This translation is for information only. If the versions differ, the German version prevails, as far as the law allows.

As of 7 November 2026 · applies to the Vario One app (iPhone, Apple Watch, Android) and the website vario-one.com

1. Controller

Leobalo GmbH, Schwester-Jovita-Str. 15, 64625 Bensheim, Deutschland Managing director (Geschäftsführer): Tino Volbracht · E-mail:

We have not appointed a data protection officer because there is no legal obligation to do so. We answer questions about data protection via our contact form (vario-one.com/en/kontakt).

2. The key points in brief

Vario, altitude and flight recording run on your device. Many features do not need an account.
Your position leaves the device only for certain features: air pressure from the nearest airfield (QNH), airspace data, maps, group flying, SafeSky and syncing your flight book. What goes where is set out below.
With an account, we store your flight book, your pilot data, routes and waypoints on our server so that you have them on all your devices.
The apps contain no analytics or advertising services.
We do not sell data and do not show advertising.

3. Legal bases

We process personal data only if there is a legal basis:

Contract (Art. 6(1)(b) GDPR): to provide you with the app and the services you use.
Legitimate interest (Art. 6(1)(f) GDPR): for example for the secure operation of our servers; we state our interest in each case.
Consent (Art. 6(1)(a) GDPR; Section 25(1) of the German Telecommunications Digital Services Data Protection Act (TDDDG)): when we expressly ask you. You can withdraw it at any time with effect for the future.
Legal obligation (Art. 6(1)(c) GDPR): for example retention under tax law.

Section 25 TDDDG applies to storing information on your device and accessing it: without consent this is allowed only if it is strictly necessary for a feature you have expressly requested (Section 25(2) no. 2 TDDDG). Operating system permissions do not replace consent.

Agreeing to our Terms and Conditions is not consent to data processing.

4. The app

4.1 Download and store

You download the app from the Apple App Store or Google Play. In doing so, Apple or Google process data such as your store identifier and payment data on their own responsibility. We have no influence on this; the privacy notices of Apple or Google apply.

4.2 What stays on your device

Location, air pressure and motion sensors: for Vario, altitude, speed, map and flight recording. During a recording the app also uses your location in the background. On Android the operating system determines the location via Google Play services; Google’s settings and terms on your device apply to this.
Flight book, settings, sound profiles: stored locally.
Bluetooth: for external Varios (e.g. BlueFly, Mipfly, Stodeus, SkyDrop, XC Tracer) and ActiveLook glasses. The readings stay on the device.
Apple Watch: The Watch app starts a workout session so that it stays in the foreground during the flight. For this it asks for permission to start workouts. The app does not read health data such as your heart rate.
Login details for XContest and DHV-XC: encrypted in the Keychain (iPhone) or encrypted storage (Android). On Android, login data is excluded from device backups.
Notifications and battery (Android): The app shows a notification during a recording or while SafeSky is active and may ask you to exclude it from battery optimization so that it is not closed in the background.

The app asks for permissions only when they are needed. You can revoke them at any time in the system settings; the affected features are then not available.

4.3 Connection to our server and server logs

When the app talks to our server (api.vario-one.com), the server processes, as technically necessary, your IP address, the time, the requested address and the status code. This data ends up in log files in order to find errors and fend off attacks (Art. 6(1)(f) GDPR). We store the IP address only in truncated form and do not log any location details. We delete the logs after 30 days.

Our servers are operated by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, in a data center in Germany, as a processor under Art. 28 GDPR.

4.4 Account

Data: e-mail address; with “Sign in with Apple”, the Apple identifier and, where applicable, the e-mail address passed on by Apple; on Android with the older sign-in, a password that we store only as a hash; sign-in codes and session keys.

Purpose and legal basis: signing in and providing the account features (Art. 6(1)(b) GDPR).

Recipients: With “Sign in with Apple”, our server verifies the sign-in with Apple. We send sign-in codes and confirmations by e-mail via our e-mail service provider (section 4.19).

Retention period: until the account is deleted (section 8). Sign-in codes are valid for 10 minutes, a sign-in remains valid for up to 90 days.

4.5 Syncing the flight book

If you have a confirmed account, the app automatically syncs your flight book with our server. That is what you created the account for; without an account your flight book stays only on your device.

Data: launch and landing time, duration, maximum values, launch and landing site with coordinates, launch type, glider, details for the DHV training record (DHV-Übungsnachweis) and the complete flight track (IGC/GPX). On Android you can also upload a sensor log with a tap, which helps us with troubleshooting.

