Privacy Policy

Effective and last updated: November 13, 2026

In plain English: Sorapuff has no account, no analytics, no ads and no third-party code. Your flights, forecasts and bump readings stay on your iPhone or iPad. To make a forecast, the App downloads public weather data straight from its sources (NOAA's data on Amazon Web Services, and aviationweather.gov); those requests carry no information about you beyond what any web request does. Everything else that leaves your device goes only where you send it: your own mail server or Microsoft sign-in if you choose to look for flights in your email, Apple for purchases and a time-zone lookup, and, only if you say yes, one anonymous flight-data report per flight to us. You can see exactly what that report contains before it's sent. Because we never receive your flights, we can't see, sell or share them.

Key points

• No account, no tracking. No analytics, advertising, crash-reporting or other third-party SDKs, and no advertising identifier.
• On your device. Flights, forecasts, motion and barometer readings, reminders and Sky Cards are stored and processed on your iPhone or iPad.
• Public weather data. Forecasts are downloaded from public sources, not from a server of ours.
• Finding flights is read-only and opt-in. Pasted text, PDFs, Wallet passes, boarding-pass scans and calendar bookings are read on your device. Email is searched only if you connect it, read-only, for flight bookings only.
• Flight data sharing is your choice. After a flight, Sorapuff asks before sending anonymous bump readings, and you can see the exact report first.
• You're in control. Turn off permissions in Settings, and delete everything by deleting the App (Section 8).

1 Who we are and what this policy covers

This policy explains how personal information is handled by the Sorapuff app for iPhone and iPad (including its widget, Live Activity and Shortcuts actions, together "the App"), by the sorapuff.app website and its flight-data endpoint, and by our email support. They are provided by Simple Products Labs LLC, a Wyoming limited liability company doing business as Simple Products Studio ("we", "us"). Under the EU and UK General Data Protection Regulation (GDPR and UK GDPR), we are the controller of the small amount of personal information described in Sections 5, 9 and 10. Our contact details are in Section 18.

2 What we don't collect

• There's no account or sign-up with us, and no server of ours that the App needs to work.
• The App contains no analytics, advertising, attribution, crash-reporting or social SDKs, and doesn't use Apple's advertising identifier.
• We never receive your flights, your location, your calendar, your email, your boarding passes, your contacts or any device identifier.
• If you choose to share flight data (Section 5), the report has no name, email address, device or user identifier, location or flight number.

Sorapuff's App Store privacy label reflects this. Once the optional flight-data sharing ships, the label lists Other Data (anonymous flight bump readings), not linked to you and not used for tracking.

3 What the App processes on your device

• Your flights: airports, departure times and the forecasts you save. They are stored in the App's private storage on your device.
• Motion and barometer: while flight mode is on, the App reads the motion sensors and the barometer to measure bumps and work out the flight phase. Readings are processed and kept on your device.
• Location (optional): near a window, GPS works in airplane mode. If you allow it, the App uses your location to show where you are on your forecast. Your location never leaves your device.
• Finding flights (optional): text you paste, PDFs and Wallet passes you open, and boarding-pass barcodes you scan are read on your device to find flight details. The camera is used only to read the barcode; nothing is recorded or saved.
• Calendar (optional): if you allow it, the App looks only for flight bookings that Mail or Gmail added to your calendar. It reads nothing else and changes nothing.
• Email (optional): if you connect a mailbox, the App connects directly from your device to your mail server in read-only mode (it opens folders with IMAP EXAMINE and fetches with BODY.PEEK, so nothing is marked as read, moved or deleted) and searches only for flight booking emails. App-specific passwords and Microsoft sign-in tokens are stored only in your device's Keychain.
• Calm music is generated on your device. No audio is downloaded and nothing is recorded.

4 What leaves your device, and to whom

Like any web request, the weather and Apple requests reveal your device's IP address to those services, under their own privacy policies. They contain nothing else about you.

5 Optional anonymous flight data ("Help Sora learn")

After a flight, the App asks whether you'd like to send that flight's readings so we can check and improve the forecast. You can choose Send, Always send or Not now, change your choice in Settings, and tap See exactly what's sent to read the full report before it goes.

What a report contains, and nothing else:

• the route as two airport codes and the departure time rounded down to the hour, in UTC;
• whether the takeoff time was felt by the phone or taken from the schedule;
• the saved forecast for the route: model run, resolution, cruise altitude, duration, the forecast stretches (start and end minute, severity and causes) and the forecast samples (minute, turbulence index, severity and altitude);
• the measured flight: per minute since takeoff, the largest bump and how much of the minute the phone was resting; each bump's start, length and peak in g; and when each flight phase was felt;
• the app version and a random report ID made for that report only.

How it travels. When our endpoint is available, the App sends the report over HTTPS to https://sorapuff.app/api/flight-report, a serverless function hosted by Vercel Inc. that checks the report, keeps only the fields listed above and forwards them by email to our studio inbox through our email delivery provider, Resend. The function stores nothing and doesn't log the report or your IP address; Vercel processes the request to deliver it. If the endpoint isn't available, the App instead opens a pre-filled email that you send from your own Mail app, and in that case we also see the email address you send it from.

What we do with it. We use reports only to compare forecasts with what phones actually felt and to tune the forecast. We don't combine them with other data, try to identify anyone, sell or share them. To have a report deleted, send us its report ID (shown on the "See exactly what's sent" screen).

6 No tracking, no ads, no analytics

• The App never asks to track you, because there's nothing to track.
• We don't build profiles, buy data about you, or make automated decisions with legal or similarly significant effects.
• We don't sell or share personal information, and we never have.

7 Permissions

The App asks for each permission only when you first use a feature that needs it. You can change any of them later in Settings.

8 How to delete your data

We hold none of your flights, so deleting them is in your hands:

• Flights and forecasts: delete them in the App's Flights tab, or use Settings › Delete all my data in the App.
• A connected mailbox: disconnect it in the App, which deletes its saved app password or sign-in token from the Keychain. Then revoke the app-specific password with your mail provider, or remove Sorapuff's access in your Microsoft account settings.
• Everything the App stores on a device: delete the App (touch and hold its icon, then Remove App › Delete App).
• A flight-data report you sent: email us its report ID and we'll delete it.
• Emails you sent us: ask us at sorapuff [at] simpleproducts.studio and we'll delete them.

9 Our website

sorapuff.app is a static website. It sets no cookies and uses no analytics, advertising, tracking scripts or third-party embeds, and it serves its own images and styles. Our hosting provider, Vercel Inc., processes standard request data, such as your IP address, browser user agent, the page requested and the time, to deliver the site and keep it secure. Vercel keeps these logs for a limited period under its own policies. We don't use them to identify you. We treat a Global Privacy Control signal as a valid opt-out of sale or sharing, although there's nothing to switch off.

10 When you email us

If you email us, we receive your email address, your name if you include it, your message and anything you attach. We use them only to answer you and to fix problems. We keep them as long as we need to help you and for up to two years after our last exchange, unless the law requires us to keep them longer. We'll delete them sooner if you ask. Please don't send us passwords; we never need them.

11 Children

Sorapuff is not directed at children under 13, and we don't knowingly collect personal information from children under 13, or under the age of digital consent where they live. If a child has emailed us, a parent or guardian can ask us to delete the message at sorapuff [at] simpleproducts.studio, and we will.

12 EU, EEA, UK and Swiss privacy rights

Controller: Simple Products Labs LLC, at the address in Section 18.

Your rights. You can ask for access to your personal information, and to have it corrected, erased or restricted; object to processing based on legitimate interests; receive your data in a portable format; and withdraw consent at any time. Email sorapuff [at] simpleproducts.studio. We answer within one month, free of charge. You can also complain to your data protection authority; in the UK, that's the Information Commissioner's Office (ico.org.uk).

International transfers. We're based in the United States, so information you send us is processed in the US by us and our providers (Vercel and Resend for the endpoint, and our email provider). Where the law requires it, we rely on safeguards such as the European Commission's Standard Contractual Clauses or the EU-US Data Privacy Framework.

13 California and other US state privacy rights

• We don't sell personal information or share it for cross-context behavioral advertising, and we haven't done so in the past 12 months.
• In the past 12 months we may have collected: identifiers (your email address if you email us or send a report by email, and IP addresses in hosting logs); internet activity (hosting logs); and anonymous flight readings you chose to send. Disclosed for business purposes only to our service providers (hosting and email delivery).
• You can ask to know, access, correct or delete personal information we hold, and you won't be discriminated against for doing so. Email sorapuff [at] simpleproducts.studio. Residents of other US states with privacy laws have similar rights, including an appeal.

14 How long data is kept

15 Security

• On your device, the App relies on iOS security: app sandboxing, Data Protection encryption, and the Keychain for mail credentials.
• Connections to weather sources, Microsoft, Apple and our endpoint use HTTPS. Mail connections require TLS.
• No method of storing or sending data is completely secure. Protect your device with a passcode and keep iOS up to date.

16 Health and safety

Sorapuff offers information and calming tools. It is not a medical device and doesn't give medical or aviation advice. Always follow your crew's instructions.

17 Changes to this policy

We may update this policy. We'll post the new version here with a new "Last updated" date and, for material changes, tell you in the App or in its release notes before they take effect, where practical. We will never add fields to the flight-data report without updating Section 5 and the App's "See exactly what's sent" screen first.

18 Contact

Simple Products Labs LLC, a Wyoming limited liability company (United States) trading as Simple Products Studio:

Email: sorapuff [at] simpleproducts.studio

Simple Products Labs LLC 30 N Gould St Sheridan, WY 82801-6317 United States

This privacy policy applies to the Sorapuff app (version 1.0 and later) and to the sorapuff.app website.

Last updated: November 13, 2026 · Version 1.0