GTLA AirWatch — Privacy Policy

The website

This policy also covers the GTLA AirWatch website, gtla.live: what the site collects when you visit, what it keeps, and which other companies are involved. In short, there are no accounts to sign up for, and we don’t sell information about you. The sections above are about the text-message program only.

Google Analytics

We use Google Analytics 4 (measurement ID G-WCW5WYMST1) to see which pages and features people use. It loads on every page and sets Google’s own cookies on this site (named _ga and _ga_WCW5WYMST1) so it can tell a returning browser from a new one. Along with your IP address and basic details about your browser, device, screen and language, the site tells Google Analytics:

• which pages you open, including the full web address, and the page that sent you here;
• whether you are using the site in a browser tab or as the installed app, and the label on the link that brought you (for example, a Telegram or notification link);
• what you do with alerts: opening the alerts screen, turning notifications on or off, which kinds of alerts you pick, what your browser answered when asked for permission, which neighborhood alerts you add or remove (by the neighborhood’s name), and when the button to get a neighborhood’s alerts on Telegram is shown to you or tapped (with the neighborhood’s name only on that neighborhood’s own page, whose address already includes it), and when you follow a story or stop following one, on its page or on My alerts (the event itself doesn’t name the story, but on a story’s own page the page address does);
• when the site offers to install as an app, and what you choose;
• whether you save or remove a neighborhood, return within a day, week or month, open a share preview, or complete or cancel the browser’s share action. These events do not include your saved list or exact reading times. The page address is still part of Google Analytics;
• which TV channel or radio station you play, and taps on a few buttons and links; Google Analytics also notes the address of any link you follow from our pages to another website.

We never send Google Analytics your name, email address or phone number, or the position from “Use my location”. Google may use your IP address to estimate a rough location, such as your city, for our reports. To stop Google Analytics, block cookies for this site, use a content blocker, or install Google’s opt-out add-on.

Our own page counter

Each page you open also sends our server the page’s path (the part of the address before any “?”) and the link label that brought you, if there was one. The server adds them to daily totals, which it keeps for 28 days. The counter does not record your IP address, your browser or anything else about you.

Cookies

• Google Analytics’ cookies, described above.
• gtla_home: when you open one of the site’s pages — the map, a neighborhood page or the incident desk, for example — this remembers for 90 days that you have been here before, so going straight to gtla.live later takes you to the live map instead of the welcome page. It holds only the word “map”.
• gtla_region: if you choose Los Angeles or San Diego on the live map, this remembers your choice for a year, so the map, and the picture shown while it loads, open on that area next time. It holds only “la” or “sd”: which area, never your location.
• A sign-in cookie used only by the site’s own editors.
• Companies whose maps or players load on a page (listed below) may set their own cookies under their own policies — YouTube, for example, when a YouTube player loads.

Saved in your browser

The site also keeps small notes in your browser’s own storage. They stay on your device, and clearing this site’s data in your browser removes them. They include:

• display and player settings: 2D or 3D view, map style, your last TV channel and radio station, volume and mute;
• if you choose one on the live map, which area it opens on, Los Angeles or San Diego (gtla.region). It holds only “la” or “sd”: which area, never your location;
• whether you have seen the tour and the welcome screen, and which prompts (install, alerts, performance tips) you have dismissed or snoozed, and when;
• a copy of your notification choices and neighborhoods, so the switches show the right state (the record that counts is on our server — see below);
• the neighborhood pages you keep coming back to — up to 24, with a visit count and the time of your last visit — so the site can offer to keep your neighborhood on your home screen, and can offer that neighborhood’s alerts on Telegram on My alerts. This list is never sent to us. If you tap that Telegram button, the one neighborhood on it goes to Telegram in the button’s link, and reaches us only if you then press Start in our bot;
• when you last sent an eyewitness report from a page, so the form waits ten minutes before asking again;
• up to eight neighborhoods you explicitly save, and reading times for up to 24 neighborhood pages, to show a summary since your last visit. These lists stay on your device. Removing a saved neighborhood does not change your notification subscriptions;
• a session code from Google’s map service, so the map does not have to ask Google for a new one on every visit;
• for up to half an hour after Google’s map fails to load, a note so the map opens on its backup instead (on a computer), or on Google’s flat map when only the 3D view failed;
• for the open tab only: a random code used to count how many people are watching an incident page, and which incident pages you have already opened.

