Last updated: 5 September 2026
Ghoomy (formerly Ghoomy) logs the flights you have taken and draws them on a globe. This policy describes exactly what the app does with your information. It is written against the app’s actual behaviour, not a template.
Flights you add — by scanning or by typing them in — are written to the
private database of your own iCloud account (CloudKit container
iCloud.com.skyline.flighttracker). This is storage that belongs to you. The
developer has no access to it, and it is covered by
Apple’s iCloud privacy terms.
Deleting the app does not delete this data. To remove it, use Settings → Delete Account inside Ghoomy.
When you scan a pass, Ghoomy tries three things in order:
One other request leaves the app, and only when you ask for it: deleting your account sends a single-use Apple authorization code to that same Worker, so your Sign in with Apple credential can be revoked. See Deleting your account below.
What that image can contain. A boarding pass typically shows your name, the booking reference (PNR), flight number, route, date, seat, and sometimes a frequent-flyer number. If you would rather none of that leave your device, do not scan documents without a barcode — use Enter manually instead, which transmits nothing.
Images are sent for the sole purpose of reading the flight out of them. They are not stored by us after the response is returned. We do not control OpenRouter’s or OpenAI’s retention; see their policies, linked above.
To draw a route we need coordinates for an airport code, and a name for an airline code. The two work differently, so they are described separately.
Airports. Coordinates come from a table of just over nine thousand airports shipped inside the app. Looking one up sends nothing anywhere: it reads a file already on your phone, and it works with no network at all.
Airlines. Airline names come from a short list built into the app, covering the carriers Ghoomy was built and tested against. A code that is not on that list is looked up in the private database of your own iCloud account — the same storage your flights live in, described above — and once resolved it is written back there and cached on your device, so the lookup does not repeat. The app also writes a handful of well-known airline records into that private database the first time you sign in. Those requests go to Apple’s iCloud on your behalf, not to us.
No third-party service is contacted to identify an airport or an airline, and nothing about your flights is sent to one.
Ghoomy requires an account. Apple gives the app a stable identifier for you, and your name and email if you choose to share them. These are held on your device and in your own iCloud record. The identifier is also sent with image scans, as described above, for rate limiting.
You can delete your account at any time from Settings → Delete Account. This removes your flights from iCloud and clears the app’s local data.
It also revokes your Sign in with Apple credential, so Ghoomy stops being listed under your Apple Account. Apple requires this, and it is not something an app can do by itself: revoking a credential has to be signed with a key that belongs to the developer account, and a key like that cannot safely live inside an app. So at the moment you confirm deletion, Ghoomy asks Apple for a fresh, single-use authorization code and sends only that code to the same Cloudflare Worker described above, which holds the signing key and asks Apple to revoke. The code is used once and is not stored, by the Worker or by us. Nothing about your flights is involved.
If that request fails — no network, say — the deletion still goes ahead and your data is still removed. The app tells you so, and you can finish the job yourself in the iOS Settings app → your name → Sign in with Apple → Ghoomy → Stop using Apple ID.
The Send Feedback button on the Profile screen opens a form inside the app. What you write there is stored in our area of iCloud — the public database of Ghoomy’s CloudKit container — which, unlike your flights, the developer can read. That is the point of it: a note filed somewhere only you could see would be a button that does nothing.
Sent with your note, and nothing else: the app version, the build number, and your iOS version. No device identifier, no name, no email address.
Your note is linked to your iCloud account. CloudKit stamps every record with its creator and offers no way to turn that off, so the developer can see which account sent a given note. Nobody else can read it — the record type grants no public read access.
Nothing about your flights is attached. If you want a reply, say so in the note and leave a way to reach you, because otherwise there is no address to answer.
Ghoomy uses the system photo picker. It receives only the single image you choose. The app has no access to the rest of your photo library and never requests it.
Ghoomy is not directed at children under 13 and does not knowingly collect their information.
If this policy changes, the date at the top changes with it, and the updated version will be published at this address.
Questions about this policy, or a request about your data: pmadan.illinois@gmail.com