Account data: Email address and password (hashed) when you create an account.
Profile data: Name, home airport, and travel preferences you voluntarily provide.
Travel party (optional): For the people you add to your travel party — a name or nickname, whether they are an adult or a child, a child's birth month and year, the country that issued their passport and its expiry date. We use these to price flights and hotels for the right ages and to check visa requirements and passport validity. We do not ask for passport numbers or full dates of birth. You can edit or remove the people at any time, and they are deleted together with your account.
Usage data: Search queries and destinations viewed.
Technical data: IP address and browser type collected automatically by hosting infrastructure.
3. Why We Process Your Data
Purpose
Legal basis (GDPR)
Providing and personalising the service
Contract (Art. 6(1)(b))
Transactional emails
Contract (Art. 6(1)(b))
Improving the AI and service
Legitimate interest (Art. 6(1)(f))
Legal obligations
Legal obligation (Art. 6(1)(c))
4. Data Processors
Supabase — authentication and database (EU/EEA)
Vercel — hosting
Anthropic (Claude AI) — AI recommendations
Resend — transactional email
KAYAK — flight search. With each search we send the search details (airports, dates, number and age groups of travellers) and, as KAYAK requires for fraud prevention, your browser's user agent and IP address. We do not send your name, email or account data.
We do not sell your personal data to any third party.
5. Data Retention
Account and profile data: retained until you delete your account.
Search history: last 20 searches, older entries deleted automatically.
After deletion: all personal data permanently removed within 30 days.
6. Your Rights (GDPR)
Access — request a copy of your data
Rectification — correct data via profile settings
Erasure — delete account via Settings → Delete account
Portability — receive data in machine-readable format
Objection — object to processing based on legitimate interest
You may also lodge a complaint with the Finnish Data Protection Ombudsman (tietosuoja.fi).
7. Cookies and Analytics
Necessary cookies (always active): sign-in, session, language preference, and a random session identifier for flight searches (taival_ktid), which KAYAK requires to tell users' searches apart. It contains no personal data and expires when you close the browser. These are required for the app to function and are exempt from consent under ePrivacy Directive (Recital 66).
Analytics (opt-in, requires your consent):
Vercel Analytics — anonymous page views and country-level statistics. No personal identifiers.
PostHog (EU-hosted server) — product analytics: search queries, feature clicks, mood selections. Signed-in users are internally identified by their Supabase user ID for cohort analysis. Anonymous users are tracked with a random ID stored in your browser.
Vercel Speed Insights — anonymous performance metrics (Core Web Vitals) to help us optimize page speed.
Both analytics tools help us improve the product. We do not run advertising, cross-site tracking, or share this data with third parties.
You can withdraw or change your consent at any time:
Currently: Analytics disabled
8. Security
We protect your data with HTTPS, hashed passwords (bcrypt), and row-level database security. No online transmission is 100% secure.
9. Changes
We may update this policy. Significant changes will be notified by email or in-app. The date at the top shows the latest revision.