The site’s service worker also keeps copies of the map software, the aircraft models and some pictures in your browser’s cache, so the map opens faster next time.

Alerts on your phone or computer

If you turn on notifications — from the bell on the map, a neighborhood page, the Follow button on a story’s page, or My alerts — your browser sets up a push subscription with its own push service (Apple, Google, Mozilla or Microsoft, depending on your browser) and gives our server:

• the subscription’s address and two encryption keys. The address is a long, random web link at the push service; with the keys, it lets us send notifications to that browser and nothing else;
• what you asked for: breaking news on or off, every news-helicopter launch on or off, up to eight neighborhoods by name, and up to twelve stories you chose to follow — for each, only the story’s public ID (the one in its web address). Following a story never turns on breaking news or launches;
• the date you turned them on;
• if the subscription has no neighborhoods and follows no story, your browser’s user-agent (the line of text that names your browser and device), shortened. It is deleted as soon as you add a neighborhood or follow a story, so your browser details are never stored next to a neighborhood or a story.

When our coverage of a story ends, we take it off your list, and send you one last notification when we can. We also take it off if the story is removed or made private. Your subscription itself stays, with the alerts you chose for it.

We don’t ask for your name, email address, phone number or location for this. Each alert travels through your browser’s push service, which delivers it. So that one event doesn’t buzz you twice, our server also keeps a note of when your subscription was last sent a neighborhood alert — but not which neighborhood. The note stops counting after half an hour, and it is removed the next time any neighborhood alert goes out after that.

You can stop following a story on its page or on My alerts, and change your alerts or neighborhoods there at any time. Turning notifications off from the bell deletes your subscription from our server. If you block notifications in your browser settings, or remove the app, the push service tells us the subscription has stopped working the next time we send, and we delete it then.

Who’s Hovering? — neighborhood alerts on Telegram

You can also get one neighborhood’s alerts as Telegram messages from Who’s Hovering?, a bot that does only this. It is a separate bot from the account that posts on our public Telegram channel. Nothing goes on its list until you open the bot, press Start and pick a neighborhood, from the link on a neighborhood page or by sending the bot its name. The list, on our server, then keeps:

• your chat’s ID: the number Telegram gives your chat with the bot, which is also your Telegram account’s number;
• the one neighborhood you picked, by name (picking another replaces it);
• when you picked it.

That is all the list keeps. Telegram sends the bot your name, and your username and language if you have them, with every message you send it; we don’t keep them, and the bot never asks for your phone number or your location. We read what you send only to work out which command or neighborhood you mean, and we don’t keep that either. If you follow a neighborhood, /now (or any message that isn’t a command or another neighborhood’s name) gets back the short summary of the sky over that neighborhood that its page on gtla.live shows at that moment; nothing more is kept for it. To stop anyone flooding the bot, the server’s memory holds your chat’s ID with the times of your latest messages to it, which is forgotten when the server restarts. So that one event doesn’t message you twice, our server also keeps a note of your chat’s ID and when it was last sent an alert — but not which neighborhood. The note stops counting after half an hour, and it is removed the next time any neighborhood alert goes out after that. Our logs count the bot’s messages; they never record your chat’s ID or what you wrote to the bot.

Send /stop to the bot at any time and it deletes your chat, your neighborhood and that note straight away (a copy can remain in a backup for up to five days, as “Hosting and server logs” explains). If you block the bot, or your Telegram account is deleted, we delete them as soon as Telegram tells us. The alerts arrive in your Telegram app like any other message and stay in the chat until you delete them; between 10 pm and 7 am Los Angeles time they arrive silently. Telegram carries and stores them under the Telegram Privacy Policy, and chats with a bot are not end-to-end encrypted.

