Privacy Policy

The data controller for the personal data described in this policy is the operator of paxstats. The operator decides why and how your data is processed, and is responsible for it under the GDPR.

For anything to do with your data, including every request to exercise the rights described below, write to the operator at contact@paxstats.app. That address is monitored by the operator directly, and it is the one contact point for all data-protection requests.

Under the GDPR, each thing we do with your data rests on one of these bases:

• Performing our contract with you — your account, your logbook, the stats and maps built from it, and the emails needed to run the service (sign-in, password reset, invite codes). If you buy a paid plan, taking payment for it and providing it rests on this basis too.
• Legal obligations — keeping payment and invoice records for as long as accounting and tax law requires, if you buy a paid plan.
• Your consent — anything optional you switch on: a public profile, photos you upload, the pax-buddy and companion features, and the AI features (boarding-pass photo scan, “Ask your logbook” and the AI flyer summary, see “AI Features” below). You can withdraw consent at any time from Settings, and withdrawing it does not affect what was done before.
• Our legitimate interests — keeping the service secure and abuse-free (rate-limit records, sign-in logs), fixing errors (error monitoring, see below), and understanding aggregate use of the product. We only rely on this where your interests do not override ours.
• Notifications — emails and push notifications about your own account, flights and badges, and about your pax buddies (a buddy request, a companion tag, a buddy's new flight, a reaction or comment) rely on our legitimate interest in telling you about activity on your account. Notification emails are on when you join, and you can switch off all of them, or any one type, in Settings at any time. Push notifications also need your permission on each device before any is sent. We don't send marketing emails or marketing push notifications; if we ever do, they will be off until you turn them on.

• Account information. When you sign in with Google or Apple, we receive your name and email address (and, for Google, a profile picture) to create and identify your account. If you use Apple's "Hide My Email" option, we only ever see the private relay address Apple generates, not your real one. If you sign up with an email address and password instead, we store that email address, and your password only as a one-way hash held by our authentication provider (Supabase), never in readable form. Your Pax ID, profile settings and invite codes are stored with your account.
• Flight data. Flight details you enter or import, such as dates, routes, aircraft, airlines, and seats, and the lounges you visited. This includes upcoming flights you add before you fly them.
• Plan and payments. Your plan (Economy, Business, First or the Gold card), how much of each monthly allowance you have used, and, if you subscribe, the subscription's state: which plan, when it renews or ends, and the store it was bought through. Your card details go to Stripe or Apple and never reach us.
• Social activity. If you use paxstats' social features: the pax buddies you connect with and the requests you send or receive, the buddies you tag as companions on a flight (and the tags others add you to), comments you write and reactions you leave on flights, and reports you submit and accounts you block. Comments and reactions are visible to the people who can see that flight; reports and blocks are never shown to the person concerned.
• Photos. Flight photos and your profile picture, if you upload one. Boarding passes you scan are read once to fill in the flight for you: we keep the flight details it produced, not the image.
• Forwarded emails. If you forward a booking confirmation or boarding pass to log@paxstats.app, we read that message to prepare a draft flight for you to confirm, and use the address it was sent from to match it to your account. The boarding pass or confirmation attached to it is read by Anthropic's model, exactly like a photo scan in the app, and only if you have turned AI features on. If you haven't, nothing is sent to Anthropic and we reply to tell you so.
• Notification tokens. If you turn notifications on, we store the push token your browser or device issues so we can deliver them. It identifies that installation, not you, and it's removed when you turn notifications off or sign out.
• Usage and technical data. Basic technical information (device and browser type, page views, app interactions), collected through cookieless analytics from Vercel on the website and from PostHog (hosted in the EU) on the website and in the iOS app, used to keep the app working well and to see which features get used. It isn't linked to your account and doesn't follow you to other sites. Page addresses are recorded with flight identifiers and profile handles removed, taps are recorded without the text or link of what you tapped, and the site you arrived from is kept to its domain name. Nothing is stored on your device for this.
• IP address. Collected automatically on some requests to prevent abuse, for example to rate-limit how often the logged-out "request access" form can be submitted. Our analytics provider, PostHog, also uses it, together with your browser type, to count you as one visitor for a single day, and our host, Vercel, uses it to tell PostHog which country you're in. Only the country is kept, never a city or anything more precise, and the IP address itself is then thrown away. We don't use it to track your location or activity.

