Privacy

Last updated 19 October 2026

This explains what this service stores, why, and what you can do about it. It describes the software as it actually works, not as a template assumes it might.

Who is responsible

The service is operated by the company named in the contact details on the contact page. Write to that address about anything on this page and a person will answer.

If you are not satisfied with how we handle a request, you can complain to the Latvian Data State Inspectorate (Datu valsts inspekcija).

What we store

Your account: email address, username, a bcrypt hash of your password (never the password itself), your interface language, your plan, and when the plan started.

What you track: the airports, dates, trip lengths, party size, filters, alert threshold and name of each search you create.

What we sent you: the alerts we raised, and a log of emails with the recipient, subject and whether delivery succeeded.

Payments: paid plans are sold and charged by Paddle (Paddle.com), which is the Merchant of Record — the seller of the subscription, responsible for the payment, the invoice and the VAT. Your card details are typed into Paddle's checkout and go to Paddle, never to us. From Paddle we receive and keep your email address, your billing country, the plan, the amounts (price, tax and Paddle's fee), the dates, and Paddle's reference numbers for you as a customer, your subscription and each payment. Payments from the earlier test checkout show only the last four digits of a test card.

Anything you write to us through the suggestions form.

Notifications, if you switch them on: the push address your browser gives us for this device (an opaque URL and two keys), the name of the browser it came from so you can tell your devices apart, and for an "anything from my airport under €X" alert the airport, the amount and which cities we have already told you about.

Whether your email address is confirmed, and when you last changed your password (a change signs out every other session).

The waitlist, if you join one: when a paid plan is marked "coming soon" and you press "Notify me when it opens", we store your account, the plan and the date you joined, and nothing else. It is used once, to tell you that the plan has opened, and the date of that message is noted so you are not told twice. You can leave the list at any time from the plan card, the payment page or your profile, and it is deleted together with your account.

What we do not do

There are no analytics, no advertising and no tracking scripts. The pages load only our own two scripts, with one exception that you choose: when you press Pay, the page loads Paddle's checkout script from Paddle (cdn.paddle.com) to open the payment window. It is not loaded before that, and it is not loaded for anyone who does not pay.

The service sets no cookies. It keeps six things in your browser's local storage, all of them needed for the site to function: your session token, your email address for the account menu, your plan label, your theme, your language and the airport you picked for the "cheapest from" list. Nothing there is used to follow you, and clearing it simply signs you out. If you tap "Track this" on a fare before signing in, that route is held in the tab's session storage until you do, and removed the moment it is used. The same goes for "Notify me when it opens" pressed before signing in, which holds only the name of the plan.

We do not build a profile of you, sell anything about you, or use your searches for any purpose beyond running the searches.

Flight prices are not your data

When we check a route, the result is stored against the route and the date — not against you. Everyone watching Riga to Barcelona reads the same rows, which is what makes the service affordable.

Because those rows identify no one, they are kept indefinitely and they survive the deletion of your account. Deleting them would erase the history other people depend on.

Who else sees anything

To find prices we send an airport pair and dates to the airlines' own public endpoints (Ryanair, Wizz Air) and to Google Flights through Bright Data (Bright Data Ltd., Israel), with SerpApi (SerpApi LLC, USA) as the fallback. Those requests carry the route, the dates and the number of passengers. They do not carry your name, your email or any identifier for you.

The trip planner (paid plans): when you press the button, the options you chose — months, trip types, length, budget, departure airport and anything you typed in the note field — are sent to an AI model run by Groq, Inc. (USA) to write the suggestions. Your name, email and account are not sent. We do not keep the request or the answer; Groq processes them under its own terms, outside the EU. Please do not type personal details into the note.

Destination photographs come from Wikipedia. Our server fetches them and serves the image itself, so Wikimedia never learns which routes our users are looking at, and no request leaves your browser to a third party.

When you press Book you leave for the airline or booking site, and what happens there is covered by their terms and their privacy policy, not ours.

The server that runs the service and holds the data is in an OVHcloud data centre in the United Kingdom (OVH SAS, France). The UK has an EU adequacy decision for data protection.

Email is sent through Brevo (Sendinblue SAS, France), which therefore sees your address, the subject and the message. Mail you send to our address is forwarded by Cloudflare, Inc., which also runs our domain's DNS.

Brevo counts, without linking it to you, whether an email was opened and a link in it pressed, to monitor delivery; the links in our emails, including password-reset and confirmation links, pass through Brevo before reaching our site.

Push notifications travel through the push service of your browser's maker (for example Google, Mozilla or Apple). The content is encrypted for your device; the service sees only that a notification was sent.

When you pay, you deal with Paddle directly. Paddle receives what you enter in its checkout — card, email, country and, where needed, postcode — and processes it as the Merchant of Record under its own privacy notice. We pass Paddle your email address and our internal account number, so that the payment can be matched to your account.

How long we keep it

Account data stays until you delete the account, which you can do yourself from your profile at any time.

Records of payments are kept after deletion, without your name attached, because accounting law requires records of money taken to be retained. Deleting the account also cancels an active subscription at Paddle; Paddle keeps its own records of the payments under its own obligations.

Collected flight prices are kept indefinitely, as described above.

The server keeps a technical log of requests (address, time, page) for finding faults. It is rotated and overwritten within a few weeks and is not used for anything else.

What you can do

Download everything we hold about you as a file, from your profile. It is the raw data, not a summary.

Delete your account and its data, also from your profile. It asks for your password because it cannot be undone.

Correct anything that is wrong, or ask us any question about the above, by writing to the contact address.

Security

Passwords are hashed with bcrypt. Sessions use signed tokens that expire. Pages are served with a content security policy that forbids third-party scripts except Paddle's checkout, which it allows only from Paddle's own addresses. That is also why destination images are proxied rather than loaded from elsewhere.

No system is perfect. If you find a problem, please write to us before publishing it and we will fix it.