Purpose and legal basis: your flight book on all devices and as a backup (Art. 6(1)(b) GDPR). Uploaded sensor logs: troubleshooting at your request (Art. 6(1)(b) GDPR).

Retention period: until you delete the flight or your account; sensor logs 90 days.

4.6 Pilot and equipment

Name, name of a companion (tandem), glider type, model, registration and launch type. The app writes them into your flight files and the DHV training record and syncs them if you have an account (Art. 6(1)(b) GDPR). In group flying, the members of your group see your pilot name (section 4.12).

With an account, we store your routes, waypoints and map markers so that you have them in the app and on vario-one.com (Art. 6(1)(b) GDPR), until you delete them or your account.

If you share a sound profile by link, the profile itself is contained in the link; our server does not receive it.

If you share a route by link, anyone with this link can see the route and your message – even without an account. The link is valid until you revoke it or an expiry date you chose is reached; without an expiry date it is valid indefinitely.

4.8 Air pressure from the nearest airfield (QNH)

For altitude readings and airspace limits given as flight levels, the app regularly fetches the current air pressure (QNH) of the nearest airfield. For this it sends your current position to our server – about every 15 minutes or when you move significantly. The feature is on by default and can be switched off in the altitude settings.

Our server requests the weather data from the US agency NOAA (aviationweather.gov). In doing so, it does not transmit your position or any data about you, only a rough area (grid cell of about 25 km).

Legal basis: Art. 6(1)(b) GDPR (accurate altitude display as part of the app).

4.9 Airspace (OpenAIP)

Airspace data comes from OpenAIP. The app loads country files via our server; OpenAIP learns nothing about you in the process. On iPhone the app also requests the airspaces in an area around your current position directly from OpenAIP; in doing so, OpenAIP receives your IP address and this area.

Legal basis: Art. 6(1)(b) GDPR. Provider: Garrecht Avionik GmbH, Wieslocher Str. 38, 69190 Walldorf, Deutschland (operator of openAIP); privacy notice: https://www.openaip.net/legal#privacy-policy.

4.10 Maps (Mapbox, Google Maps, kk7)

Mapbox (Mapbox Inc., USA) provides the map and offline maps. When loading, Mapbox receives your IP address and the map section. We have switched off the usage statistics of the map module (“telemetry”).
Google Maps (Google Ireland Ltd.) shows the free launch and landing site map on Android. Google receives your IP address and the map section.
kk7 (thermal.kk7.ch, Switzerland) provides the thermals and skyways layer if you switch it on. kk7 receives your IP address and the map section.

Legal basis: Art. 6(1)(b) GDPR. For the transfer to the USA, see section 7.

4.11 Weather stations (Holfuy)

The app fetches wind data from weather stations via our server; Holfuy receives no data about you in the process. If you open a station’s page, the app loads it directly from Holfuy (on Android in the browser); Holfuy then receives your IP address.

4.12 Group flying

If you create or join a group, the app sends your position, altitude and pilot name during the flight about every second, encrypted, via our server to the other members. Our server assigns the group key and can therefore technically read the data – so this is not end-to-end encryption. It stores the last position for at most 2 minutes; the relay keeps the last position and connection address in memory for about 30 seconds. Groups and memberships remain stored until you leave the group.

Legal basis: Art. 6(1)(b) GDPR – you start group flying yourself.

4.13 Traffic via SafeSky

SafeSky is switched off until you activate it. When you register, our server transmits your call sign, a random identifier, the aircraft category and your e-mail address to SafeSky or the ADS-L register (api.flyadsl.com). SafeSky requires your e-mail address for registration; we pass it on only for that purpose. After that, the app sends your position, altitude, speed, climb and course directly to SafeSky about every second during the flight, so that other airspace users see you. Other participants see your call sign and your position. On the ground the app sends only if you switch on “Send position on ground”.

Recipient: SafeSky, Avenue du Champ de la Bloquerie 42, 1420 Braine-l’Alleud, Belgien, as a separate controller. SafeSky’s privacy policy applies to the processing by SafeSky: https://www.safesky.app/legal. Legal basis: Art. 6(1)(b) GDPR. Retention period with us: until you deregister from SafeSky or delete your account.

4.14 Upload to XContest and DHV-XC

If you upload a flight, the app sends the flight file and your login details directly to XContest or the DHV-XC server. We do not receive this data. The respective provider is responsible for further processing.