• To create and manage your account and authenticate you via Google or Apple Sign-In, or your email and password.
• To store your logbook and photos, and generate the statistics the app displays.
• To operate, maintain, secure, and improve paxstats, including detecting and preventing abuse.
• To diagnose and fix errors, using automated crash and performance monitoring.
• To send notifications about your account, your flights and your pax buddies, unless you switch them off.
• To communicate with you about your account or the service, if needed.

We do not sell your personal information, and we do not use it for advertising.

paxstats sets two cookies, both strictly necessary: a session cookie set by our authentication provider (Supabase) to keep you signed in, and, only if you choose to try the demo, a cookie that remembers you are in the demo for up to 45 minutes. Neither requires your consent under applicable law. The app also keeps some data on your own device so it opens quickly and works offline: a copy of your logbook for up to 24 hours (cleared when you sign out), your profile picture, flights you logged while offline until they are sent, and a few preferences. None of this leaves your device except to sync with your account. Our analytics are cookieless, and we don't use advertising or tracking cookies or load third-party scripts that would set them. Because there are no non- essential cookies, we don't show a cookie consent banner. Two things do still run without asking you first, and we'd rather name them than imply nothing happens: cookieless analytics — page views and taps, plus a few counts of things like opening a shared profile or trying the demo, never tied to your account — and, only when something goes wrong, an error report sent to Sentry (see “Error Monitoring” below). We do not record your screen or your session. Neither is used for advertising, neither follows you to other sites, and neither is shared with a data broker or ad network.

We don't sell your personal data, and we don't share it with third parties for their own marketing purposes. We do use a small number of service providers ("sub-processors") to operate paxstats, each of whom only receives the data needed to perform their specific function and is bound by their own confidentiality and data-protection obligations:

