flightroute.me Privacy Policy

Effective date: October 9, 2026 Last updated: October 9, 2026

1. Who we are

flightroute.me is a flight board for airline non-revenue (standby and staff) travelers. The service is operated independently. We can be reached by email only (see Section 18).

In this policy, "flightroute.me," "we," "us," and "our" mean the operator named above. "You" means anyone who uses the service.

This policy covers:

• the landing site at https://flightroute.me,
• the web app at https://app.flightroute.me, and
• the iOS app "flightroute.me" (together, the "Service").

For privacy questions or requests, email privacy@flightroute.me. For anything else, email support@flightroute.me.

2. The short version

• We collect what we need to run your account and the Service: your email, password (stored securely), your saved plans, favorite airports, and any profile info you choose to add.
• We do not sell your personal information.
• We do not show ads, and we do not use third-party analytics or tracking tools.
• We only use your location if you ask us to find your nearest airport, and we do not store it (see Section 3.4).
• Apple handles iOS payments and Stripe handles web payments. We never see or store your card number.
• You can ask us to access, correct, or delete your data, and you can delete your account by emailing privacy@flightroute.me or, where available, in the app (see Section 12).

3. Information we collect

3.1 Information you give us

• Account information. Your email address and password when you create an account. Passwords are stored only as a salted bcrypt hash, never in plain text. If you choose Continue with Google or Continue with Apple, we receive your email address and an account identifier from that provider; we do not receive your Google or Apple password.
• Profile information. Information you choose to add to your profile: your name, a contact email, a phone number, the airlines you work for, airlines you want hidden from your boards, and your display preferences. All profile fields are optional.
• Saved plans. Trip plans you build, including the flights you select, their order, and any notes you add (where notes are available).
• Favorite airports. Airports you mark as favorites, where this feature is available. These sync between the web app and the iOS app when you are signed in.
• Feedback and bug reports. If you send feedback or a bug report (by email to support@flightroute.me), we receive what you write and anything you choose to attach, such as a screenshot. Please avoid including sensitive information in screenshots.
• Communications. If you email us, we receive your message and email address.

3.2 Information collected automatically

• Session and security cookies. When you sign in, we set a session cookie (marked HttpOnly and Secure) that keeps you signed in for up to 30 days. Sign-in and password pages also set a short-lived CSRF cookie (up to 2 hours) to protect against cross-site request forgery, and Google or Apple sign-in uses short-lived cookies (10 minutes) to complete the sign-in safely. These cookies are strictly necessary for the Service to work. The website and web app also keep your preferences (such as light or dark mode, sort order, and plans made while signed out) in your browser's local storage, which stays on your device. We do not use advertising or tracking cookies.
• Server logs. Our servers and network provider may record requests, including IP address, user agent (browser/device type), the page or API endpoint requested, and the time of the request. The app server itself keeps only limited operational logs (such as errors and service events). We use these logs for security, troubleshooting, and operating the Service.
• Sign-in and usage records. We record when you last signed in and which sign-in methods your account uses. We count which routes are searched, keeping the IP address of the most recent search for each route, and we keep usage counts of flight data lookups by plan level. We use these records for security, abuse prevention, rate limiting, and operations.
• Error reports. Where available, the apps send us automatic error reports when something goes wrong. These include the app (web or iOS), app version and build, the page or screen path, the error message, and the response status. They do not include your email address, passwords, cookies, or what you typed.

3.3 Information from others

• Apple. If you subscribe through the iOS app, Apple processes the payment and the app sends us Apple's signed transaction so we can verify it. We store only your plan level, that it was bought through Apple, and when it expires. We do not store Apple transaction IDs, and we do not receive your card number.
• Stripe. If you subscribe on the website, Stripe processes your card payment. We send Stripe your email address and flightroute.me account ID so it can link the payment to your account, and Stripe tells us about your subscription. We store your Stripe customer ID, Stripe subscription ID, plan level, and the end of the current billing period. We do not receive or store your card number.

3.4 Location

The Service uses your location only when you ask it to find your nearest airport (for example, with a "use my location" button), to fill in the origin airport. The iOS app asks for "while using the app" location permission, and the website asks through your browser. Your device sends your coordinates to our server, which matches them to the nearest airport and does not store them.

On the website, if your browser cannot provide a location (but you have not denied permission), our server may instead estimate your approximate city from your IP address. To do that, it sends your IP address to a third-party IP geolocation service (ip-api.com, or ipapi.co as a backup). The result is held only in our server's memory for up to 24 hours and is not saved to your account. If you deny location permission, we do not use your location at all.

