Privacy Policy

How LowPass processes your personal data.

Last updated: 15 September 2026

1. Data controller

The data controller is the LowPass project (Telegram bot @LowPassBot and website lowpassbot.pages.dev), a free, non-profit, hobbyist project developed and run by a single person.

As it is not a company or a commercial activity, no physical address or registered office is provided. For any request concerning your personal data you can contact the controller on Telegram: @LowPassBot.

2. Data collected by the website

Review form

The website collects, through the review form, the following voluntarily provided data:

  • Name (optional);
  • Star rating (from 1 to 5);
  • Review text.

The data is sent to the bot backend and stored in a JSON file; the controller receives a notification (by email) to manage the published reviews.

Community statistics

The website only displays aggregated and anonymous data (active users, tracked flights, sent notifications, spotting sessions). No personal data is collected for these statistics.

Google Analytics

With your consent (given via the cookie banner), the website uses Google Analytics to collect aggregated and anonymous statistics about page usage (for example pages visited, device type, country of origin). This data is not used to identify you directly.

Umami Analytics

The website uses Umami, a web analytics service that does not use cookies and does not collect personal data. Only aggregated and anonymous statistics are collected (pages visited, traffic source, device type and country).

What we do NOT collect on the website

The website does not collect email addresses, does not require creating an account and does not process sensitive data. Browsing is free and non-identifying.

3. Data processed by the Telegram bot (separate)

The bot @LowPassBot processes, within Telegram, the Telegram user data required for the service to work:

  • the approximate position manually chosen by the user (not the real position of the device);
  • the tracked flights (flight passport) and related statistics.

This notice mainly concerns the website. The bot's data is managed by the same controller, within Telegram, to provide alerts and the flight passport.

4. Legal basis for processing

Voluntarily submitting a review through the form constitutes consent to the processing of the data for the stated purposes (Art. 6(1)(a) GDPR). Providing the data is optional: you can browse and view the site without submitting any review.

Google Analytics is used solely on the basis of your consent (Art. 6(1)(a) GDPR), which you can grant or refuse via the cookie banner and revoke at any time.

5. Purposes of processing

  • Publishing reviews on the website;
  • Improving the service and the bot;
  • (for the bot) providing real-time alerts and the flight passport.

6. Retention period

Reviews are kept as long as they remain published on the website, or until you request their removal. Data managed by the Telegram bot is kept until you delete it or stop using the bot.

7. Your rights (Art. 15–22 GDPR)

You can exercise the following rights at any time:

  • Access to your data (Art. 15);
  • Rectification (Art. 16);
  • Erasure / right to be forgotten (Art. 17);
  • Restriction of processing (Art. 18);
  • Data portability (Art. 20);
  • Objection to processing (Art. 21).

To exercise them, contact the controller on Telegram: @LowPassBot. You will receive a response within the time limits set by law.

You also have the right to lodge a complaint with the competent supervisory authority (in Italy, the Garante per la protezione dei dati personali).

8. Third-party services

  • Netlify — website hosting. Netlify's servers may also be located outside the European Union (including the United States); data transfer is governed by Standard Contractual Clauses (SCC). Privacy policy: https://www.netlify.com/privacy/.
  • Google Fonts — the website's fonts are loaded from Google's servers; the request may involve transmitting the IP address to Google. Privacy policy: https://policies.google.com/privacy.
  • Google Analytics — active only with your consent, collects aggregated and anonymous statistics about site usage. Data may be transferred to the United States with adequate safeguards (SCC). Privacy policy: https://policies.google.com/privacy.
  • Umami — web analytics without cookies and without personal data, with aggregated and anonymous statistics. Privacy policy: https://umami.is/privacy.
  • Bot backend — managed by the controller; used to store reviews and serve aggregated statistics (no personal data).

9. Transfers outside the EU

Except for Netlify hosting and Google services (Google Fonts and, with your consent, Google Analytics), which may involve the transfer of data to the United States with adequate safeguards (SCC), no other data is transferred outside the European Union.

10. Profiling and sharing

No profiling or automated decision-making is carried out. Data is not sold or transferred to third parties for commercial purposes.