▸ Privacy Policy

This Privacy Policy describes how we collect, use, and share information when you use our website and services, including flight search and award seat alert functionalities.

Information We Collect

• Server Logs — IP address, browser type, operating system, referring URLs, pages visited, and timestamps.
• Google Analytics — Page views, traffic sources, and user behavior.
• Google OAuth — Name, email address, and profile picture when you log in with Google.
• Stripe — Payment information when you subscribe. Processed securely by Stripe. We do not store full credit card details.
• Award availability searches — Search parameters including origin, destination, travel dates, and cabin preferences.
• Amazon SES — Email address for sending award seat alert notifications.
• Conversational Data — Text of your interactions with our AI search assistant.

How We Use Your Information

• To provide and improve our website, flight search, and alert services
• To process payments and manage subscriptions
• To send award seat alert notifications you have requested
• To analyze website traffic and user behavior
• To provide customer support
• To comply with legal obligations
• For security and debugging purposes

Sharing Your Information

• Google — For analytics and OAuth authentication
• Stripe — To process your payments
• Global distribution system (GDS) provider — To check airline availability for your searches. Only search parameters are shared (origin, destination, dates, cabin, airline); never your name, email address or payment details.
• Amazon Web Services — For hosting, email delivery (SES), and infrastructure
• Service Providers — Third parties who assist with hosting, data analysis, and operations
• Legal Obligations — If required by law or to comply with legal process

Your Rights

• Access — Request the personal information we hold about you
• Rectification — Request correction of inaccurate or incomplete information
• Erasure — Request deletion of your personal information
• Restriction — Request restricted processing of your information
• Objection — Object to the processing of your information
• Data Portability — Receive your data in a structured, machine-readable format

Data Security

• Hosting — Our servers run on Amazon Web Services in the United States (us-west-2, Oregon). The website and API are served only over encrypted connections (HTTPS).
• Payments — Handled by Stripe; card details never reach our servers.
• Sign-in — Through Google; we never receive or store your Google password.
• API keys — Shown once, when issued, and stored only as a one-way hash (SHA-256), so a key cannot be recovered from our systems, even by us.

We take reasonable measures to protect your personal information from unauthorized access, use, or disclosure. However, no method of transmission over the internet or electronic storage is 100% secure.

API Members

For API and MCP members we hold your account name and email address, your plan and billing status (via Stripe), the hashed key, and a usage log of each call (its time and outcome), used for quotas, security and support. Availability and pricing responses contain no traveller personal data. Your key is revoked when your membership ends, or sooner on request.

Data Retention

We keep server logs, search history and conversations for as long as needed to operate, secure and improve the service; there is no fixed deletion schedule. You can ask us to delete your personal information at any time (see Your Rights).

Security Incidents

If we become aware of a security breach affecting your personal information or your API account, we will notify affected users and API members without undue delay, and within 72 hours of confirming it, explaining what happened, what information was involved, and what we are doing about it.

Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page.

Contact Us