Privacy statement

Applies to the GPSDump Android app (com.gpsdump), version 3.0 and later. Last updated: 4 October 2026.

The short version

Data stored on your phone

• Tracklogs, waypoints, tasks and airspace files that you download from an instrument or open from a file are saved as ordinary files under Documents/GpsDump/. They are not sent anywhere unless you upload or check them yourself.
• Settings (pilot name, file-format preferences, etc.) are stored in the app's own preferences.
• Server sign-ins for XContest, Flightlog, XCGlobe and your own FTP or HTTP server, if you enter them, stay on the phone and are used only to sign in to the server you chose. Passwords and the Flightlog API token are encrypted with a key held by the Android keystore rather than kept in the ordinary preferences, and they are masked in wire captures and never shown in upload reports or status lines. The rest of a sign-in — your username, country, server address, FTP folder — is an ordinary preference.
• Your openAIP API key, if you paste one into Preferences in order to download airspace, is stored in the app's preferences. It is your own free key from openaip.net — no key ships with GPSDump — and it is sent only to openAIP, in a request header rather than in the web address.
• Your list of gliders (the wings you fly, with class, rating and tandem flag) is a local list. It changes only when you edit it, or when you press Get Flightlog gliders, which adds the gliders registered to your flightlog.org account (see Network use). Nothing is ever sent from the list except the glider you choose for an upload.
• Remembered instruments. When you tell GPSDump to remember an instrument, it keeps the instrument's name, the identity it reports over USB (vendor and product numbers, and the serial number of its USB chip or of the instrument itself, where it has one), when it was last plugged in, and how many flights have come off it. The serial number is how your instrument is told apart from another of the same make. Instruments you answered Not now to are listed the same way, so you can change your mind.
• The newest flight you have stored. For each instrument, GPSDump remembers the date and start time of the newest flight you saved or uploaded from it, so the flight list can mark the newer ones as new. It contains no track and no position.

None of this is included in Android's cloud backups or in a phone-to-phone transfer: the app's preferences are excluded from both, on purpose.

The online IGC signature check

An IGC flight file carries a signature that contest servers check. GPSDump can check it too, so you know whether a flight will be accepted before you file it, by sending the file to the FAI/CIVL Open Validation Server (vali.fai-civl.org). That happens only in two ways:

• When you ask for it — Online igc validation on the Tracklog tab sends the flight you have loaded.
• Automatically, if you turn it on — the setting Automatic online IGC check (IGC file options) sends every IGC file the app opens, and every flight downloaded from an instrument that records its own IGC file. That includes a Brauniger Competino or Flytec 5020 flight, whose original is checked before GPSDump corrects its date and replaces the instrument's signature with its own. The setting is off by default. With it off, nothing is sent: flights are shown as not checked, and a corrected Competino/5020 flight is still corrected and signed, with a note in the file that its original signature was not checked online.

In each case:

• What is sent is the whole file: your track, and its header, which usually holds the pilot name, the glider and the instrument's serial number.
• The service is contacted over plain HTTP, because its HTTPS address serves an invalid certificate. The file therefore crosses the network unencrypted.
• The service is run by the FAI's hang-gliding and paragliding commission (CIVL) for exactly this purpose, and is the same check contest servers make. How it handles the files is governed by the FAI, not by GPSDump.

Network use you start yourself

Apart from the IGC check above, GPSDump connects to the internet only when you start one of these actions, and only to the server involved:

• Flight upload to XContest (www.xcontest.org) — sends your username and password, the claim details you enter, your glider and the tracklog.
• Flight upload to Flightlog (flightlog.org) — sends your API token, the tracklog as the instrument's signed IGC file, the glider, its tandem flag, your comment and whether the flight should be kept out of competitions. Check token and Get Flightlog gliders send only the token, and the second fetches the list of gliders registered to your account.
• Flight upload to XCGlobe (xcglobe.com) — sends your username and password, the glider, any note you enter, and the tracklog.
• Upload to your own FTP or HTTP server — sends your login and each selected file to the server address and folder you configured. FTP is unencrypted: your FTP password and files cross the network in the clear, so use it only with a server you trust.
• Airspace download from openAIP (api.core.openaip.net) — sends your openAIP API key, the position you chose to centre on (a waypoint from your own list, or a latitude and longitude you typed) and the radius. GPSDump does not read the phone's GPS and never sends where you actually are.
• Load XCTrack task by code (tools.xcontest.org) — fetches the task matching the code or link you enter.

Uploading several flights at once sends them one at a time to the destination you chose. A flight is sent once; a Retry after a failure re-sends only the flights the server did not accept.

Data sent to these services is handled under their own privacy policies. A tracklog is a record of where and when you flew, so consider what a contest or logbook site publishes before you file to it.

Android permissions

Wire captures and the drive report

GPSDump can record what it exchanges with an instrument or a server (Save wire capture), so a problem can be diagnosed from a file rather than from a description. Nothing is captured unless you turn it on, and nothing is sent anywhere: the capture is a file in Downloads/ on your phone, yours to look at, keep, or send to the developer if you choose. Passwords and tokens are masked. Everything else that was on the wire is in it — your flight data, your pilot name, the server's replies — so read a capture before you share it. The drive report, which describes an unrecognised instrument well enough for support to be added for it, works the other way round: pilot name, glider and logger serial number are removed before it is written.

Your choices

• Every file the app writes is an ordinary file you can inspect, move or delete.
• Remember password can be switched off in the sign-in form; the password then lives only until the app is closed. Forget sign-in clears the stored username, password or token for that destination at once. A Flightlog token can also be revoked on flightlog.org, which cuts GPSDump off from your account.
• Automatic online IGC check is off unless you turn it on, and can be turned off again at any time.
• The openAIP API key can be cleared in Preferences. Without one, the airspace download makes no request at all.
• Gliders can be removed from the glider list at any time.
• Remembered instruments (⋮ menu) lists every instrument GPSDump remembers, with Forget on each and Forget all.
• Uninstalling the app, or clearing its data, removes all of the above. Files you saved under Documents/GpsDump/ stay on the phone.

Children

GPSDump is a technical utility for pilots and is not directed at children. It collects no data from anyone, children included.

Changes to this statement

If the app's data handling changes, this page will be updated and the change noted in the changelog. A desktop version of GPSDump is planned; this statement will be extended to cover it when it is released.

Contact

Contact details for the developer are on the app's Google Play listing. For bug reports and feature requests, please use the Codeberg issue tracker.