WIZARD-OPS: Security and Data Facts

Updated 7 November 2026. Map · About and privacy · Credits and licenses

What it is	Free map software for flight planning and training that runs in your browser. No account. Privately run. Not for navigation.
Slow links	On a slow connection it turns off its heaviest layers (radar, cameras, background terrain) and says so.
Hosting	Static files only: no server code, no database. All code is served from wizard-ops.com.
Transport	TLS 1.2 and 1.3 only; HTTP redirects to HTTPS; HSTS with subdomains. Mozilla Observatory A+ (130).
Scripts	`script-src 'self'`: no inline script, no eval, no WebAssembly, no WebSocket.
Your data	Kept in your browser (not encrypted) and in files you save. Opened files are read locally, never uploaded. No cookies seen in testing.
What outside services see	Your network address and the map area viewed. Weather, search (including the load-page starting point), cameras, traffic and nav-point lookups send a position or the text typed, only when used.
Open source	Open-source parts and their licenses: credits.

Outside hosts. Maps: services.arcgisonline.com, tiles.arcgis.com, wayback.maptiles.arcgis.com, fly.maptiles.arcgis.com, basemap.nationalmap.gov, imagery.nationalmap.gov, tiles.maps.eox.at, gibs.earthdata.nasa.gov, s3.amazonaws.com, tile.openstreetmap.org, tile.opentopomap.org, wmts.geo.admin.ch, nwy-tiles-api.prod.newaydata.com, api.tiles.openaip.net, tilecache.rainviewer.com, tiles.openfreemap.org. Data: services1.arcgis.com, services6.arcgis.com, api.core.openaip.net, api.rainviewer.com, mesonet.agron.iastate.edu, api.weather.gov, api.open-meteo.com, historical-forecast-api.open-meteo.com, api.met.no, geocode.arcgis.com, photon.komoot.io, nominatim.openstreetmap.org, overpass-api.de, overpass.private.coffee, overpass.kumi.systems, api.windy.com, cwwp2.dot.ca.gov, wzmedia.dot.ca.gov. Only when opened: globe.airplanes.live, globe.adsb.fi, globe.adsbexchange.com, www.google.com, tile.googleapis.com.