3.5 Flight data

Flight information shown in the Service (commercial passenger and cargo flights, connections, gates, and status) comes from third-party flight data providers. This is information about flights, not about you.

4. How we use information

We use information to:

• create and manage your account and keep you signed in;
• let you build, save, sync, and share trip plans and favorite airports;
• provide subscription features and check which plan you are on;
• respond to feedback, bug reports, and support requests;
• send password reset emails and, when needed, other service notices about your account, subscription, or changes to our terms and policies (we do not send marketing email);
• secure the Service, prevent abuse, fraud, scraping, and API misuse, and enforce our Terms;
• monitor uptime, troubleshoot problems, and improve the Service; and
• comply with legal obligations.

We do not use your information for advertising, and we do not sell it or share it for cross-context behavioral advertising.

5. Legal bases (EEA/UK users)

If you are in the European Economic Area or the UK, we rely on these legal bases:

• Contract — to provide the Service you signed up for (account, plans, favorites, subscriptions).
• Legitimate interests — to keep the Service secure, prevent abuse, fix bugs, and improve the Service.
• Consent — where you choose to send optional content such as a screenshot with a bug report, or your device location when you ask us to find your nearest airport. You can withdraw consent at any time.
• Legal obligation — where we must keep or disclose information by law.

6. Share links

You can create a read-only share link for a plan. Anyone who has the link can view the shared plan — they do not need an account. Shared plans never include your name, email, or account details. Only share links with people you trust, and don't put sensitive information in notes you share.

There are two kinds of share link, depending on the version of the app you use:

• Server share links point to a read-only page on our server that shows the plan's flights with live status and, only if you turn it on, the plan's note. You can turn sharing off at any time, which stops the existing link from working right away.
• Self-contained links (used by some versions of the web app) carry the plan's flights inside the link itself, without a note. We do not keep a copy, so these links cannot be switched off; to stop sharing, stop passing the link along.

7. Calendar export

Where calendar export is available, you can add a plan to your calendar through a private calendar (.ics) link that our server generates from your saved plan. Your calendar app downloads the plan's flights from that link and may check it again for updates. Anyone with the link can see those flights, and you can turn the link off at any time, which stops it from working. We never see your calendar or anything else in it.

8. Maps

• Web: maps in the web app are provided by Apple Maps (MapKit JS) and/or CARTO map tiles based on OpenStreetMap data, depending on the version. When a map loads, your browser connects directly to Apple or CARTO, which may receive information such as your IP address and the map area being viewed, under their own privacy policies.
• iOS: the iOS app uses your device's built-in map.

9. How we share information

We share information only as described here:

• Service providers (processors). We use providers that process data on our behalf, including:
• Cloudflare — network, security, and content delivery; traffic to the Service passes through Cloudflare.
• Slack — where automatic error reporting is available, short error alerts (app, version, page path, and error message, with no account information) are delivered to the operator's Slack workspace.
• A third-party uptime monitoring service — checks that the Service is online by visiting public pages. It does not receive your personal information.
• IP geolocation services (ip-api.com and ipapi.co) — receive your IP address only in the website fallback described in Section 3.4, to estimate your nearest airport.
• Zoho Mail — password reset and service emails are sent from a flightroute.me address through Zoho Mail, and emails you send us are received through it.
• Apple and Stripe — payments and subscriptions (Apple for iOS in-app purchases, Stripe for website purchases).
• Third-party flight data providers. To look up flights, our server sends flight queries (such as airport codes, flight numbers, dates, and time windows) to third-party flight data providers. The requests come from our server, not your device, and we do not send them your account information, email address, or IP address.
• People you share with. Anyone with a share link you create can view that plan.
• Legal and safety. We may disclose information if required by law, or to protect the rights, safety, or security of users, the public, or the Service.
• Business changes. If the Service is transferred, sold, or merged, information may be transferred as part of that transaction, subject to this policy.

Administrator access. The operator and authorized administrators can see user lists, last sign-in times, sign-in methods, subscription status, and usage records to run and secure the Service.

We do not sell personal information.

10. Hosting and international transfers

The Service is hosted on a server operated by the owner in Arizona, USA, behind Cloudflare. If you use the Service from outside the United States, your information is transferred to and processed in the United States. Some providers (such as Cloudflare, Slack, Zoho, Stripe, and Apple) may also process data in other countries. Where required, we rely on appropriate safeguards for such transfers, such as the Standard Contractual Clauses or Data Privacy Framework commitments those providers offer.

