Your data, plainly

Ground to Solo is a free paragliding study aid. We collect only what we need to run your account and keep your progress. We never sell or rent personal data, we show no ads, and we use analytics only if you allow it.

Who we are

Ground to Solo is run by Ground To Solo, Pakistan (“we”, “us”). We are the controller of the personal data described here: we decide why and how it is used. Contact: [email protected].

What we collect

Data	Source	Where it lives
Account basics: your name, email address, profile photo address and a Google account identifier. We never see your Google password.	Google, when you choose “Continue with Google”	Firebase Authentication
Training progress: lessons opened and read, quiz answers and scores, mock exam results, personal minimums you enter, simulator mission results (scores, criteria, the simulated conditions and duration), your certificate record (including the name you choose to print), and synced preferences (units, standards body, lesson order, when you acknowledged the safety notice and accepted the terms).	You, as you use the guide and simulator	Cloud Firestore, under your account only; also in your browser
Contact messages: the topic, your name, the email address you give for our reply, your message, and your account identifier if you were signed in.	You, through the contact form	Cloud Firestore; readable only by us
Reviews: your star rating, what helped you, your comment, whether we may quote it and the name to show with a quote, and when you wrote or changed it.	You, through the review form	Cloud Firestore, under your account
Error reports: when the guide or simulator crashes, the technical error message and code location, the page, your browser and its version (the user-agent string), and the app version. No name, email or account identifier; anything that looks like an email address is removed first.	Your browser, automatically, for serious errors only	Cloud Firestore; readable only by us
Security signals: technical information about your browser and device, used to check that requests come from this website.	Google reCAPTCHA v3, through Firebase App Check	Google
Usage statistics, only if you allow them: pages viewed, events such as “lesson read”, “quiz completed” or “mission passed”, and a short description of any error you run into, with device type, browser, approximate location (country or city, derived from your IP address, which Google Analytics does not store) and a random analytics identifier.	Google Analytics 4, after you choose “Accept analytics”	Google Analytics

We do not collect sensitive data such as health, biometric or financial information, and we do not ask for your date of birth, address or phone number. The progress documents do not contain your name or email address; they are linked to your account identifier. Some data never leaves your device: your theme and motion settings, analytics choice, simulator graphics, controls and volume settings, and the simulator’s flight recordings.

Why we use it, and the legal basis

Purpose	Data	Legal basis (GDPR / UK GDPR and similar laws)
Sign you in, save your progress and sync it between devices, issue your certificate of completion	Account basics, training progress	Performance of our agreement with you (the Terms)
Keep the service and your data secure, prevent abuse	Security signals, account identifier	Our legitimate interest in running a secure service
Find and fix crashes	Error reports	Our legitimate interest in a service that works; the reports hold no information that identifies you
Understand which lessons and missions help, and improve them	Usage statistics	Your consent, which you can withdraw at any time
Answer your messages and requests about your rights	Contact messages	Legal obligation (for rights requests), and our legitimate interest in responding
Learn from your review to improve the guide	Reviews	Our legitimate interest in improving the service
Quote your review on the site, only if you ticked the box	Your comment, rating and the name you chose	Your consent, which you can withdraw by editing or deleting the review

We do not use your data for advertising, we do not build advertising profiles, and we make no decisions about you by automated means that have legal or similarly significant effects. The readiness check and certificate are calculated in your browser from your own progress, for your information only.

Cookies and storage on your device

Strictly necessary storage is used without asking, because the service cannot work without it. Analytics storage is used only after you accept it.

Name	Type	Purpose	Duration
`g2s.v1.prefs`, `g2s.v1.guide`, `g2s.v1.sim`	Local storage, necessary	Your preferences and progress on this device	Until you sign out or clear site data
`g2s.v1.session`, `g2s.v1.sync`	Local storage, necessary	Remember who is signed in on this device and what still needs syncing	Until you sign out
`g2s.v1.scroll`, `g2s.v1.next`	Session storage, necessary	Return you to the same place on a page, or after signing in	Until you close the tab
`firebaseLocalStorageDb`	IndexedDB, necessary	Your Firebase sign-in session	Until you sign out
`g2s-tracks`	IndexedDB, necessary	Your last simulator flight recordings, for replay on this device	The last 20 flights
`_GRECAPTCHA` and related	Cookie and storage by Google, necessary	App Check security: telling real visitors from automated abuse	Up to 6 months
`_ga`, `_ga_*`	Cookies by Google Analytics, only with consent	Count visits and distinguish returning visitors	Up to 2 years, removed when you withdraw consent

You can change your analytics choice at any time in Settings → Account and privacy. If your browser sends a Global Privacy Control signal, we treat it as a “no” to analytics unless you later turn analytics on yourself.

