Privacy Policy

We collect a few distinct categories of information:

• Account information you provide when you sign up or update your profile: name, email, phone, and password. Your password is never stored in plain text — it’s run through a one-way salted hashing algorithm (bcrypt) before it’s saved, so even we can’t read it back; a unique random salt is generated for every password, so two identical passwords never produce the same stored hash.
• Content you create: the listings you publish and the messages you send to other users through the Service.
• Usage data generated automatically as you use the site: page views, referrers, and device/browser details. Automated bot and crawler traffic is excluded before it’s ever recorded.

We do not collect full payment card numbers — those go directly to Stripe (see section 3).

If you upload logbook pages, annual sign-offs, or repair paperwork (Form 337s) for an aircraft listing, we store those documents in a private storage location separate from your listing photos, accessible only to you, Vapor Trail staff, and any specific buyer you explicitly grant time-limited access to from a message thread. These documents are never served publicly. Older FAA paperwork can sometimes contain a Social Security number where a taxpayer ID was historically used — please redact anything you don’t want us to see before uploading if possible; we ask you to, but can’t guarantee every upload is redacted.

If you use the optional identity verification feature, we store the government ID photo you upload (e.g. a driver’s license) in a private storage location, accessible only to you and Vapor Trail staff — never served publicly, and never shared with the same storage used for logbook documents or listing photos. We run an automated scan to compare the name on the document against your account name; a staff member reviews the document image directly whenever that automated scan can’t confirm a match. You can decline this feature entirely — it’s optional and only affects whether your listings show an “ID Verified” badge.

For the free tail-number lookup tool and listing registry checks, we store data synced from the FAA’s public Releasable Aircraft Registry and the NTSB’s incident records. This includes registrant name and city/state (not full street address) for the aircraft’s current registration — information the FAA already publishes publicly for any tail number.

To operate the marketplace: creating and securing your account, publishing your listings, connecting buyers and sellers, processing payments, moderating content, responding to support and feedback requests, and understanding which pages and features are actually used so we can improve them.

All payments are handled by Stripe, a PCI-compliant third-party payment processor. Stripe collects and stores your payment method directly — we receive confirmation of payment and limited billing metadata, never your full card number.

We use a session cookie to keep you signed in, and a separate anonymous first-party cookie (not tied to your account) to count unique visitors without repeatedly counting the same person’s page loads. We also log basic page-view analytics (path, referrer, user agent) to understand site usage, with automated bot and crawler traffic excluded before it’s ever recorded. We don’t use third-party advertising trackers on the Service today.

We share information with service providers who help us run the Service (payment processing via Stripe, hosting, email delivery once configured) under obligations to protect it, and with other users to the extent needed to complete a transaction (e.g., a seller sees a buyer’s message and reply-to address). We do not sell your personal information.

We retain account records for as long as your account is active. Invoice and payment records are retained for at least 5 years from the transaction date to meet accounting and dispute-resolution obligations — you can view and download your own invoices for the past 5 years anytime from your billing history. Nightly backups are retained on a rolling basis (30 days locally by default) for disaster recovery.

You can review and update most account information yourself from your dashboard. To request a copy of your data, ask us to delete your account, or ask a question about how your information is handled, contact us at the address below.

The Service is not directed to children under 16, and we don’t knowingly collect personal information from them. If you believe a child has provided us information, contact us and we’ll remove it.

Passwords are never stored in plain text — see section 1. Traffic to the Service is served over HTTPS, and database access is restricted to the application itself, not exposed to the public internet. No method of transmission or storage is 100% secure, and we can’t guarantee absolute security.

We may update this policy from time to time. Continued use of the Service after a change takes effect constitutes acceptance of the revised policy.

Questions about this policy, or a privacy request? Reach us at support@vaportrailmarket.com.