“Use my location”

Your browser always asks before the site can see where you are, and you can say no and still use the site. On the live map the question can come as soon as the map opens, because the map tries to show the name of the place you are in. The /here page, which shows what is flying over you, asks as soon as it opens. So does each aircraft’s own page, whose address is /here/ followed by the aircraft’s registration. That page shows the aircraft whether or not you say yes; your position is used to say how far away the aircraft is and to put you on its small map. The only aircraft pages that don’t ask are those of aircraft we no longer expect to record.

• Some things use your position only inside your browser, and it is not sent to us: working out which aircraft are closest to you and how far away an aircraft is, putting you on the small map on the /here page and on each aircraft’s page (more on that map below), adding your nearest neighborhood on My alerts (only the neighborhood’s name is saved), starting the map tour near you, and, if you have not chosen an area, opening the live map on San Diego when you are there. That last one happens only if your browser already lets the site see your location; it never asks you for it. Two things can send your position, or the edges of the map around it, out of your browser. They are next.
• The first is the place-name label on the live map. To turn your position into a name such as “Redondo Beach”, your browser sends your coordinates to our server, and our server asks Mapbox, a mapping company, for the name of that spot. Mapbox gets the coordinates from our server, not from your browser, rounded to about 100 metres. Our server files the answer in its memory under your position rounded to about 100 metres, and re-uses it for up to a day so it does not have to ask again. The answer stays in the server’s memory until the server next restarts. It is not written to disk and is not linked to you.
• The second is asking the map to show the area around you, by tapping the place-name label or through “Who’s hovering?”. The map moves so that you are in the middle of the screen, and your browser loads map pictures of that area from the map companies listed below. What else happens depends on which view the live map is in. In the flat Map view, that is all: our server is sent nothing. The live map starts in that view unless you have switched it to Earth, and on a phone it starts there every time. That map already shows the street names, and the map asks our server for landmarks only once it is less than about 10 km above the ground, which is closer than this move takes it. In the Earth view (the photo-realistic 3D map that the EARTH button switches to), the map also asks our server for the street names there, which sends our server the edges of the area on your screen (see the next section), rounded out to a fixed grid of map squares about 4 km across. Because that area is around you, those edges show where you are to within about 2 km. That is for any one request: two requests from different views, taken together, can narrow it further. If our server doesn’t already have that part of the map, it fetches it from public Overpass servers, which hand out OpenStreetMap’s map data. They get only the square of map being filled in, from our server, and nothing about you. In either view, zooming in closer afterwards, or switching to the 2D view (the map seen from straight above, much closer in), asks our server for the landmarks too, with the edges of the area on your screen, rounded the same way. Switching to the 2D view also sends our server the spot it centres on, which is where you are unless you have picked an aircraft, or every news helicopter we are tracking (at least two) is close together, and our server asks Mapbox for the nearest address and landmark there (see the next section).
• The small map on the /here page and on each aircraft’s page shows an aircraft, its recent path and a “You” dot where you are: on /here, the aircraft nearest to you, and on an aircraft’s page, that aircraft, whenever our live feed has a fresh position for it. The map picture itself comes from Mapbox and shows only the aircraft and its path; your browser draws the “You” dot on top of it, so your position is not sent to us or to Mapbox. If you are within about 40 km of the aircraft, the picture is zoomed out far enough to show you too, so its zoom, which our server and Mapbox see, says roughly how far you are from the aircraft. One picture doesn’t say in which direction. But the page asks for a new picture as the aircraft moves, so while the map is showing this happens every few seconds, and a run of pictures taken together can narrow down where you are.