Who processes it for us

We use service providers who process data only on our instructions, under written data processing terms:

Google LLC / Google Ireland Limited (Firebase and Google Cloud): hosting, sign-in (Firebase Authentication), progress storage (Cloud Firestore) and App Check with reCAPTCHA v3. reCAPTCHA is also subject to Google’s Privacy Policy and Terms of Service.
Google Analytics 4, only if you consent, with advertising features, Google signals and ad personalisation switched off. We never send your name, email or account identifier to Analytics.

When you choose to share your certificate, you go to LinkedIn, X or Facebook yourself; what you post there is governed by their policies. We do not pass your data to them. We may disclose data if the law requires it, to protect people from harm, or as part of a transfer of the service to a new operator who keeps this policy (we will tell you first).

International transfers

Google may process data in the United States and other countries. For people in the European Economic Area, the United Kingdom and Switzerland, transfers rely on the EU–US Data Privacy Framework and its UK and Swiss extensions where Google is certified, and otherwise on the European Commission’s Standard Contractual Clauses (and the UK Addendum), as set out in Google’s data processing terms. Your progress is stored in the Firestore region we chose when setting up the service.

How long we keep it

Account and progress: until you delete your account. If an account has not been used for 3 years we may delete it after emailing you a warning.
Usage statistics: 14 months in Google Analytics, then deleted automatically.
Error reports: 90 days.
Contact messages: as long as needed to answer, and no more than 2 years. They are kept even if you delete your account, so we can finish answering; ask us and we will delete them sooner.
Reviews: until you delete the review or your account (deleting your account deletes your review).
Backups: deleted data can stay in encrypted backups for up to 35 days before it is overwritten.

Security

Data is encrypted in transit (HTTPS with HSTS) and at rest. Database rules allow each person to read and change only their own progress; App Check blocks automated access; the site sends a strict Content Security Policy. Signing out clears your progress from that device. No system is perfectly secure: if a breach affecting your data occurs, we will notify you and the authorities where the law requires it.

Your rights

Wherever you live, you can:

Get a copy of your progress in a portable, documented JSON format: Settings → Your progress → Export progress.
Delete your account and all cloud data: Settings → Account and privacy → Delete my account and cloud data. Deletion is immediate and cannot be undone.
Correct the name on your certificate in the certificate page, and your Google name or photo in your Google account.
Edit or delete your review at any time on the review page, including withdrawing permission to quote it.
Withdraw consent to analytics at any time, without affecting what happened before.
Ask us for access to, correction, restriction or erasure of your data, to object to processing based on legitimate interests, or anything else in this policy, by writing to [email protected]. We will reply within one month (45 days where Californian law applies), and may need to confirm it is really you.

We will not treat you differently for exercising your rights.

Rights by region

European Economic Area, United Kingdom and Switzerland

You have the rights of access, rectification, erasure, restriction, portability and objection under the GDPR, the UK GDPR and the Swiss FADP, and the right to complain to your data protection authority (in the UK, the Information Commissioner’s Office, ico.org.uk).

United States, including California

Under the California Consumer Privacy Act (CCPA, as amended by the CPRA) and similar state laws (for example in Colorado, Connecticut, Virginia, Utah and Texas): in the last 12 months we collected identifiers (name, email, account and analytics identifiers), internet activity (progress and, with consent, usage events) and approximate location (with consent), for the purposes above. We do not sell or share personal information for cross-context behavioural advertising, and do not use sensitive personal information. You can ask to know, delete or correct your information, and you can use an authorised agent. We honour Global Privacy Control.

Brazil

Under the LGPD you can confirm processing, access, correct, anonymise, port or delete your data, and learn with whom it is shared; you can complain to the ANPD.

Canada

Under PIPEDA and provincial laws (including Quebec’s Law 25) you can access and correct your information and withdraw consent. Our contact above acts as the person responsible for privacy.

Australia and New Zealand

We handle personal information in line with the Australian Privacy Principles and the New Zealand Privacy Act 2020. You can request access and correction and complain to the OAIC or the NZ Privacy Commissioner.

India

Under the Digital Personal Data Protection Act 2023 you can access, correct and erase your data, nominate someone to exercise your rights, and raise a grievance with our contact above (our grievance officer) before approaching the Data Protection Board.

Elsewhere

People in other countries, including Japan, South Korea, Singapore and South Africa, can use the same rights through our contact above, and complain to their local authority.

Children

Ground to Solo is not directed at children under 13 and we do not knowingly collect their data. To create an account you must be 16 or older, or 13 to 15 with a parent’s or guardian’s permission where the law where you live allows it. If you believe a child under 13 has given us data, contact us and we will delete it.

Changes

We will post any change here with a new version date. If a change materially affects how we use your data, we will tell you in the app before it takes effect and, where the law requires, ask for your consent again.

Contact and complaints

Ground To Solo, Pakistan. Email: [email protected], or use the contact form. If you are not satisfied with our answer, you can complain to the data protection authority where you live or work.