordaxis.rc@gmail.com.
We have no Data Protection Officer, and given the size and nature of the processing we are not required to have one (GDPR Article 37). A person reads that inbox.
2 What we collect and why
Only what the program needs to work. We do not buy data, we do not sell yours, and there is no advertising or commercial profiling.
| What | Why | Legal basis | How long |
|---|---|---|---|
| Name, email and photo that Google or Discord give us, if you sign in with them | Creating the account without another password | Contract | While the account exists |
| If you turn on two-step verification, the key that generates its codes (kept by Supabase) | Asking you for the code when you sign in | Contract | Until you turn it off or delete the account |
| The beta-tester mark, if we give you one | Giving you the whole community while you test the program | Contract | Until it is removed or you delete the account |
| Your email, if we invite you to test the beta before you have an account | Giving you the beta-tester mark as soon as you sign up with that email | Pre-contractual steps at your request (Art. 6(1)(b)) | Until you sign up, or 30 days if you do not |
| Email and password | To have an account and sign in | Contract (Art. 6(1)(b)) | While the account exists |
| Name, username, photo | So people recognise you in the community | Contract | While the account exists |
| Country | Program language and country rankings | Contract | While the account exists |
| Year of birth | To check you meet your country's minimum age to have an account | Contract (Art. 6(1)(b)): without that age no contract can be made | While the account exists |
| Forum, club and wall messages, with their photos | So the community exists | Contract | See section 5 |
| Private messages, end-to-end encrypted: we keep the encrypted text, who sends it, to whom and when | So you can write to other pilots | Contract | See section 5 |
| The keys of the encrypted chat: your account's public key and a copy of the private ones, encrypted with a key derived from your password | So that only the sender and the recipient can read private messages, also when changing computers | Contract | While the account exists |
| Your status for your friends: online, away or a line you write yourself | So your friends know whether you are around and what you are up to | Contract | Until you change it or delete the account |
| Email notice of unread private messages, with the program's language; and “Seen” | So you know someone wrote to you even when the program is closed | Legitimate interest (Art. 6(1)(f)): that messages are not missed. You can object with «Email me», in the chat settings wheel | While the account exists |
| Flight log, including the place and its coordinates if you enter them | To keep your record of flights | Contract | While the account exists, or until you delete it |
| Each confirmation of the safety notice before piloting: date and time, notice and terms versions, language, vehicle, output mode and profile name | To show that you were warned before each session | Legitimate interest (Art. 6(1)(f)): defence against claims | While the account exists |
| Inventory: batteries, consumables, photos and purchase links | So you can track your gear | Contract | While the account exists |
| Flight hours, streaks, level | Rankings and progress | Contract | While the account exists |
| Reports you file or receive | Moderating the community | Legitimate interest (Art. 6(1)(f)): making it liveable | See section 5 |
| Moderation notices that affect you: what was removed or what measure was taken, and why | To explain the decision and let you appeal | Legal obligation (Digital Services Act, Art. 17) | While the account exists |
| Messages you send to support, from the program or from the website form | To answer you | Contract or, if you have no account yet, your own request (Art. 6(1)(b)) | 12 months |
| Purchase or donation data | Billing the subscription, receiving the donation and keeping accounts | Contract and legal obligation | 6 years, tax law |
| Crash reports: program version, operating system, when it happened and the technical trace of the failure; and your account, if you were signed in | Finding and fixing what makes the program close | Legitimate interest (Art. 6(1)(f)): that the program works. You can object with the switch in your account | Up to 12 months |
The flight log coordinates are optional. If you fill them in, they mark where you fly, which is sometimes your home. Only you can see them: the server's row-level rules do not let anyone else read them. Leave the field empty and the log works just the same.
Crash reports. If the program closes unexpectedly, the next time you open it it sends Cordaxis a technical report so we can fix it: the version, the operating system, when it happened and the trace of the failure (the program's files and the lines where it failed). Before it is sent, your user folder, email addresses and any session key are removed. If you were signed in, it is linked to your account, so we can see whether a failure keeps happening to the same person; if you delete your account, it no longer is. Without a connection, the report waits in the program's folder and goes out next time. You can turn it off in Account, with the «Send crash reports» switch: when it is off, reports stay on your computer.
Chat email notifications. If someone sends you a private message and you have not read it after 3 hours, we send you an email saying who wrote to you and how many of their messages are unread; never the text or the photos. At most one a day per person, and never from someone you have blocked. So we can write in your language, the program records in your account the language you use it in. It comes with “Seen”: whoever writes to you sees when you read their last message, and you see theirs, only if both of you have it on. It comes on and is turned off in the chat settings wheel, with «Email me»; that also turns off “Seen”.
What we do not do: the program sends no usage statistics and no telemetry of any kind. Other errors stay written on your computer.
