Privacy Policy

Information We Collect

Account Information

When you create an account, we process your email address, account identifier, authentication information and account settings. Passwords are handled by our authentication provider; FindPassengers does not receive your password in plain text.

Flight Information

We process the flight number and date you search for. Flight groups can contain the airline, route, airport codes, scheduled times, operational status, delay information and provider identifiers. Search results may come from existing FindPassengers records or from our flight-data provider after you explicitly request a provider lookup.

Flight Group Membership

We record the flight groups you join. Other visitors can see aggregate passenger counts. Members of the same group may recognise your activity through the passenger alias shown with messages, but your email address is not displayed in the flight chat.

Claim Status Information

Your individual claim status and any compensation amount you enter are private to your account. Other users receive only aggregated counts, such as how many claims were submitted, compensated or rejected. We do not use this information to determine your legal entitlement.

Messages and Attachments

Messages and files you share are available to authorised current members of the same flight group. Attachments are limited to supported image and PDF formats and are stored in private storage. Short-lived download links are issued after an access check.

Contact Information

If you use the contact form, we process your name, email address and message so the enquiry can be reviewed and answered. Contact submissions are not intended to be stored in the FindPassengers database. Until email delivery is configured, the form will not report a message as sent.

Technical and Security Information

We process limited request and security information needed to operate the service and prevent abuse. This includes request timing, authentication and session data, attachment validation records, and one-way HMAC fingerprints derived from a trusted client IP for selected rate limits. FindPassengers does not intentionally store raw IP addresses in its application rate-limit tables. Hosting and infrastructure providers may process normal connection and security logs under their own terms.

How We Use Your Information

We use information to:

• authenticate accounts and keep sessions secure;
• find, create and display flight groups;
• manage memberships, private claim statuses and aggregated claim statistics;
• deliver chat, attachment and notification functionality;
• respond to contact requests when email delivery is available;
• enforce security, upload, anti-spam and rate limits; and
• maintain, troubleshoot and protect the platform.

Information Shared With Other Passengers

Current members of a flight group can see messages, passenger aliases and shared files in that group. Public flight pages can show flight details, passenger totals and aggregated claim counts. We do not display your account email or individual claim record to other passengers through these features.

Aggregated Information

FindPassengers combines individual claim records into group-level totals. Aggregates are intended to help passengers compare experiences without revealing which individual selected a particular status. Very small groups may still make inferences possible, so do not treat aggregate statistics as guaranteed anonymity.

Service Providers

Supabase provides authentication, database, realtime and private file-storage services. AeroDataBox, accessed through API.Market, provides flight information when you explicitly request a provider lookup. Hosting infrastructure processes requests needed to serve and secure the website. If you follow a partner or affiliate link, the destination provider processes your visit under its own privacy policy.

Data Retention

We retain account and membership information while needed to provide the service. Security and rate-limit records are retained for limited operational windows and may be removed opportunistically. Flight groups and aggregate information may remain available after individual members leave. Messages and finalized attachments can remain part of a group conversation until they are deleted through available controls or are otherwise no longer needed. Exact retention periods may also depend on legal, security and backup requirements.

Account Deletion

You can permanently delete your account from the Account page after recent password authentication. Deletion removes your authentication account, email-linked account data, flight memberships, private claim records and user-specific notification data through the configured deletion process. Existing chat messages and shared attachments remain in their flight groups to preserve the conversation. Their user link is removed and the sender is shown as “Passenger deleted.” Message content, timestamps, attachment metadata and stored files are not automatically erased by account deletion.

Security

We use access controls, private storage, server-side validation, short-lived attachment links, signed flight candidates, request-origin checks and rate limits to reduce risk. No internet service can guarantee absolute security. Protect your password and avoid sharing sensitive information in flight chats or attachments unless necessary.

Cookies and Browser Storage

Supabase authentication stores session information in the browser so you can remain signed in. FindPassengers also uses a signed first-party visitor cookie for anonymous flight-group creation rate limiting; it can remain for up to one year. Essential browser and cookie storage is used for authentication, security and service operation. The current application does not implement advertising cookies or analytics tracking.

Your Privacy Rights

Depending on where you live, you may have rights to request access, correction, deletion, restriction, portability or an objection to certain processing. These rights can be subject to legal limits and the rights of other passengers. Use the Contact page to make a privacy request. We may need to verify your identity before acting on it. You may also have the right to complain to your local data-protection authority.

International Users

The service and its providers may process information in a country or region different from your own. Applicable transfer safeguards depend on the configured hosting regions and provider arrangements. Those details must be confirmed before public launch.

Changes to this Privacy Policy

We may update this policy when the service, providers or legal requirements change. The date at the top shows the latest revision. Material changes should be communicated in an appropriate way.

Contact

For privacy questions or requests, use the Contact page. The responsible operator’s legal identity and formal contact details must be added before public launch.