Privacy and Security
Understand what WingView stores, shares, and contacts on your network.
Understand what is safe to share and what WingView contacts. You can verify each network connection described here.
WingView stores your Wi-Fi password, API key, and chosen coordinates. It never displays any of them. The Wi-Fi password and API key are never shown back to you.
Screenshots and video
You can safely share screenshots and video of the web pages. They do not display your Wi-Fi network name, password, API key, or coordinates.
Each location shows its name and a link. The network page shows the first eight characters of the stored API key. This identifies the key without exposing it.
Before sharing, check these details:
Web UI passphrase. This opens the board's web pages. It appears after saving Wi-Fi details and on the status screen. Replace it through Settings → New passphrase if it appears in your recording.
Location names. A name like
KATLdoes not identify you. A street name might.
The passphrase only works for someone already on your Wi-Fi. WingView accepts connections from your local network only. It makes outbound requests and cannot be reached from the internet.
The locations page includes coordinates in the page source. They are not rendered in screenshots or recordings. Do not save the page or share its source if those coordinates are private.
The log page is designed for sharing with support. It replaces your Wi-Fi name, API key, passphrase, and coordinate-shaped values with <redacted> before displaying them.
What WingView contacts
WingView does not send telemetry, analytics, crash reports, or usage data. It makes only the connections listed here.
Flight-data requests include your API key and the selected view center, rounded to five decimal places. We use the API key to authorize the request and apply your plan. The coordinate determines which aircraft are nearby.
WingView does not know its physical location. It has no GPS. The selected location can be an airport, landmark, or another point away from your home.
Flight-data requests include no serial number or hardware identifier. Update checks and connectivity checks include neither the API key nor a coordinate. Each host can still see your public IP address, as with any request from your network.
Complete host list
customer-api.wingbits.com
Flight data
Every poll, every 2 to 30 seconds while awake. While asleep, only when a browser watches the traffic page.
Update server
Firmware checks and downloads
When you select Check for update. While asleep, once after 30 minutes, then every one to three hours.
cp.cloudflare.com and connectivitycheck.gstatic.com
Distinguishing an API outage from an internet outage
After a failed poll, at most once per minute.
Time server
Setting the clock for logs and the idle clock
At startup, then occasionally. Your router provides one when possible. The fallback is pool.ntp.org.
Your router
DHCP and DNS
At startup and occasionally afterward.
The connectivity checks use standard generate 204 endpoints. They use plain HTTP, carry no data, and return an empty response body. They let WingView report the correct failure reason.
Browser connections during map builds
Your browser builds maps because the board cannot render them. During a build, your browser fetches map tiles from api.protomaps.com and the rendering libraries it needs.
WingView receives finished images. It never contacts those map hosts.
A packet capture during map building therefore includes browser connections that do not come from WingView.
Check connections yourself (using Linux or WSL)
Find the board's address on its home page or status screen. Hold the N button to open the status screen.
Most routers show connected clients or DNS lookups. Check the board's address and compare its connections with the host list above.
You can also run a packet capture from a linux computer on the same network:
Leave the board awake for several minutes. Each connection should match a host above.
To view DNS traffic, run:
You cannot read API request contents because the connection uses HTTPS. This protects the data on your network. You can still verify connection destinations and frequency.
See the Wingbits developer documentation to compare requests with the published API.
What happens while the board sleeps
When the screen sleeps, WingView stops requesting flight data. It still checks for firmware around 30 minutes later, then every one to three hours.
Each update check is a short connection. If an update is available, the board downloads about 2 MB, installs it, and returns to sleep.
Overnight, expect a few brief update-server connections and little else. Any other persistent traffic merits investigation.
Where the time zone comes from
Your browser provides a time-zone rule to WingView. This describes clock behavior rather than your location. The time-zone data never leaves your network.
Erasing requires physical access
Each erase starts from the web page but needs confirmation on the board. Touch and hold the screen until the ring closes.
Someone with the passphrase can request an erase. Only someone physically present can complete it. Each erase level requires a different confirmation word.
Last updated
Was this helpful?