Privacy policy

1. Introduction

Imagine Flying LLC ("we," "us," or "our"), a limited liability company based in Jacksonville, Florida, operates HeyDPE ("the Service"), an AI-powered web application that simulates FAA Designated Pilot Examiner (DPE) oral examinations for checkride preparation.

This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website at aviation-oral-exam-companion.vercel.app or use our Service.

By using HeyDPE, you agree to the collection and use of information in accordance with this policy. If you do not agree, please do not use the Service.

2. Information we collect

We collect the following categories of information:

3. How we use your information

We use the information we collect for the following purposes:

• Provide and maintain the Service — delivering AI-powered exam simulations, tracking your progress, and personalizing your experience.
• Process payments — managing subscriptions and billing through Stripe.
• Analytics and improvement — understanding how users interact with the Service to improve features, performance, and user experience.
• Fraud prevention and security — detecting and preventing unauthorized access, abuse, or security threats.
• Legal obligations — complying with applicable laws, regulations, and legal processes.

4. Third-party services

We share data with the following third-party service providers (sub-processors), each under their own privacy policies and our agreements with them:

5. Voice data

• Your speech is transcribed by Deepgram. When you use voice mode, your microphone audio is streamed over an encrypted connection to Deepgram, our speech-to-text provider (the Deepgram Nova-3 model), which converts it to text. Transcription happens on Deepgram's servers, not in your browser.
• HeyDPE does NOT store your audio recordings. Your audio is streamed for real-time transcription only and is not saved by HeyDPE.
• The text transcript is sent to Anthropic. Once your speech is converted to text, the transcript is sent to the Anthropic Claude API to generate examiner questions and assess your answers, and is stored in your exam history so you can review your progress.
• Examiner replies are synthesized as speech. The examiner's text responses are converted to audio by Deepgram's text-to-speech service (the Aura-2 model), with OpenAI used as an automatic fallback if Deepgram is briefly unavailable.
• You can always use text input instead. Voice mode is optional. You may type your answers at any time, in which case no microphone audio is captured or transmitted.

6. Data retention

• Account & exam data — including your conversation transcripts and progress, retained while your account is active, plus 30 days after account deletion to allow for recovery.
• Payment records — retained for 7 years as required by tax and financial regulations.
• Analytics data — retained per our analytics providers' default retention periods (e.g., Google Analytics' 26-month default).
• Voice recordings (raw audio) — not retained. Audio is streamed to Deepgram for transcription only and is never stored by HeyDPE (see Section 5). Text transcripts of your answers are retained with your exam history.

7. Your rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

General rights

• Access — request a copy of the personal data we hold about you.
• Correction — request that we correct inaccurate or incomplete data.
• Deletion — request that we delete your personal data.
• Export — receive your data in a portable, machine-readable format.
• Opt-out of analytics — disable analytics and advertising tracking (PostHog, Google Analytics, Google Ads) via the cookie-consent banner or your browser settings.

CCPA rights (California residents)

• Right to know — what personal information we collect, use, and disclose.
• Right to delete — request deletion of your personal information.
• Right to opt-out of sale — HeyDPE does NOT sell your personal data to third parties.
• Non-discrimination — we will not discriminate against you for exercising your CCPA rights.

GDPR rights (EEA/UK residents)

• Data portability — receive your data in a structured, commonly used format.
• Restrict processing — request that we limit how we use your data.
• Object to processing — object to our processing of your personal data.
• Lodge a complaint — file a complaint with your local data protection authority.
• Withdraw consent — withdraw your consent at any time where processing is based on consent.

To exercise any of these rights, contact us at pd@imagineflying.com.

8. Children's privacy

HeyDPE is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child has provided us with personal data, please contact us at pd@imagineflying.com and we will take steps to delete such information.

9. Security

We implement industry-standard security measures to protect your personal data:

• TLS encryption — all data in transit is encrypted using TLS (HTTPS).
• Encryption at rest — database data is encrypted at rest via Supabase infrastructure.
• Passwordless authentication — sign-in uses one-time email codes or OAuth (Google, Apple, Microsoft) via Supabase Auth; we do not store passwords.
• Row-Level Security (RLS) — database access policies ensure users can only access their own data.

While we strive to use commercially acceptable means to protect your personal data, no method of transmission over the Internet or electronic storage is 100% secure.

10. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will notify you by email at the address associated with your account and update the "Last Updated" date at the top of this page. Your continued use of the Service after any changes constitutes your acceptance of the updated policy. We encourage you to review this page periodically.

11. Contact

If you have questions or concerns about this Privacy Policy, please contact us: