From 4dfae6ad86a09f3a632e944d9790e058a3ce9baf Mon Sep 17 00:00:00 2001
From: Pietro Bonaldo <pietro.bogre@gmail.com>
Date: Wed, 8 Oct 2025 20:35:11 +0200
Subject: [PATCH 1/4] Add ENABLE_EXTERNAL_APIS env var, allowing opt-out of
 external apis

---
 Dockerfile                |  1 +
 client/api.ts             |  3 ++-
 client/pages/New.tsx      | 14 ++++++++++----
 server/environment.py     |  1 +
 server/main.py            |  7 ++++++-
 server/routers/flights.py |  3 +++
 6 files changed, 23 insertions(+), 6 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index 90bdca5..988a57c 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -31,6 +31,7 @@ ENV APP_PATH=/app
 ENV DATA_PATH=/data 
 ENV JETLOG_PORT=3000
 ENV TOKEN_DURATION=7
+ENV ENABLE_EXTERNAL_APIS=true
 ENV USE_IPV6=false
 
 RUN mkdir -p ${APP_PATH}
diff --git a/client/api.ts b/client/api.ts
index e3a8612..460556d 100644
--- a/client/api.ts
+++ b/client/api.ts
@@ -2,9 +2,10 @@ import axios, {Axios} from 'axios';
 import TokenStorage from './storage/tokenStorage';
 
 const config = await fetch('./config').then((response) => response.json())
-                                      .catch(() => ({ BASE_URL: '/' }));
+                                      .catch(() => ({ BASE_URL: '/', ENABLE_EXTERNAL_APIS: true }));
 
 export const BASE_URL = config.BASE_URL == '/' ? '' : config.BASE_URL;
+export const ENABLE_EXTERNAL_APIS = config.ENABLE_EXTERNAL_APIS;
 
 // TODO improve this because there's a lot of repetition (get, post, delete are pretty much exactly the same)
 // perhaps one method for each endpoint? i.e. API.getFlights(), ...
diff --git a/client/pages/New.tsx b/client/pages/New.tsx
index fc2665c..69c5e3c 100644
--- a/client/pages/New.tsx
+++ b/client/pages/New.tsx
@@ -3,7 +3,7 @@ import { useNavigate } from 'react-router-dom';
 
 import { Heading, Label, Button, Input, Select, TextArea } from '../components/Elements';
 import SearchInput from '../components/SearchInput'
-import API from '../api';
+import API, { ENABLE_EXTERNAL_APIS } from '../api';
 import { objectFromForm } from '../utils';
 import { Airline, Airport, User } from '../models';
 import ConfigStorage from '../storage/configStorage';
@@ -151,6 +151,10 @@ export default function New() {
     };
 
     const attemptFetchFlight = async () => {
+        if (!ENABLE_EXTERNAL_APIS) {
+            return;
+        }
+
         API.getRemote(`https://api.adsbdb.com/v0/callsign/${flightNumber}`)
         .then(async (data: Object) => {
             const originICAO = data["response"]["flightroute"]["origin"]["icao_code"];
@@ -246,9 +250,11 @@ export default function New() {
                                     onChange={(e) => setFlightNumber(e.target.value)}
                                 />
                             </div>
-                            <div className="h-10 flex items-center">
-                                <Button text="Fetch" onClick={attemptFetchFlight} disabled={!flightNumber} />
-                            </div>
+                            { ENABLE_EXTERNAL_APIS && 
+                                <div className="h-10 flex items-center">
+                                    <Button text="Fetch" onClick={attemptFetchFlight} disabled={!flightNumber} />
+                                </div>
+                            }
                         </div>
                         <div>
                             <Label text="Connection" />
diff --git a/server/environment.py b/server/environment.py
index 4235ce1..3783df0 100644
--- a/server/environment.py
+++ b/server/environment.py
@@ -23,3 +23,4 @@ def _get_environment_variable(key: str, cast_int: bool = False, required: bool =
 SECRET_KEY = _get_environment_variable("SECRET_KEY")
 AUTH_HEADER = _get_environment_variable("AUTH_HEADER", required=False)
 TOKEN_DURATION = _get_environment_variable("TOKEN_DURATION", cast_int=True)
+ENABLE_EXTERNAL_APIS = bool(_get_environment_variable("ENABLE_EXTERNAL_APIS"))
diff --git a/server/main.py b/server/main.py
index 2c03ca9..45c16eb 100644
--- a/server/main.py
+++ b/server/main.py
@@ -1,5 +1,6 @@
 from server.routers import flights, airports, airlines, statistics, geography, importing, exporting
 from server.auth import users, auth
+from server.environment import ENABLE_EXTERNAL_APIS
 from fastapi import FastAPI, Depends, Request
 from fastapi.responses import HTMLResponse, JSONResponse
 from fastapi.staticfiles import StaticFiles
@@ -34,7 +35,11 @@
 
 @app.get("/config")
 async def get_config(request: Request):
-    return JSONResponse({"BASE_URL": request.scope.get("root_path", "/")})
+    config = {
+            "BASE_URL": request.scope.get("root_path", "/"),
+            "ENABLE_EXTERNAL_APIS": ENABLE_EXTERNAL_APIS
+    }
+    return JSONResponse(config)
 
 @app.get("/", include_in_schema=False)
 @app.get("/new", include_in_schema=False)
diff --git a/server/routers/flights.py b/server/routers/flights.py
index 4487eca..ebaded8 100644
--- a/server/routers/flights.py
+++ b/server/routers/flights.py
@@ -1,4 +1,5 @@
 from server.database import database
+from server.environment import ENABLE_EXTERNAL_APIS
 from server.models import AirlineModel, AirportModel, ClassType, CustomModel, FlightModel, AircraftSide, FlightPurpose, SeatType, User
 from server.auth.users import get_current_user
 
