This policy explains what Rocket Design Lab ("we," "us," or "our") collects when you use our mobile app (currently distributed as a beta under the name "RDL Beta"), our web app at rocketdesignlab.com/app/ and rocketdesignlab.com/beta/, and rocketdesignlab.com itself (together, the "Service"), how we use and share it, and the choices and rights you have — including the specific rights guaranteed under the EU/UK General Data Protection Regulation (GDPR) if you're located in the EU or UK.
Who is responsible for your data
The data controller is Rocket Design Lab (Ian Dalton, sole proprietor), Las Vegas, Nevada, USA. For any privacy question, request, or complaint, contact support@rocketdesignlab.com. We haven't appointed a formal Data Protection Officer — our size and the kind of data we process don't require one under GDPR Art. 37 — but the contact above reaches the person responsible for privacy decisions directly.
Information we collect
- Account information: email address, hashed password (we never see or store your plaintext password — authentication is handled by Firebase Auth).
- Profile information you choose to add: display name, city, birth date, certification level and number (e.g. NAR/TRA/CAR/UKRA), club affiliation. All optional beyond the minimum needed to create an account.
- Content you create: rocket designs, build logs, inventory/stash records, flight records, checklists, and any photos or files you upload against them.
- Location data: launch-site coordinates you enter or capture for a flight record, used to fetch weather and, in aggregate de-identified form, to improve motor/kit recommendations.
- Purchase information: if you subscribe to a paid tier, payment is processed by Apple, Google, Stripe, or RevenueCat directly — we receive confirmation a purchase was made, never your card details.
- Bug reports and kit-data corrections you submit, which may include your account identifier and whatever description or screenshot you provide.
- Beta program applications: name, email, location, device/platform details, and the survey answers you submit if you apply to the beta.
- Automatically logged technical data: app version, platform, and basic error/crash diagnostics needed to keep the service running. In the phone and tablet apps, crash and error diagnostics (device model, operating system, app version, and an anonymous account identifier) are sent to Firebase Crashlytics so we can find and fix bugs.
- Usage analytics: we use Google Analytics for Firebase to see which screens get opened and which parts of the app get used — screen views, a handful of custom events such as switching tabs, and the device model, operating system, app version, app-instance identifier, and coarse location (country/region) Google derives from your IP address. This measures how the app is used, not who you are: we don't join it to your designs, flights, or profile, and we don't use it for advertising.
We do not collect government ID numbers, financial account numbers, or any special category data (health, biometric, genetic, religious, political, or similar) as defined by GDPR Art. 9, and we ask that you not include any in free-text fields like bug reports or notes.
Why we process it, and our legal basis
| Purpose | Data used | Legal basis |
|---|---|---|
| Creating and running your account | Email, password | Contract (Art. 6(1)(b)) |
| Storing your designs, logs, and records | Content you create | Contract (Art. 6(1)(b)) |
| Optional profile fields | Certifications, club, birth date, city | Consent (Art. 6(1)(a)) — editable/removable any time in Settings |
| Weather lookups for a flight record | Launch coordinates | Contract (Art. 6(1)(b)) |
| Processing a subscription purchase | Purchase confirmation | Contract (Art. 6(1)(b)) |
| Security, abuse prevention, rate limiting | Account ID, usage patterns | Legitimate interest (Art. 6(1)(f)) |
| Understanding how the app is used | Screen views, app events, device/app info, app-instance ID | Legitimate interest (Art. 6(1)(f)) — you can object at any time, see "Your rights" |
| Improving kit/motor data from de-identified aggregated usage | Aggregated, ownerId-stripped data | Legitimate interest (Art. 6(1)(f)) |
| Reviewing bug reports or beta applications | Report/application content | Legitimate interest / pre-contractual steps (Art. 6(1)(f)/(b)) |
| Complying with a valid legal request | Whatever the request specifies | Legal obligation (Art. 6(1)(c)) |
How your information is shared
We don't sell your data. We share it only with:
- Service providers acting on our behalf: Google Firebase (Authentication, Firestore, Cloud Storage, and Google Analytics for Firebase) hosts your account and app data and measures app usage; Resend sends transactional email (verification codes, beta invitations); RevenueCat, Apple, Google, and Stripe process subscription purchases and payments; Open-Meteo receives the coordinates you enter for a flight record to return weather data, but not your account identity; ThrustCurve.org supplies public motor-performance data — we send it a motor lookup, never your personal data.
