Offline and online play
HAMFS offers local free flight and AI air combat. Entering a pilot name creates a local profile; it does not by itself register an online account. Local flight, prerecorded voice prompts and AI opponents do not need an account server. The iOS app includes the game resources; the Web version must first download its files from the site hosting it.
Online services are contacted when you choose multiplayer, join an invitation, or use an online account or reporting feature. Website hosting and network providers necessarily process connection information such as an IP address when delivering their services.
Data on your device
Local storage holds your pilot name, interface language, independently selected voice language, aircraft, map, departure and weather preferences, graphics, audio, control settings and blocked pilots. An invitation you create or enter is held in the current application session.
Audio prompts are bundled files, including synthesized speech. The game does not send text to a speech service, record your microphone, or use voice chat. The flight world does not require your real location. Local AI combat results are not submitted as competitive multiplayer scores.
Online account and session
Joining online play can create a guest pilot record using your display name and a generated account identifier. Existing account endpoints also support usernames and salted password hashes. Other players receive your display name and an identifier for the live room; passwords and session tokens are not shared with them.
The server uses an HttpOnly session cookie with a maximum age of 14 days. The iOS wrapper can use its native HTTP bridge and a short-lived realtime ticket; the current server ticket lifetime is 60 seconds. Signing out removes the current server session when that service is reachable.
Multiplayer state and invitations
While connected, the relay handles your room and map, selected aircraft, position, orientation, velocity, throttle, gear, flap and control-surface state, plus presence. It distributes relevant state to pilots in the same room. Disconnecting ends that live transmission; local flight can continue.
Invitation codes contain a known server-node code, map identifier and random room code. Anyone with a valid code can join that room; it is not an access-controlled private friends list. Do not post a code publicly if you only want invited pilots to join.
Chat and multiplayer safety
Chat is length-limited, filtered and relayed to pilots in your room. Local blocking hides a pilot’s messages on your device. A submitted report stores the reporting account, reported pilot name and room identifier, message text, timestamp and supplied client context for review.
Online flight statistics can include flight/crash counts, highest altitude, highest speed and time airborne. The current client submits a crash summary for an online account; a purely local pilot does not send one. Do not put real names, contact details, passwords or sensitive information in pilot names, chat or reports.
Services and transport
The current hamfs.io Web service uses the Guangzhou (CN) backend for accounts, chat and live flight traffic, with no automatic fallback to another region. Its versioned game assets are also delivered from Guangzhou. The legacy beta.hamfs.io service remains separate and uses its Hong Kong (HK) backend; its retired mainland entry is disabled. Invitation rooms remain tied to the node encoded in their code.
The current hamfs.io Web service uses HTTPS and WSS. Account requests pass through the same-origin Hong Kong frontend to Guangzhou over verified HTTPS; short-lived, single-use tickets authorize direct WSS connections to Guangzhou. Some older or custom builds can still configure unencrypted HTTP or WebSocket endpoints. Opening a credit/source link leaves the game and is subject to that site’s practices. The game includes no advertising or analytics SDK, and does not use cross-app tracking or sell personal data.
Retention and controls
You can clear local preferences with your browser or device website-data controls. Removing local data or uninstalling does not delete an existing server account, online statistics or submitted reports. Signing out is also different from deleting an account.
Expired server sessions are cleaned up. Account records, statistics and reports have no fixed automatic deletion period implemented in this version. Contact support to request access, correction or deletion and identify the relevant pilot name and server node; do not send your password. The operator may need limited identifying information to locate and verify the request.
Children and contact
Use a nickname and avoid sharing personal information. A parent or guardian can contact support for a child’s account or content. For privacy, data access/deletion, safety or support requests: andyxecm@gmail.com.
This notice describes the current application and server implementation as reviewed on October 31, 2026. Hosting-provider logs and existing server records are operated separately from device settings.