Bandit: Plane Spotter

Bandit — Privacy Policy

Last updated: 12 October 2026

Bandit: Plane Spotter ("Bandit", "the app") is a game about photographing aircraft. It is operated by Bandit: Plane Spotter, Melbourne, Victoria, Australia ("we", "us"). This policy explains what the app does with your account, progress, camera, location and photographs, who can see them, and the choices you have. Questions, requests and complaints: banditplanespotter@gmail.com.

The short version

• You can play without an account. Signed out, your progress and photographs stay on your phone.
• If you create an account, we use Google Firebase to sign you in, back up your cards, scores, logbook and compressed copies of your photographs, publish your display name and scores, and run squads and friends.
• Location is used to find aircraft near you. It is saved with each sighting. Signed in, those sightings are part of your private backup.
• Global rankings show your display name and game statistics to every signed-in player. Friends and squad members see more, as described below. They see your photographs only if you turn on Binder sharing, and Binder sharing starts off.
• Bandit has no advertising, does not sell your information, and does not track you across other companies' apps or websites.
• Release builds send crash reports to Firebase Crashlytics, including when you are signed out, unless you switch that off in Account › Privacy.
• You can ask us to delete your account and its data at any time (see Deleting your data).

Who can use Bandit

Bandit is for people 13 and over, with or without an account. If you are under 18, ask a parent or guardian before you create an account or turn on sharing, and ask them to help with the choices below. We do not knowingly collect personal information from children under 13; if you believe a child has created an account, email us and we will delete it.

Signing in is optional

Bandit starts without an account and stays playable signed out. Cloud backup, global rankings, squads and friends need an account. You can create one with an email address, a password and a public display name, or sign in with Google (Android and iPhone) or Apple (iPhone). Firebase Authentication handles your password; Bandit never receives it in readable form. With Google or Apple, that company tells Firebase your email address (with Apple, the private relay address if you chose Hide My Email) and your name. Bandit keeps only the first word of that name as your public display name, and asks you straight away whether to keep it or choose another. Bandit never receives your Google or Apple password.

Your display name is public to other signed-in players, so do not use your full name, your address or anything you would not want strangers to read.

Information Bandit uses

Account and game progress

When you are signed in, Firebase Authentication stores your email address, sign-in method and an account identifier. Cloud Firestore stores your display name, cards, scores, achievements, purchases made with earned in-game currency, logbook entries, squad membership, friends and related game progress, so it can be restored on another phone. In-game cash, crates and boosters are earned by playing; they cannot be bought with real money and have no cash value.

Global rankings are visible only to signed-in players. They contain your chosen display name and game statistics: lifetime spot, cash and XP totals, level, prestige, badge count, counts of the aircraft types, tail numbers and rarities you have collected, recent daily totals, an equipped callsign plate and the time the score was updated. They do not contain your email address, photographs, notes or location.

Camera and photographs

Bandit takes a photograph when you press the shutter and saves it in the app's private storage on your phone. Google's ML Kit image-labeling library checks the photograph for an aircraft on the phone, using a model bundled in the app. Photographs are not sent to ML Kit's servers or to any other image-analysis service.

When you are signed in, Bandit also backs up a copy of each photograph to your account in Firebase Storage so it can be restored on another phone. Backup copies are JPEG images no more than 2048 pixels on the longer side, and camera metadata, including any embedded location, is removed before upload. The originals on your phone are not changed. Only your account can read its backup copies. When you delete a photograph or a card in the app, its backup copy is deleted too. Signed out, photographs stay on the phone where they were taken.

Your phone's own backup can also include Bandit. On iPhone, iCloud Backup includes Bandit's saved progress and its full-size photographs. On Android, Google's device backup includes Bandit's saved progress but not its photographs; Android's phone-to-phone transfer brings both. These backups belong to your Apple or Google account and its settings; Bandit does not receive or read them.

On Android you can turn on Back up photos to Google Drive in Settings. Bandit then copies your full-size photographs into Google Drive's hidden app data folder in your own Google account, and can download them again on another phone. Bandit asks Google only for access to its own app data folder (the drive.appdata permission), which cannot see your other Drive files. The copies use your Drive storage and we cannot access them. Turning the backup off stops new uploads; to delete the copies, remove Bandit's hidden app data in Google Drive (Settings › Manage apps on drive.google.com).

You can put a picture of your own on a card: a JPEG you choose with Import a camera photo, or one you take with your phone's own camera app through Card photo with your camera app. Bandit receives only that one picture and stores, backs up and shares it as it would a photograph it took itself. The other camera app may keep its own copy under its own settings. When you choose Save photo to phone, a copy is added to your photo library; Bandit asks only to add to your library and never reads it.

Take care with what is in your photographs. Bandit is meant for pictures of aircraft. If other people, vehicles or private property appear in a photo, they stay on your phone and in your own backup unless you choose to share the card (see Binder sharing). Do not share photographs you do not have the right to share.

