Privacy summary
Updraft layers are derived from the flights of consenting pilots; the principle is "how much and where, never who". These rules apply in the same way on every outgoing path (API, tiles, Atlas) and are covered by tests. This page is a summary for developers who integrate Updraft.
Thresholds
An object or a cell leaves Updraft only when the data of enough distinct pilots supports it; below that it is never returned, with any parameter.
| Layer | Minimum distinct pilots (default) |
|---|---|
| Take-off and landing sites | 3 |
| Thermal grid, skyways, region profile details | 5 |
The Updraft administration may raise the thresholds, never below 3. When a threshold rises, objects below it drop out on the next request. Objects added by a moderator or from OpenStreetMap (e.g. a take-off entered by hand) carry no pilot claim.
Tiered counts
No exact pilot or flight count reaches any surface: a count changing one by one would give away a single pilot's flight, withdrawal or deletion request. Instead:
| Field | Values |
|---|---|
confidence / confidence_tier |
low (3–4 pilots, or from a moderator/OSM), medium (5–9), high (10+) |
min_pilots |
"At least N pilots": rounded down to the steps 3, 5, 10, 20, 50, 100; null for moderator/OSM objects |
The steps are fixed within an API version. Do not build rankings or "most popular" lists from these fields: a count must not turn into an incentive to take risks.
Masks
- The first and last 500 m around each flight's first and last valid fix stay out of the thermal grid and skyways (so that a pilot's home or car is not revealed). Take-off and landing clustering is exempt from this mask but needs 3 pilots.
- Home and private areas a pilot defines (2 km by default) enter no layer at all.
Consent and withdrawal
- Consent is per flight: each flight arrives with the version of the privacy notice the pilot accepted (
consent_version). Flights without consent never enter the layers. - When a pilot stops contributing in general, their later flights stay out of the layers; earlier flights remain in the anonymous totals.
- For a withdrawal of listed flights and for a deletion request, those flights leave every layer within 24 hours.
- The public replay of a shared flight masks its start and end, has no pilot name or identity, and dates are by day only.
Not in the API
No endpoint returns a pilot's name or identity, flight lists, exact counts, moderator identities or risk-encouraging measures such as maximum altitude, best climb or glide. Response schemas are checked against an allow list; a new field needs a review.
What we expect from you
- Do not try to single out people from the layers or by combining several responses.
- Clients that upload pilots' flights (server to server,
flights:write) send the pilot's identity only as an HMAC computed with their own key; no name, e-mail or phone (POST /v1/flights). - When a pilot stops contributing or asks for deletion, call the corresponding endpoint (consent endpoints).