3 What is public and what is not
Public to any signed-in user: your username, display name, photo, country, your Discord username if you add it, level, hours, and everything you write in the forum, the clubs and your wall.
Only if you choose: appearing on the map of online pilots (others see that you are online) and receiving messages from people you do not know. Both options come switched off and are switched on in the chat settings. Accounts of under-18s cannot switch them on.
Your friends: whether you are online now or were today, and the status you choose in the friends list (online, away or a line of your own). Only friends you have accepted, and never someone you have a block with.
Yours alone: the flight log, the inventory, your vehicle profiles and your settings.
Between the two people: private messages, end-to-end encrypted. They are encrypted on your computer before they leave, and only the sender's and the recipient's computers can open them: we cannot read them, not even with access to the database. What we do see is who writes to whom, when and how much. If you report a message, your program gives us the key to that message, and only that one, so moderation can read it and check it is the real one. With someone still using an earlier version of the program, messages go unencrypted until they update, and the conversation tells you. And, if both of you have email notifications on, when each of you read the other's last message (“Seen”).
Photos you upload to the forum, the clubs and the wall live in a publicly readable store: anyone with the exact image address can see it without an account. When you retire a message, its photos are deleted from that store too.
Photos you send by private message are kept separately, in a private store and, if the conversation is encrypted, encrypted like the message: only the sender and the recipient can see them, and moderation only if someone reports that message. The program downloads them with your session and does not save them to disk. When you retire the message they are deleted too; when you delete your account, within 30 days of the deletion at the latest.
4 Who we share them with
Nobody, except who we need to run this. And they do not all play the same role, which is a distinction that matters:
Who processes data on our behalf (processor, Article 28: may only use it to provide their service to us, under contract):
| Who | What for |
|---|---|
| Supabase | Database, accounts, photo storage and the server functions (payments, contact and GIF search), which run in Ireland |
| Netlify | Serves the website. Like any web server, it sees your IP address while you visit |
| Resend | Sends your account emails (confirming sign-up, resetting your password, changing your email) and the chat notifications, and delivers to us by email what you write in the contact form, on the website or in the program |
Who decides on their own account (independent controller, not our processor):
| Who | What for |
|---|---|
| Paddle | Sells the subscription. Paddle is the merchant of record: the customer buys from them, they issue the invoice, and they handle payment data as their own controller. We never see your card. To show you your country's prices, our server tells Paddle the country, never your IP address. Your email only reaches them when you decide to pay. Their policy: paddle.com/legal/privacy |
| Google and Discord | If you sign in with them, they identify you and give us your name, your email and your profile photo, and nothing else. Each handles your data as its own controller |
| PayPal | Takes donations, on its own page: you enter the amount and your payment details there, and PayPal handles them as its own controller. It shows us your name, your email and the amount, as it does to anyone who receives a payment; the program stores none of it. Their policy: the paypal.com privacy statement for your country |
Requests that leave your computer, not ours. In these cases we send them nothing: it is your machine asking for the file, so the other server sees your IP address just as it would if you visited their website.
| Who | When |
|---|---|
| Giphy | When you see a GIF, in the forum, the wall, the clubs or a private message, and the search previews: your computer requests it from Giphy, which sees your IP address and which GIF you view. We keep no copies: the message only holds its Giphy address. The search, by contrast, is done by our server: Giphy receives what you typed, but not your IP address |
| YouTube (Google) | The thumbnail of a video linked in the forum or in a club, when you view the list: your computer requests it from YouTube. The title is only requested by the computer of whoever posts the link |
| MET Norway (api.met.no) | Weather on the community map: it receives the map area you are looking at, rounded to about a kilometre |
| NASA (GIBS) | Satellite images of the community map |
| Arduino and Espressif | The first time you set up an ESP32 board: the program downloads their build tools from their servers |
| GitHub | When downloading the program from the website and when it updates: the installer is requested from GitHub |
| Horizon Hobby, Tamiya, Traxxas, DJI and other manufacturers | When downloading a model's manual, which is requested from their own server |
We will also hand over data to authorities where a legal order requires it.
5 How long we keep them
While you have an account, as set out in section 2.
If you delete a message, the text disappears from view at once and a copy is kept for 90 days in case a report was involved. After 90 days the copy deletes itself. If there is an open report about that message, the copy stays until the report is resolved. Of an encrypted private message we keep nothing we can read: only, if someone reported it, the encrypted copy attached to the report and the key the person who reported it handed over.
If you delete a flight from the log, its position, place and notes are deleted at once, and the rest of the record after 30 days.
Who viewed your wall or your posts is only noted so the same visit is not counted twice, and is deleted after 2 days.
If you delete your account, see section 6.