- Other users, only for content you choose to make visible. If you submit a kit correction or a design tagged to a community kit, the corrected specification is shown to other users; your account identity is not. Display names are pseudonymous by design.
- Legal disclosures, if required to comply with a subpoena, court order, or similar valid legal process, or to protect the rights, property, or safety of our users or the public.
None of these recipients may use your data for their own marketing purposes.
International users
Our infrastructure (Google Firebase / Google Cloud) runs on U.S.-based servers. If you're located outside the U.S. — most non-U.S. users today are in Australia and New Zealand, with occasional EU/UK visitors — your data is transferred to and processed in the United States. Google is certified under the EU-U.S. Data Privacy Framework and offers Standard Contractual Clauses for Firebase customers, which is the safeguard we rely on for any EU/UK transfer.
Data retention and deletion
- Account and content data (designs, logs, inventory, flight records): kept while your account is active. Deleting your account (Settings → Delete My Account, or emailing support@rocketdesignlab.com) removes your Firestore data, uploaded files, and authentication record.
- Computer-transfer feature uploads: automatically deleted 14 days after upload, whether or not downloaded.
- Bug reports and community kit-data corrections: kept indefinitely as shared records that may still be relevant to other users, and are not automatically deleted when you delete your account. To have a specific report tied to your identity removed, email support@rocketdesignlab.com and we'll handle it manually.
- Usage analytics: Google retains the user-level analytics records for our project for a limited window — no longer than 14 months — after which only aggregate counts that don't identify anyone remain.
- De-identified, aggregated statistics (e.g. typical apogee for a given kit/motor combination) don't identify you and may be retained indefinitely.
Your rights
If you're in the EU or UK, GDPR gives you the right to access the personal data we hold about you; rectify inaccurate or incomplete data (most profile fields are also directly editable in Settings); erase your data ("right to be forgotten"); restrict how we process it in certain circumstances; port it to another service in a structured format; object to processing based on legitimate interest, including profiling; withdraw consent at any time for anything processed on a consent basis, without affecting processing that already happened; and lodge a complaint with your local data protection supervisory authority.
These rights aren't exclusive to EU/UK users — anyone can email support@rocketdesignlab.com to make any of these requests, and we'll respond within 30 days.
Cookies and similar technology
We use no advertising cookies and no tracking pixels anywhere, and the marketing pages on rocketdesignlab.com set no cookies of their own.
Signing in stores a session token in your browser (via Firebase Authentication) to keep you signed in, including for the file-transfer feature. That storage is strictly necessary for a service you asked for and doesn't require consent under GDPR's cookie rules (ePrivacy Directive Art. 5(3) necessity exemption).
The app itself uses Google Analytics for Firebase to measure which screens get used. In the web app at rocketdesignlab.com/app/ and rocketdesignlab.com/beta/ that writes Google Analytics cookies to your browser; the mobile app sets no cookies and uses an app-instance identifier instead. You can block cookies for this site in your browser, and you can object to this processing at any time by emailing support@rocketdesignlab.com.
Data security
Data is encrypted in transit (HTTPS/TLS). Database access is restricted by per-user security rules — no other user's account can read or write your data.
Children's privacy
Our service isn't directed at children, and we don't knowingly collect data from anyone under 16 (or the lower age of digital consent set by your country's law, which under GDPR can be as young as 13). If we learn we've collected data from a child below the applicable age without a parent or guardian's consent, we'll delete it.
Changes to this policy
If we change what we collect or how we use it, we'll update this page and the date at the top.
Contact us
Questions about this policy or your data? Email us at support@rocketdesignlab.com.