Location

Bandit asks for your precise location while you use it. It is used to:

1. Find nearby aircraft. Bandit asks two aircraft-tracking services, ADSB.lol and, when it is slow or unavailable, adsb.fi. Each receives coordinates rounded to two decimal places (roughly a kilometre) and, like any web request, your IP address. The requests contain no Bandit account or device identifier.
2. Name the place where a photograph was taken, using the geocoding service built into your phone's operating system (Apple on iPhone, Google on Android).
3. Save the location of a logged sighting with the sighting. Signed in, this is part of your private backup. It is not shown to squad members or friends: squad feeds and friends' logbooks show the aircraft and the time, not where you were.
4. Check for interesting aircraft near the last place you used the app, if you turn on alerts. On Android, Bandit does not request background-location permission and discards the remembered location after six hours.

On iPhone, if you turn on aircraft alerts and choose to allow location access "Always", Bandit also uses your location while the app is closed: iOS tells Bandit when your phone has moved a significant distance, and Bandit uses that position, or your current position when it checks in the background, to look for interesting aircraft near you. That position is used only for the nearby-traffic request in item 1 and to decide whether to show an alert on your phone. It is not added to your sightings, your backup or your squad. You can turn this off at any time in the iPhone Settings app under Bandit, or by turning off aircraft alerts.

The radar and logbook maps are drawn from Mapbox (satellite, street and terrain imagery, with OpenStreetMap data). Each map-tile request tells Mapbox which area is being shown, which is around you on the radar or around a sighting in your logbook, and your IP address. It contains no Bandit account or device identifier.

Squads, friends, rankings and Binder sharing

A squad is a small group joined with an invitation code. Squad members can see each other's display names and scores, and a feed of squad sightings: the aircraft type, callsign when available, the member's name and the time.

You can add other signed-in players as friends. A friend request or squad invitation shows your display name to the person you send it to. Friends can see your profile: your display name, prestige, badges, featured aircraft and showcase card, and the cosmetics you have equipped.

Binder sharing is optional and starts off. If you turn it on, your squad members and friends can see the cards you share: aircraft identity, rarity, condition, capture date, flight details such as callsign and route, and a reduced-size copy of each card's photograph, stored in Firebase Storage with camera metadata, including location, removed. Notes, your email address, balance, full-size photographs and your private backup are not shared.

While Binder sharing is on, your friends (not squad members who are not also friends) can also open your logbook from your profile. It shows the aircraft you logged, when, the flight's route and airline, rarity and milestones, with the reduced-size card photographs. It does not include the logbook's map, where you were, your notes, an aircraft's registered owner or what a capture earned.

Friends can react to a shared card with a heart or an emoji. You see how many of each reaction a card has, not who gave them.

Reporting and blocking. On another player's profile you can report them (an offensive name, bothering you, inappropriate content, cheating or something else, with an optional note) or block them. A report records your account identifier, the reported player's identifier and name, where you met them, the reason and your note; it is readable only by us, is not shown to the reported player, and is kept for as long as needed to act on it and to protect other players. A block is stored in your own account: it hides that player from your Ranks board and squad feed, ends any friendship, and stops them sending you friend requests or squad invitations. They are not told. You can unblock in Account › Friends › Blocked players. Display names and squad names are also checked against a list of objectionable words when you choose them.

Access ends when you turn sharing off, leave the squad or remove the friend, but a friend who has already seen something may remember it or have taken a screenshot. Share only with people you trust.

Aircraft identification

Bandit sends an aircraft's public Mode-S hex code, registration or callsign to adsbdb.com, ADSB.lol, adsb.fi and planespotters.net to find its type, registration, route, the path it has flown and a photograph of it. These requests contain no information about you beyond the IP address any web request carries. The photographs from planespotters.net belong to their photographers and are shown with a credit and a link back.

The Logbook can show an airline's logo, fetched from FlightAware by airline code. The request carries the airline's code and your IP address.

Australian aircraft types are identified on the phone from the Civil Aviation Safety Authority's aircraft register (reduced to registration mark and type; licensed under CC BY 4.0), which sends nothing anywhere.

Alerts and home-screen widgets

Alerts are composed on your phone from aircraft data it already fetched. We operate no push-notification server and there is no marketing notification service.

The optional home-screen widgets (Progress, Last Catch and Sky Now) show your level and streak, your newest photographs and a map of the aircraft near the last place you used the app. The app writes what they show into storage on your phone that only Bandit and its widgets can read. Anyone who can see your home screen or lock screen can see what a widget shows, so remove or hide a widget if that matters to you. Tapping Sky Now asks the traffic and map services in Location for an update around your last known position.