The part of the map you are looking at

When you zoom in on the live map, it asks our server for the landmarks — schools, parks, hospitals and the like — in the area on your screen, once the map is less than about 10 km above the ground. In the Earth view it also asks for the street names, from a little higher up (under about 15 km); the flat Map view doesn’t need them, because that map already shows them. Either way it sends our server the edges of that area, rounded out to a fixed grid of map squares about 4 km across. If our server doesn’t already have that part of the map, it fetches it from public Overpass servers, which hand out OpenStreetMap’s map data, and saves it for everyone to re-use. Those servers get only the square of map being filled in, from our server, and nothing about you.

When you switch the live map to its 2D view, the map sends our server the spot in the middle of the screen, and our server asks Mapbox for the nearest address and landmark there. Mapbox gets that spot rounded to about 100 metres. Opening an aircraft’s details does the same with the aircraft’s position, to name the neighborhood it is over. Our server keeps those answers in its memory the same way as the place-name label above: re-used for up to a day, and gone when the server next restarts.

Eyewitness reports

The “On the ground?” box on neighborhood pages lets you tell us what you can see or hear. A report keeps:

• the neighborhood and the time;
• your answers to its questions (can you see it, what is it doing, what can you hear, anything else);
• anything you type in the optional note, up to 500 characters;
• what the page was showing you when you sent it — its alert level, how many aircraft, and which ones — so we can tell a first-hand report from the page being repeated back to us;
• a scrambled code made from your IP address, the date and a secret, which lets us limit how many reports come from one connection in a day. Your IP address itself is not stored.

Reports go only to the GTLA desk. They are never published automatically, and the note is never shown on the public site. Reports may be used editorially, carry no expectation of privacy, and are unpaid. If a report ever informs coverage it is credited only as “a reader in that neighborhood” — never anything narrower. Reports older than 90 days are deleted automatically. After you send one, the site tells you how many reports have come from that neighborhood in the last hour — a number, never anyone’s details.

Counting who is looking

A few features count people without identifying them. Some incident pages show how many people are watching: your browser makes up a random code for that tab, sends it every 15 seconds or so while the page is open, and forgets it when the tab closes. The neighborhoods page lists first the areas people are looking at right now; to count them, our server scrambles your IP address and browser details together with a secret that is thrown away whenever the server restarts, and holds the result in memory for about two minutes. To spot breaking news as it happens, we also count how many people are looking at each neighborhood page by scrambled network address (the first part of your IP address, scrambled with that same throwaway secret and held in memory for about two minutes), and we watch how often the live map is opened. Every time, only the totals are saved: just counts, no names or anything personal.

Hosting and server logs

The site runs on a server rented from Fly.io, in Los Angeles, and Fly.io’s network carries every request to it. As with any website, each request your browser makes includes your IP address and its user-agent. Our own server logs record what the site is doing — errors, alerts sent, whether the data feeds are working — and we don’t use them to track visitors. One exception: if someone repeatedly fails to sign in to the site’s editor tools, the log records that IP address when it is locked out. When a 3D model is requested, the server also checks which site is asking and what kind of program it is, to turn away other websites and download tools; that check is not recorded.

The site’s script, style, 3D map and aircraft model files — the fonts and map software below included — load from static.gtla.live, which Cloudflare carries and caches on their way from our server. When your browser fetches those files, Cloudflare receives your IP address, your browser details and the page that asked for them (browsers normally send just “gtla.live”, not the full page address). A file Cloudflare already holds is sent without reaching our server, so the 3D model check above runs only when it does not. Cloudflare handles what it receives under the Cloudflare Privacy Policy.

What our server saves — the push subscriptions, the Telegram neighborhood list, eyewitness reports, page counts and other records this page says our server keeps — is stored on a disk attached to it. (What this page says stays in your browser, or only in the server’s memory, is not.) The disk is backed up every day and each backup is kept for five days, so something we delete can remain in a backup for up to five days.

Maps, video and audio from other companies

Some of what you see is loaded by your browser straight from other companies. They receive your IP address and browser details and, for maps, which part of the map you are looking at. Each has its own privacy policy.

