Privacy Policy

The Points Check. Where you want to go, which points programs you hold, a balance range for each one (we never ask for an exact balance), your home airport, your country and your email address. We keep a copy of the trips we emailed you, so we can show what you were sent.

If you start the Points Check and don't finish it, we keep only how far you got, the country and destination you picked, and how you arrived. There is no email address and nothing that identifies you.

Your consent. The exact wording you were shown at the email step, whether you agreed to follow-up email, and when.

How you arrived. The campaign tags on the link you followed (for example which ad or post) and the first page you landed on.

Abuse protection. A one-way hash of your IP address, kept with a Points Check so one computer can't use the form to send email in bulk. The hash can't be turned back into your IP address, and we don't store the address itself.

Your account, if you make one. Email address and a hashed password. We never see your password in readable form. If you sign in with Google instead, Google tells us your email address, your name and your profile picture, and nothing else. We use the email address to find your account. We never see your Google password and can't read your Gmail, contacts or anything else in your Google account.

What you put into the app. The questions you ask, the balances you choose to save, trips you save and routes you watch. Balances are numbers you type in: we never connect to your loyalty accounts and never ask for their logins.

Purchases. Payments are handled by Stripe. We store the email address you paid with, what you bought, the amount, the currency and a Stripe reference. We never see or store your card number.

Operational logs. Requests we make to our availability provider, and the usage counts we need for limits and billing.

We advertise on Meta (Facebook and Instagram). To find out whether those ads lead to finished Points Checks and purchases, our public pages use the Meta Pixel and Meta's Conversions API. The signed-in app does not.

Meta receives:

• that a public page was viewed;
• that a Points Check was finished (a “Lead” event);
• that a purchase was made, with its amount and currency (a “Purchase” event).

With those events Meta receives your IP address, your browser details and Meta's own cookie identifiers. If you chose the United States in the Points Check, we also send a one-way hash of your email address so Meta can match the event to an account; we never send the address itself. If you chose Canada, we do not send your email to Meta in any form.

Your Points Check answers, your points programs and your balance ranges are never sent to Meta. You can limit how Meta uses this information in your Facebook or Instagram ad settings, and a browser content blocker will stop the pixel loading.

• We don't sell your personal information.
• We don't share your questions or balances with other users.
• We don't run advertising trackers inside the signed-in app.
• We don't ask for, want, or store your airline or bank login details.

We use a small number of providers, each handling only what its job requires:

• Vercel: hosting and request logs.
• Supabase: database and sign-in.
• Anthropic: the model that reasons over search results. Your question and the relevant context are sent to answer it.
• Seats.aero: the award availability data behind searches and the Points Check. Nothing about you is sent to it.
• Stripe: payments and sales tax.
• Resend: sending email.
• Meta: measuring advertising, as described above.

Your Points Check results are emailed because you asked for them. After that, we send follow-up email and the weekly points deals only if you agreed to it. In Canada that means ticking the box at the email step; if you leave it unticked, the results are the only email you get. In the United States the form tells you that submitting it subscribes you.

Every one of those emails carries a one-click unsubscribe link and our mailing address, and unsubscribing takes effect immediately.

Account email (receipts, the link to something you bought, password links, and alerts you set up yourself) is sent because you use the service, and isn't affected by unsubscribing from the list.

We set these ourselves:

• your login session;
• the affiliate code, if you arrived through an affiliate link (30 days);
• the campaign tags from the first link you followed (90 days);
• a reference to your Points Check, so the page after it knows your currency (30 days);
• the key to the Playbook, if you bought it, so it opens in this browser (1 year).

On public pages, Meta sets its own cookies (_fbp, and _fbc if you arrived from an ad) for the measurement described above.

Account data is kept while your account exists. Ask us to delete your data and we will remove your account, saved balances, trips, alerts, questions and Points Check answers; records we must keep for tax and accounting (payments) are retained as required by law. Unsubscribed email addresses are kept on a suppression list so we don't mail you again by accident.

Depending on where you live, you may have the right to access, correct, export or delete your personal data, and to object to certain processing. Email us and we'll action it. You don't need to cite a regulation to make the request.

Reply to any email from us, or write to the postal address in our email footers. See also our Terms of Service.