@@ -363,6 +364,8 @@ async def compute_connections(user: User = Depends(get_current_user)) -> dict:
 
 @router.post("/airlines_from_callsigns", status_code=200)
 async def fetch_airlines_from_callsigns(user: User = Depends(get_current_user)) -> dict:
+    if not ENABLE_EXTERNAL_APIS:
+        raise HTTPException(status_code=400, detail="This endpoint relies on the use of an external API, which you have opted out of.")
     import requests
 
     res = database.execute_read_query("""SELECT flight_number, COUNT(*)

From dae0dd2add7618c4ac19412037fe3e3c5a76b06a Mon Sep 17 00:00:00 2001
From: Pietro Bonaldo <pietro.bogre@gmail.com>
Date: Wed, 8 Oct 2025 20:38:29 +0200
Subject: [PATCH 2/4] Add privacy notice to README

---
 README.md | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/README.md b/README.md
index c174faf..1588dc8 100644
--- a/README.md
+++ b/README.md
@@ -15,6 +15,7 @@ A self-hostable personal flight tracker and viewer
 - [Features](#features)
 - [Getting Started](#getting-started)
 - [Importing & Exporting](#importing--exporting)
+- [Privacy Notice](#privacy-notice)
 - [Contributing](#contributing)
 - [Stack](#stack)
 - [Acknowledgements](#acknowledgements)
@@ -61,6 +62,14 @@ you can also export to CSV, iCal
 
 For details on how to import your data, have a look at the [importing wiki](https://github.com/pbogre/jetlog/wiki/Importing)
 
+## Privacy Notice
+
+Jetlog itself does not collect any user data outside of your own setup. However,
+it relies on external APIs ([adsbdb](https://www.adsbdb.com/)) for some features
+such as automatic flight fetching from the flight number. Since you cannot always
+be sure of how external APIs use your data, you may wish to opt out of these by setting
+the `ENABLE_EXTERNAL_APIS` environment variable to `false`.
+
 ## Contributing
 
 If you would like to contribute to this project by opening an issue or a pull request, 

From 10fa493e99707e0d77d79266eec0d0f4639046b8 Mon Sep 17 00:00:00 2001
From: Pietro Bonaldo <pietro.bogre@gmail.com>
Date: Wed, 8 Oct 2025 20:46:34 +0200
Subject: [PATCH 3/4] Fix parsing ENABLE_EXTERNAL_APIS env var

---
 server/environment.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/server/environment.py b/server/environment.py
index 3783df0..788d747 100644
--- a/server/environment.py
+++ b/server/environment.py
@@ -1,7 +1,7 @@
 import os
 import sys
 
-def _get_environment_variable(key: str, cast_int: bool = False, required: bool = True) -> str|int|None:
+def _get_environment_variable(key: str, cast_int: bool = False, cast_str: bool = False, required: bool = True) -> str|int|None:
     value = os.environ.get(key)
 
     if not value:
@@ -23,4 +23,4 @@ def _get_environment_variable(key: str, cast_int: bool = False, required: bool =
 SECRET_KEY = _get_environment_variable("SECRET_KEY")
 AUTH_HEADER = _get_environment_variable("AUTH_HEADER", required=False)
 TOKEN_DURATION = _get_environment_variable("TOKEN_DURATION", cast_int=True)
-ENABLE_EXTERNAL_APIS = bool(_get_environment_variable("ENABLE_EXTERNAL_APIS"))
+ENABLE_EXTERNAL_APIS = str(_get_environment_variable("ENABLE_EXTERNAL_APIS")).lower() == "true"

From 420612a72754e4ad63326410459a1047360398c7 Mon Sep 17 00:00:00 2001
From: Pietro Bonaldo <pietro.bogre@gmail.com>
Date: Wed, 8 Oct 2025 20:50:24 +0200
Subject: [PATCH 4/4] Hide incompatible endpoints depending on
 ENABLE_EXTERNAL_APIS

---
 client/pages/Settings.tsx | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/client/pages/Settings.tsx b/client/pages/Settings.tsx
index 57f39ff..da874ab 100644
--- a/client/pages/Settings.tsx
+++ b/client/pages/Settings.tsx
@@ -1,7 +1,7 @@
 import React, { useState, useEffect } from 'react';
 import { useNavigate } from 'react-router-dom';
 
-import API from '../api';
+import API, { ENABLE_EXTERNAL_APIS } from '../api';
 import { Heading, Label, Input, Checkbox, Subheading, Button, Dialog, Select } from '../components/Elements'
 import ConfigStorage, { ConfigInterface } from '../storage/configStorage';
 import { User } from '../models';
@@ -255,10 +255,12 @@ export default function Settings() {
                     <Button text="Run" disabled={disableJobs} onClick={computeConnections} />
                 </div>
 
-                <div className="flex justify-between">
-                    <Label text="Fetch missing airlines" />
-                    <Button text="Run" disabled={disableJobs} onClick={fetchAirlinesFromCallsigns} />
-                </div>
+                { ENABLE_EXTERNAL_APIS && 
+                    <div className="flex justify-between">
+                        <Label text="Fetch missing airlines" />
+                        <Button text="Run" disabled={disableJobs} onClick={fetchAirlinesFromCallsigns} />
+                    </div>
+                }
             </div>