• Google Maps, through Google Maps Platform: Google’s street map and its photorealistic 3D view. Google handles what it receives under the Google Privacy Policy, and using Google Maps here is also covered by Google’s own terms (see our terms).
• Cesium ion: a backup map for computers (satellite imagery from Microsoft’s Bing Maps, the shape of the ground and 3D buildings), which loads only when Google’s map fails, and part of the map credits.
• CARTO and, as a backup, OpenStreetMap: the dark street map and its labels.
• Mapbox: the flat map pictures — the map of Los Angeles shown while the live map loads (or of San Diego, when that is the area the map opens on), the map on each neighborhood page, and the small map on the /here page and on each aircraft’s page. Your browser asks our server for the picture, and our server sends your browser on to Mapbox to fetch it. So Mapbox receives your IP address, your browser details and the name of this website (browsers normally send just “gtla.live”, not the full page address), along with what the picture shows. That is never your own position: on /here and the aircraft pages, your browser draws the “You” dot itself (see “Use my location”). Mapbox handles what it receives under the Mapbox Privacy Policy.
• Video and audio: when a TV, radio or replay video player loads, your browser connects to the service that streams it — YouTube, or the station’s own video or audio provider. Live TV and radio normally wait until you press play. The exception is a big breaking story: we can set the live map to open a TV station’s live coverage by itself. While that is on, opening the live map on a computer, or on any screen at least 1,024 pixels wide, starts that station’s player without you pressing play, so your browser connects to YouTube or the station’s provider straight away, and YouTube may set its cookies.

Search text stays on your device while you type. When you submit a street address with Search or “Look up address”, we send that address and city through our server to Mapbox for a temporary match. We do not put address search text in the page URL, GTLA analytics or application logs, and do not save the match on our server. Its map target stays only in this tab’s memory, without putting the address or its coordinates in browser history or storage. Restoring an address view expires after 30 minutes and does not survive a reload. Nearby neighborhood links use public area centers. Place names and addresses from Mapbox work the other way round: our server, not your browser, asks Mapbox for those (see “Use my location” and “The part of the map you are looking at”). Aircraft positions come from volunteer ADS-B networks and the OpenSky Network; our server fetches them, and your browser never contacts those networks. The server also gathers other public information — emergency incident feeds, news and public social posts — and uses AI services to help write alerts from it; none of that includes anything you give this site. The site’s fonts and its map software come from our own server.

Telegram, X and Bluesky

We post alerts publicly on Telegram, X and Bluesky. Following, joining or replying happens on those services, under their own privacy policies; there, we see only what they show any account holder, such as follower counts and what you post publicly. Messaging Who’s Hovering?, our neighborhood-alerts bot, is different: see “Who’s Hovering?” above. If you ask about a helicopter in a public post on X or Bluesky, or mention us, we may read that post and reply to it publicly, and we keep a record of recent posts we have considered or answered.

Your choices

• Say no to location, notifications or cookies. None of them is needed to use the site.
• Change or turn off alerts on My alerts or from the bell on the map.
• Send /stop to Who’s Hovering?, our neighborhood-alerts bot on Telegram, to take your chat and neighborhood off our list.
• Clear this site’s data in your browser to remove everything it saved on your device.
• Block Google Analytics with a content blocker or Google’s opt-out add-on.
• Email us about anything we hold. Because the site has no accounts and doesn’t know who you are, we usually can’t tell which stored record is yours, but we will help where we can.

“Do Not Track” and tracking across websites

Some browsers can send websites a “Do Not Track” signal. This site does not respond to it: the site works the same way, and loads the same services, whether or not your browser sends one. Other companies whose services run on this site — for example Google, through Google Analytics, Google Maps and YouTube players, and Mapbox, through its map pictures — may collect information about what you do online over time and across different websites, including this one. What they do with it is covered by their own privacy policies.

Children

GTLA AirWatch is for a general audience and is not aimed at children under 13. We don’t knowingly collect personal information from children. If you think a child has sent us something — in an eyewitness note, for example — email us and we will delete it.

Changes to this policy

When what the site collects changes, we update this page and the date at the top.