4.15 Subscription and purchases

Purchases are processed by Apple or Google. So that we can activate your subscription, the app sends the purchase receipt (iPhone) or the purchase token (Android) to our server, which verifies it with Apple or Google. Apple and Google automatically inform us of changes (renewal, cancellation, refund).

Data: purchase receipt or token, product, status, term, where applicable the link to your account; for discount offers the product and offer identifier, for redeemed codes the code. For statistics about subscriptions we use only an encrypted identifier with no link to your name or e-mail address.

Legal basis: Art. 6(1)(b) GDPR; abuse prevention Art. 6(1)(f) GDPR. Retention period: as long as the subscription runs and for 12 months afterwards, then we delete the data.

4.16 Crash reports

The apps contain no analytics or statistics services and no third-party crash services.

On iPhone and Apple Watch we receive crash reports only via Apple, and only if you have switched on “Share With App Developers” in your device settings. These reports contain details about the device, system version and crash location, but neither your name nor your location. You can change this setting at any time under Settings → Privacy & Security → Analytics & Improvements.

The Android app uses no analytics or crash services. It stores crashes only on the device.

4.17 Inquiries to us

If you send us an e-mail, we process your e-mail address and your message in order to reply to you (Art. 6(1)(b) or (f) GDPR). We delete such e-mails no later than 3 years after the last contact. The mailbox is hosted at ALL-INKL (section 4.19).

Feedback on Android:

If you send us feedback via the app, your e-mail app opens with a prepared message. It contains the app version, device model and Android version and, if available, crash logs or a sensor log. You see the message before sending. We use it to reply to you and fix errors (Art. 6(1)(b) or (f) GDPR).

4.18 Record of your agreement to the Terms and Conditions

When you agree to the Terms and Conditions, the app stores on your device which version you agreed to and when, together with a random installation identifier, the app version and the language setting. This serves as proof of the conclusion of the contract (Art. 6(1)(b) and (f) GDPR). This data is excluded from device backups. The app also transmits the record to our server; if you are signed in, we link it to your account. We store it there until three years after the end of your use. If you delete your account, we remove the link to the account; the version, time and installation identifier remain as a record for this period.

4.19 E-mails

We send sign-in codes, confirmations and deletion confirmations via the e-mail service of ALL-INKL.COM – Neue Medien Münnich, Hauptstraße 68, 02742 Friedersdorf (Deutschland), as a processor. Our mailbox is also hosted there.

4.20 Organizations and briefings

Flying schools, clubs, shuttle services and competitions can create an organization on vario-one.com and use it to publish daily or weekly briefings for their pilots.

Data: name, type and logo of the organization; the accounts of the members who manage the organization; invitations to further members (e-mail address of the invited person); contact persons of the organization with name, role, phone number, preferred channel (phone/WhatsApp) and link to the WhatsApp group; content of the briefings, including routes and waypoints; a log of who changed or published what and when.

Who sees what: Published briefings with the contact persons named in them are visible to anyone with the link or, if the organization sets this, only with a group code.

Legal basis: Art. 6(1)(b) GDPR towards the members of the organization. The organization is the controller for the personal data of its contact persons and the e-mail addresses of invited people; we process this data on its behalf (Art. 28 GDPR, Terms and Conditions section 15). It is best to address questions about this to the organization; we forward inquiries sent to us.

Retention period: until the organization deletes the entries or is dissolved; invitations until they expire. If you delete your account, your membership ends; content you created remains with the organization without any link to your account.

5. The website vario-one.com

5.1 Visiting the website

When you visit, our web server processes your IP address, date and time, the page requested, the browser and the previously visited page, in order to deliver and secure the website (Art. 6(1)(f) GDPR). The website also runs on servers of Hetzner Online GmbH in Germany. We store the IP address only in truncated form; we delete the logs after 30 days.

5.2 Audience measurement (Umami)

We use Umami on our own server (analytics.vario-one.com). Umami does not set cookies. It records pages visited, origin, device type as well as clicks on buttons (with text and target) and form submissions. Umami does not store your IP address; it only derives from it a non-reversible visitor identifier, whose calculation basis changes regularly, and uses it to work out your approximate country, region and city. We delete the recorded data after 25 months.

