Home › Privacy

Privacy & cookies

Last updated 28 July 2026

canfly? is a free map of official drone geo-zones. No accounts, no adverts, no profiles. This page says what is collected and how to refuse it.

In short. Browsing canfly? stores nothing that identifies you. Analytics cookies are set only if you press Accept. The map fetches its background images from one third party, which reveals your IP address to them. If you buy a download, we hold your email address and the order - and nothing else.

Who is responsible

Controller: Exovoid Ltd., bul. Cherni Vrah 47A, fl. 5, Sofia, Bulgaria, which operates canfly.io. To ask anything here, or to exercise your rights, write to contact@exovoid.tech.

Cookies and local storage

No cookies are set unless you accept analytics. The two local-storage entries stay on your device, are never sent to us, and only do something you asked for - so they need no consent.

Name	Type	Set by	Purpose	Expires
`_ga`	Cookie	Google Analytics	Tells browsers apart so visits can be counted. Only if you accept.	2 years
`_ga_<id>`	Cookie	Google Analytics	Keeps session state. Only if you accept.	2 years
`canfly.consent`	Local storage	canfly?	Remembers your cookie choice.	Until you clear it
`dronemap.theme`	Local storage	canfly?	Remembers your map theme.	Until you clear it

Withdrawing is as easy as consenting: Decline removes the analytics cookies and stops the script loading again.

What is collected, and on what basis

1. Analytics - only with your consent

Accept, and we load Google Analytics 4 (G-5B54NYZ5T8) to count visits and see which pages are useful. It records pages viewed, approximate location from your IP address, and device type. Google states that GA4 does not store IP addresses. We see aggregate reports only.

Legal basis: consent (Art. 6(1)(a) GDPR; Art. 5(3) ePrivacy Directive for the cookies). Decline, and your browser never contacts Google.

2. Map tiles - required for the map

Background images come from CARTO (basemaps.cartocdn.com). Fetching them reveals your IP address to CARTO. It is the only third party the map contacts: the mapping library is served from canfly.io, not from a CDN.

Legal basis: legitimate interest in showing the map you asked for (Art. 6(1)(f) GDPR). The country pages and downloads draw no tiles.

3. Free zone exports and the API

The coordinates and format you export are used to build the file, then discarded. We keep no record of who exported what. (Paid downloads are different - see 6 below.)

4. Server logs

canfly? writes no visitor request log. Our host keeps standard technical logs, including IP addresses, for security and fault diagnosis. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).

5. Crawler statistics

We count how often search and AI crawlers fetch each page, matched against a fixed list of bots. Counters only - no IP addresses, nothing about human visitors.

6. Buying a download

If you buy one of our paid downloads we hold your email address, which product you bought, your Stripe payment reference, and a download token. That is all. Card details never reach us - Stripe takes the payment and holds them, along with any billing details you give it. Hostinger, who also host this site, send you the download link from our own mailbox.

Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR) to deliver what you bought, and legal obligation (Art. 6(1)(c)) to keep the accounting record. Buying does not require accepting analytics, and purchases are never sent to Google.

The commercial side of a purchase - what you receive, delivery, your right of withdrawal and refunds - is set out in the terms of sale. If you write to us about an order we hold that message for as long as it takes to deal with it.

What we do not do

No accounts, newsletters or profiling. Browsing us leaves no personal data at all.
No adverts, tracking networks or automated decisions.
No selling or sharing of personal data.
No access to your device's location.
We never see or store your card details.

Sharing and international transfers

Four parties receive anything, each only in the circumstances above: Google (analytics, if you accept), CARTO (map tiles), and - if you buy something - Stripe (payment) and Hostinger (the email itself). Google LLC and Stripe participate in the EU-US Data Privacy Framework; other transfers rely on the European Commission's Standard Contractual Clauses. We disclose to no one else unless legally obliged.

Retention

Google deletes analytics data on the retention period set for the property. Hosting logs follow our provider's period. Crawler counters hold no personal data. Your cookie choice stays on your device until you change or clear it.

Orders are kept for as long as accounting and tax law requires us to keep the record of the sale. Your download entitlement is separate, and we can end it on request.

Your rights

You may request access, correction, erasure, restriction or portability; object to processing based on legitimate interest; and withdraw consent at any time, without affecting what came before. Write to contact@exovoid.tech - we reply within one month.

If you have never bought from us we hold no accounts and no identifiers, so there is usually nothing a request can be matched to. If you have, quote the email you bought with.

One limit on erasure, stated plainly: we can delete your download entitlement and stop contacting you, but not the record of the sale itself - Art. 17(3)(b) GDPR keeps what we are legally obliged to retain for accounting.

For analytics you can also install Google's opt-out add-on.

To complain, contact your national data protection authority - the European Data Protection Board publishes the list.

Changes

If these purposes change we update this page, and ask for your cookie choice again rather than carrying the old one over.