Crash and error reports

Release builds use Firebase Crashlytics for app stability. Reports can include app version, device and operating-system information, a Crashlytics installation identifier, crash stacks and technical failure categories. Bandit does not set your account identifier in Crashlytics or attach photographs, sighting locations, email addresses, tokens or the exportable local debug log. Dart error reports include the exception type and source-code stack frames; raw exception messages are omitted because they may contain private file paths or server responses. Reports are used to diagnose faults, not for advertising. You can turn them off at any time in Account › Privacy › Send crash reports. The detailed on-device debug log leaves your phone only if you export and send it.

Security of the app itself

When you are signed in, Firebase App Check uses Play Integrity (Android) or Apple App Attest (iPhone) to confirm requests come from a genuine copy of Bandit. That check sends device-integrity signals to Google or Apple under their own policies.

Service providers and other recipients

We do not sell personal information and do not share it for advertising. We disclose it to the providers above to run the app, to other players as described in Squads, friends, rankings and Binder sharing, and where the law requires or to protect people from harm. If the app were sold or transferred, your information could move with it, subject to this policy.

Where information is processed

Cloud Firestore and Firebase Storage for Bandit are configured in Sydney, Australia, and the account-deletion function runs in Australia. Firebase Authentication processes data in the United States, and Google, Mapbox and the aircraft-data services may process data in other countries, including the United States and Europe. When your information is sent overseas we rely on the provider's own safeguards (for Google, its published data-processing terms) and take reasonable steps to make sure the provider handles it consistently with this policy. Google describes its practices in Privacy and Security in Firebase.

Storage, security and retention

Firebase encrypts data in transit and at rest. Firestore and Storage rules limit private backups and photo copies to the signed-in account, squad data to current squad members, and shared cards and the shared logbook to current squad members or friends while Binder sharing is on. Global ranking fields are limited to those described above. No system is perfectly secure; protect your password and your phone.

We keep cloud account data while the account exists. Earlier backup revisions can be kept so a restore is reliable, and a card or photograph you delete in the app is removed from your current cloud copies. After you delete your account we delete your cloud data and do not keep it, except for what the law requires us to keep or what is needed briefly to finish the deletion; routine Google backups of the deleted data are overwritten on Google's normal cycle. Reports about a player are kept for as long as needed to act on them. Crash reports are kept by Crashlytics for its standard period (currently 90 days). Data on your phone stays until you delete it or uninstall.

Your choices and rights

• Access and correction. You can see most of what we hold in the app. Email us for a copy or to correct anything you cannot change yourself.
• Delete. See Deleting your data below.
• Permissions. You can turn off camera, location, motion, notifications and Google Drive backup at any time in your phone's settings or in the app. Without location, Bandit cannot find aircraft near you.
• Sharing. Binder sharing is off by default and you can switch it off at any time, leave a squad, or remove a friend.
• Crash reports. Switch them off in Account › Privacy; email us if you want your Crashlytics installation identifier deleted.
• Everyone, wherever you live. If you are in the European Economic Area, the United Kingdom, California or another place with a privacy law, you may also have the right to object to or restrict processing, to receive your data in a portable form, and to withdraw consent you gave. Our reasons for using your information are: to provide the app you asked for (accounts, backup, rankings, squads), your consent where you grant a permission or switch on a feature, our legitimate interest in keeping the app secure and working (crash reports, App Check) and legal obligations. We do not sell or share personal information for cross-context behavioural advertising, and we do not use it for automated decisions that have legal effect on you.
• Complaints. Email us first and we will reply within 30 days. If you are in Australia and are not satisfied, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au); elsewhere, to your local data-protection authority.

Deleting your data

You can remove local data by uninstalling Bandit or, on Android, using Settings → Apps → Bandit → Storage → Clear storage.

To delete your account, open Account in the app and choose Delete account. You will be asked to sign in again, and the account and the data below are then deleted at once. If you cannot use the app, email banditplanespotter@gmail.com from the address used for the account with the subject "Delete my Bandit account" (instructions are also at https://ax3e.github.io/planespotter-privacy/delete-account.html); we complete emailed requests within 30 days.

Deletion covers your sign-in account, backups and backup photographs, leaderboard entry, profile, shared cards and their photograph copies, squad records, friends links and requests, and reactions you gave. If you signed in with Apple, Bandit's access to your Apple ID is revoked. Your cards and photographs on your phone stay there, and you can keep playing signed out. Signing out does not delete an account. Photographs in your own Google Drive backup, your phone's backups, reports about other players that we need to keep, and anything other people have already seen or saved are outside what deletion removes.

Advertising and tracking

Bandit shows no advertising, has no analytics or advertising SDKs, and does not track you across other companies' apps or websites.

Changes and contact

If this policy changes in a way that matters, we will publish the new version and date at the same address and, for material changes, take reasonable steps to tell you before they apply. Questions, requests and complaints: banditplanespotter@gmail.com.