The emails we send you (confirming sign-up, resetting your password, changing your email, chat notifications) and the messages from the contact form are logged for 30 days at Resend, so we can find out what happened to one that does not arrive. After that they delete themselves.
What you write in the contact form is kept for 12 months so we can reply and follow the thread. After that it deletes itself.
Crash reports are kept for at most 12 months from the last time the same failure happened. After that they delete themselves.
We do not keep IP addresses. Supabase records the one of each sign-in for security, and we delete it every day. To stop anyone using the contact form to send messages in bulk, it keeps for 2 hours an encrypted fingerprint of the connection, from which the address cannot be recovered. Its technical request logs also carry it and delete themselves within a few days.
The website uses no cookies of its own. It only stores in your browser the language, when you choose it. On the payment page, Paddle uses the cookies strictly necessary to take the payment.
Invoices are kept for 6 years because tax law says so, which is not up to us or to you.
6 Your rights
You can exercise them from inside the program, under User settings → Privacy and your data, or by writing to cordaxis.rc@gmail.com. We answer within one month at the latest.
Access and portability. The "Download my data" button gives you a JSON file with absolutely everything we hold about you. Encrypted private messages come out readable: your program decrypts them, with your key, before saving the file.
Erasure. The "Delete my account" button requests the deletion. For 7 days you can change your mind: sign in and choose to keep your account. If you have a subscription, it is cancelled at that moment and will not renew; if you have paid time left, you choose whether the account is deleted after 7 days (and that time is lost) or when it runs out. After that, your email, photo, flight log, inventory, statistics, the private messages you wrote and the keys of your encrypted chat are deleted automatically and for good. What you posted in the forum, the clubs and the wall stays, signed as "Deleted pilot", because removing it would leave other people's replies making no sense. If you would rather it was emptied too, there is a checkbox to ask for that, and that happens straight away.
Rectification. You change your name, photo and country in settings.
Objection and restriction. Write to us and we will sort it out.
Complaint. If you think we got it wrong you can complain to the Spanish Data Protection Agency (www.aepd.es) or to your own country's supervisory authority. We would rather you wrote to us first, but you are not obliged to.
7 Where the data lives
Data is stored on Supabase servers in Ireland (region eu-west-1), that is, inside the European Union, and the server functions (payments, contact and GIF search) also run there. Supabase is a company based outside the European Economic Area: it and some of its sub-processors may access the data from outside to maintain the service, under the European Commission's Standard Contractual Clauses included in its processing agreement.
In addition, the website is hosted on Netlify, a US company, so visiting it sends your IP address to the United States. And emails go through Resend, also a US company: your account emails (confirming sign-up, resetting your password, changing your email), the chat notifications and what you write in the website's contact form, which reaches us by email. Both transfers are covered by the Standard Contractual Clauses approved by the European Commission.
8 Children
To have an account you must be as old as your country's law requires: between 13 and 16 across the European Union depending on the member state (14 in Spain), 13 in the United States, 18 in India. That is why we ask for a date of birth at sign-up, also when you sign in with Google or Discord. We store only the year.
Accounts of under-18s cannot receive messages from people they do not know or appear on the map of online pilots. To pay for a subscription, a minor needs the permission of a parent or guardian.
If we learn that someone below the minimum age has an account, we close it and delete their data. If you are a parent or guardian and think that is the case, write to cordaxis.rc@gmail.com.
9 If you live in the United States
We do not sell or share your personal information, including in the sense of the California privacy law, and we do not use it for advertising. You have the rights in section 6 and exercise them the same way. We do not knowingly collect data from children under 13 (see section 8).
10 Security
Everything travels encrypted to the server. Passwords are stored on the server as a cryptographic hash, never in the clear, and the program does not store your password on your computer: only a derived value used to recognise you when signing in offline, from which the password cannot be recovered. The session stored on your machine is encrypted by Windows with your user account's key.
Private messages are end-to-end encrypted (X25519 and AES-256-GCM, with a different key for each message). The key that opens them is on your computer, encrypted by Windows, and the server only holds a copy encrypted with a key derived from your password (scrypt), which we do not know: that is how you can read them when you sign in on another computer. If you reset your password by email, that copy can no longer be opened: earlier encrypted messages will still be readable on the computers where you already read them, but not on a new one. If you sign in without typing your password (with the remembered session, or with Google or Discord), the chat asks for it once to make that copy; with Google or Discord, by creating a password for your account.
Who can read what is decided by the server, not by the program, so modifying the program does not let anyone see other people's data.
If there is ever a breach that could affect you, we will tell you, and we will report it to the Spanish Data Protection Agency within 72 hours of becoming aware of it, as GDPR Article 33 requires.
11 Changes
If we change anything important, we will tell you with a notice inside the program, with a link to the new version. We keep previous versions archived and will send you whichever one you ask for.