Umami stores nothing on your device. It only checks whether you have switched off the measurement; this serves solely to respect your objection. That is why we do not ask for consent for it. The legal basis is our legitimate interest in improving the website (Art. 6(1)(f) GDPR). You can object, e.g. by activating “Do Not Track” in your browser or using a content blocker.

5.3 Map on the website

The map at vario-one.com/en/karte loads map images directly from OpenStreetMap, OpenTopoMap, Esri (USA) and OpenAIP. These receive your IP address and the map section (Art. 6(1)(f) GDPR, interest: displaying the map).

5.4 Route planning in the browser

If you sign in on vario-one.com, sections 4.4 and 4.7 apply accordingly.

5.5 Contact form

We forward messages sent via the contact form (name, e-mail, message, page) through an automation service we run ourselves (n8n) on our server at Hetzner to our mailbox, in order to reply to you (Art. 6(1)(b) or (f) GDPR). The same retention period applies as for e-mails (section 4.17).

5.6 Deleting your account

Via vario-one.com/en/konto-loeschen you can request the deletion of your account; for this we process your e-mail address and language (Art. 6(1)(b) and (c) GDPR).

5.7 Fonts

The website does not load any fonts from Google or other third parties.

6. Recipients

We pass on your data only if it is necessary for the purposes described:

Processors: Hetzner Online GmbH (servers, Germany), ALL-INKL.COM (e-mail, Germany).
Recipients acting as independent controllers for features you use: Apple, Google, Mapbox, OpenStreetMap, OpenTopoMap, Esri, OpenAIP, kk7, Holfuy, SafeSky, XContest, DHV-XC, other members of your group, recipients of your share links.
Authorities, if we are legally obliged to do so.

7. Transfers to third countries

Some providers are based in the USA or process data there (Mapbox, Google, Apple, Esri). These providers are certified under the EU-US Data Privacy Framework; the transfer is based on the EU Commission’s adequacy decision on it (Art. 45 GDPR). An adequacy decision exists for Switzerland (kk7). You can get information about the safeguards on request via our contact form (vario-one.com/en/kontakt).

8. Deleting your account and retention periods

Deleting your account: in the app or at vario-one.com/en/konto-loeschen. You receive an e-mail with a confirmation link (valid for 24 hours); if your account has no e-mail address, deleting it in the app immediately counts as a deletion request. After confirmation we permanently delete your account after 3 days; if you sign in again during this time, we cancel the deletion.
What is deleted: account, flight book with flight files, pilot data, routes, waypoints, share links, map pins, SafeSky registration, the link to your subscription, group memberships and a beta tester entry. If you used “Sign in with Apple”, we revoke the sign-in with Apple. Groups you share with others remain for the other members under the group name.
Backup copies: Deleted data can remain in encrypted backups for up to 12 months (on our server at Hetzner and on our own storage system in Germany). We use them only for recovery after an outage or attack and in doing so delete already deleted accounts again (Art. 6(1)(f), Art. 32 GDPR).
Statutory retention: Data we have to keep for commercial or tax law reasons is blocked until the period expires (up to 10 years).
You delete locally stored data by uninstalling the app.

9. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and withdrawal of consent (Art. 7(3)).

Right to object (Art. 21 GDPR): If we process data on the basis of legitimate interests, you can object at any time on grounds relating to your particular situation.

To do so, write to us via our contact form (vario-one.com/en/kontakt). You can export your flights individually in the app as an IGC or GPX file.

10. Complaint to the supervisory authority

You can complain to a data protection supervisory authority, for example the one responsible for us: Der Hessische Beauftragte für Datenschutz und Informationsfreiheit (the Hessian Commissioner for Data Protection and Freedom of Information), Gustav-Stresemann-Ring 1, 65189 Wiesbaden.

11. Obligation to provide data, automated decisions

You are not obliged to provide us with data. Without certain data (e.g. location, e-mail address), however, individual features are not available. We do not make automated decisions or create profiles within the meaning of Art. 22 GDPR. The automatic check of your subscription only activates features.

12. Children and young people

Vario One is intended for users aged 16 and over. Younger people need the agreement of their parents or legal guardians (see Terms and Conditions). We do not collect age and do not knowingly process data of children without this agreement.

13. Data security

The connection between app, website and server is encrypted (TLS). We store passwords only as a hash, and login details for third-party services encrypted on your device. The app’s login data is excluded from device backups.

14. Changes

We adapt this policy when the app or the legal situation changes. You can find the current version in the app and on vario-one.com.

Privacy Policy for Vario One