11. Data retention

We keep information only as long as needed:

• Account, profile, plans, and favorites: while your account is active. Deleted within 30 days after you delete your account or ask us to delete it, except as noted below.
• Server logs: up to 30 days, then deleted.
• Sign-in and usage records: your last sign-in time is kept with your account and deleted with it. The IP address stored with route search counts is replaced by the next search of that route and removed within 90 days. Flight-lookup usage counts are not tied to your account and are kept for up to 90 days.
• Feedback, bug reports, and error reports: support emails are kept for up to 2 years to track and fix issues, or deleted sooner on request. Automatic error reports are kept only in server memory (the most recent 200) and are cleared when the server restarts; error alerts in Slack are kept for up to 1 year.
• Subscription records: as long as needed for billing, tax, and legal purposes (generally up to 7 years). Apple and Stripe keep their own payment records under their policies.
• Backups: we make nightly backups, keeping daily copies for 14 days and weekly copies for 8 weeks. Deleted data may remain in backups until they roll off, within 8 weeks.
• Flight data cache: we cache flight data on our servers. Cached flight records that haven't changed for 6 days are trimmed down to the basics — flight number, airline, times, and aircraft type. This cache is about flights, not about you.

We may keep information longer if required by law or to resolve disputes or enforce our Terms.

12. Deleting your account and data

You can delete your account by emailing privacy@flightroute.me from the email address on your account; we will delete it within 30 days. Where available, you can also delete your account yourself in the app. Deleting your account removes your account, sign-in methods, profile, saved plans, favorite airports, and share and calendar links (which stop working), subject to the retention notes above.

Deleting your account does not cancel an App Store subscription. To stop being billed for a subscription bought in the iOS app, cancel it in your Apple ID settings (see Section 13). Deleting your account does cancel a website (Stripe) subscription, so it will not renew.

You can also ask us to delete your data by emailing privacy@flightroute.me.

13. Subscriptions and payments

flightroute.me offers Free, Basic, Plus, and Pro plans. You can subscribe in two ways:

• In the iOS app, through Apple In-App Purchase. Apple processes the payment, and Apple's privacy policy applies to information Apple collects.
• On the website, through Stripe. Stripe processes your card payment, and Stripe's privacy policy applies to information Stripe collects.

We never see or store your card number. Subscriptions renew automatically unless canceled. Cancel App Store subscriptions in your Apple ID settings (on iPhone: Settings > [your name] > Subscriptions), and website subscriptions in your account settings on the website.

14. Your rights and choices

Depending on where you live, you may have the right to:

• access the personal information we hold about you;
• correct inaccurate information;
• delete your information;
• receive a copy of your information in a portable format;
• object to or restrict certain processing;
• withdraw consent where we rely on consent; and
• opt out of the sale or sharing of personal information — we do not sell or share personal information for targeted advertising.

California residents: California law gives you rights to know, delete, correct, and opt out of the sale or sharing of personal information, and to limit use of sensitive personal information. We do not sell or share personal information, and we do not use sensitive personal information for purposes that require a right to limit. We will not discriminate against you for using your rights.

EEA/UK residents: you may also complain to your local data protection authority.

To make a request, email privacy@flightroute.me. We may need to verify your identity before acting on a request, and we will respond within the time required by law. You may use an authorized agent where the law allows.

Other choices: you can edit your profile, plans, and favorites in the app; turn off sharing on any plan; and choose not to attach screenshots to bug reports.

15. Security

We use reasonable measures to protect your information, including encrypted connections (HTTPS), HttpOnly and Secure session cookies, CSRF protection, Cloudflare network protection, bcrypt password hashing, hashed one-time password reset tokens, sign-in rate limiting, encryption of stored service credentials, administrator-only access controls, and backups readable only by the operator. No system is perfectly secure, so we cannot guarantee absolute security. Please use a strong, unique password and keep it private.

16. Children

The Service is only for people 18 and older, everywhere. It is not directed to anyone under 18, and we do not knowingly collect personal information from anyone under 18. If you believe someone under 18 has given us personal information, email privacy@flightroute.me and we will delete it.

17. Changes to this policy

We may update this policy from time to time. We will post the updated version with a new "Last updated" date, and for significant changes we will give notice in the app and/or by email. Continued use of the Service after changes take effect means you accept the updated policy.

18. Contact us

Questions or requests about privacy:

flightroute.me is operated independently. We can be contacted by email only:

• Privacy questions and requests: privacy@flightroute.me
• Everything else: support@flightroute.me