OnAirOnAir privacy: what the app sends and when
There is no account and no telemetry. A few features talk to a server, and this page lists each one.
In short#
- OnAir has no account, no analytics and no telemetry.
- By default the only server it contacts on its own is GitHub, for the update check, which you can turn off.
- Everything that uploads something about you or your receiver is opt-in and off until you turn it on.
- Crash reports are written to a file on your computer; nothing is uploaded. You attach one yourself if you choose to.
Every feature that uses the internet#
| Feature | Server | What is sent | Default |
|---|---|---|---|
| Update check | api.github.com (and GitHub downloads) | the usual web request with a user agent OnAir/<version>; the package is verified against GitHub's SHA-256 | on; switch off in the version button |
| Public map upload | map.on-air.dev | decoded positions, see below | off; asks first |
| Online map tiles | tile.openstreetmap.org | the tiles for the area you view (so the server sees your IP address and the area) | when a map is shown; use offline MBTiles to avoid it |
| Satellite orbit data (TLE) | celestrak.org, data.keplerpass.com, or your own list | a normal download request | only when you press download |
| Cell tower lookup (OpenCelliD) | opencellid.org | the cell identity (MCC, MNC, TAC, cell id) and your own API key, at most once a second; answers are cached | off until you paste a key |
| Shared channel list | raw.githubusercontent.com (adswill/OnAir-channels) | a normal download request | when you open the list |
| Submitting channels | github.com in your browser | nothing is sent by OnAir: the button opens GitHub with the text filled in and you press Submit (you need a GitHub account) | only when you click |
| PSK Reporter | pskreporter.info | the stations you decode (callsign, frequency, SNR, mode, locator, time) with your callsign, locator and antenna text; batched every 5 minutes | off until you tick it |
| WSPR spots | wsprnet.org | WSPR spots you decode | off until you turn it on |
| MeshCore presets | api.meshcore.nz | a download request; nothing about you | only when you click Refresh |
| Discord status | the Discord app on your computer | the mode (and, if you choose, the frequency) is shown on your profile by your own Discord app | off |
The public map in detail#
map.on-air.dev is the public live map of aircraft, ships, APRS, mesh nodes and other positions that OnAir users choose to share. Everyone can watch it. Your receiver only sends data when you turn that on.
- Asking. OnAir asks once, with three choices: Send positions, Not now (nothing is sent, and it asks again at the next start) and No, do not ask again. You can turn it off at any time in the Server menu.
- What is sent: positions that the signals themselves sent: for each track its kind (aircraft, vessel, APRS, drone, sonde, satellite and so on), an identifier (an aircraft's ICAO address, a ship's MMSI or the callsign or name the signal carries), a label, latitude and longitude, altitude, heading, speed, climb rate, squawk, the age of the fix, the source mode and a short recent path (up to 60 points). The request also carries a random 20-character station ID that OnAir makes on your computer the first time; it is not derived from you.
- What is never sent: catalogue satellite orbits, your receiver location, drone operator locations, privacy-flagged FLARM aircraft (their no-track and stealth flags are respected everywhere), cell towers, and the built-in test signal.
- Old fixes are dropped before sending (for example 30 seconds for ADS-B), at most one batch every few seconds, and a heartbeat every minute while it is on.
- A small diagnostic log of the upload is kept inside the app for support (Server menu).
Things that stay on your computer#
- Your position (locator or coordinates), settings, recordings and results (see Settings and files).
- The remote-control API is off by default and listens on
127.0.0.1only unless you open it with a token (API). - Share my radio and the data feeds are off until you turn them on and stay on this computer unless you tick Let other computers connect (LAN).
- The optional NTP server is off at every start and answers private (LAN) addresses only.
- FLARM stealth aircraft, and anonymous addresses, are never shown, logged, saved or exported.
Receiving other people's signals#
Many signals OnAir decodes come from other people's devices (pagers, IoT sensors, Bluetooth and Wi-Fi beacons, LoRa meshes, cell information). OnAir is passive: it never connects, pairs, joins or decrypts. What you may listen to, keep or share is a legal question where you live: see Legal.
Questions or corrections: GitHub issues.