• Supabase: database and authentication. Your account data and logbook are stored in a Supabase project hosted in the EU (Ireland).
• Cloudflare R2: stores uploaded flight photos and your profile picture.
• Google Sign-In: authenticates your identity when you sign in with Google.
• Apple Sign-In: authenticates your identity when you sign in with Apple, on web or in the iOS app.
• Flightradar24: used when you autofill a flight, and when paxstats fetches the path and actual times a past flight really flew (for example when you open that flight or save it); we send the flight number and date to look up schedule, route, and — when available — the real flown flight path on your behalf. Flightradar24's terms require any data we retrieve from them to be deleted within 30 days, which we do automatically.
• AeroDataBox, through RapidAPI: used for published flight schedules — when you autofill a flight that hasn't flown yet, to add scheduled times to a flight, and as a fallback when Flightradar24 has no match — and for a flight's aircraft details. We send the flight number and date, or the aircraft's registration (tail number) to look up its age and flying status. Requests go through RapidAPI, the API marketplace AeroDataBox is sold on, which passes them on to AeroDataBox. Neither receives your name, email or any account identifier.
• Visual Crossing: used to show historical weather — or, for a flight today or in the next couple of weeks, the forecast — for a flight's date and airports. It receives only the airport's coordinates and the date.
• planespotters.net: supplies publicly available aircraft photos. No account data is sent to it. Aircraft photos load straight from planespotters.net, which, like any image host, sees your device's IP address and browser details when it serves one. Airline logos are stored on our own servers, so your device never contacts a third party for them.
• Anthropic: powers the optional AI features: the boarding-pass photo scan, the "Ask your logbook" question box and the AI flyer summary on your Pax ID card. Nothing is sent to Anthropic unless you have turned AI features on (see “AI Features” below). For the question box and the summary, we send the relevant flight details (dates, routes, airlines, aircraft, seats and similar entries from your logbook) with no name, email, or account identifier attached. For a scan, the boarding pass itself is sent so its details can be read back into a draft flight. The same applies to a boarding pass or booking confirmation attached to an email you forward to log@paxstats.app. Anthropic processes each request to answer it, and under their standard API terms your data isn't used to train their models. Those terms do let Anthropic keep requests for a limited period for trust and safety, and longer if one is flagged for a policy violation.
• Cloudflare Email Routing: receives mail sent to paxstats.app, including log@paxstats.app, so it handles any boarding pass or booking confirmation you forward there; it is stored with our other files in Cloudflare R2 until we have processed it.
• Apple Push Notification service and your browser's push service: deliver notifications to your device if you turn them on. They carry the notification itself, not your logbook.
• Sentry: error monitoring and crash reporting (see below). Session replay is not used.
• Cloudflare Email Service, with Resend as a backup: deliver the email paxstats sends: notification emails (such as a pax buddy request or a reaction to one of your flights) unless you've switched them off in Settings, a reply if a forward to log@paxstats.app can't be matched to an account, and an internal notice when someone submits the logged-out "request access" form. Never used for marketing, and every notification type can be turned off in Settings.
• Vercel: hosts the application, and provides the cookieless analytics and performance measurements described above.
• PostHog: cookieless product analytics on the website and in the iOS app, stored in its EU region (Frankfurt). It receives page addresses with identifiers removed, which buttons are tapped (without their text), device and browser type, the country you're in, and your IP address, which it uses only as described above and does not keep. It never receives your name, email, Pax ID or flights.
• Stripe: takes payment for a paid plan bought on the web. It receives your email address, your billing address when tax requires it, and your card details, and tells us the subscription's state. For a shop order it also takes the shipping address and phone number the order is sent to.
• Printful: prints and ships shop orders. For an order it receives the name, shipping address, email address and phone number it is sent to, and the print files made from your logbook. When you open a shop item, the artwork made from your logbook is sent to Printful to make its product photos.
• Apple and RevenueCat: a paid plan bought in the iPhone app is paid through your Apple ID. RevenueCat checks the App Store purchase for us and tells us the subscription's state; it receives your paxstats account identifier and the purchase, never your logbook.

We may also disclose information if required by law, regulation, or valid legal process.

We use Sentry to catch and diagnose bugs. When something goes wrong in the app or on our servers, an error report is sent to Sentry: the error message and the code that failed, the page or screen it happened on, your device, browser and operating system type, the app version, and a short trail of technical events leading up to it (such as pages visited, buttons tapped and network requests made). A small sample of ordinary requests also sends timing data so we can spot slow pages.

We do not use session replay: nothing records your screen, what you type, or your session. Before a report leaves the app or our servers, sign-in tokens, cookies and the contents of requests and responses are removed, and no name, email address or account identifier is attached to it. Sentry stores these reports in its EU data region (Germany).

paxstats lets you optionally make your logbook public from Settings, visible to anyone with the link, to other members in the in-app community, and to search engines. Public profiles are included in the sitemap. This is off by default. Turning it on is your choice, and you control exactly what's visible (your flight list, photos, and profile picture can each be shown or hidden independently). You can turn it back off, or delete your account entirely, at any time. Profiles that are limited to signed-in members or to accepted buddies are not indexed.

Three optional features use Anthropic's Claude model: reading a boarding pass from a photo when it has no barcode (in the app, or attached to an email you forward to log@paxstats.app), answering questions in “Ask your logbook”, and writing the one-line AI flyer summary on your Pax ID card. They are off until you agree to them. The first time you use one, paxstats asks you first, explaining what would be sent, and nothing is sent unless you choose “Allow”. One answer covers all three, and we record when you gave it.

When they are on, what is sent is only what the feature needs: for Ask your logbook and the summary, your question (if any) and the flight details in your logbook, with no name, email or account identifier attached; for a photo scan or a forwarded email, the photo you take or the attachment you forward, which can show your name, booking reference and frequent-flyer number. The summary refreshes after you log a new flight. Scanning a barcode is done on your device and never uses these features.

You can turn AI features off at any time in Settings → AI features. From then on nothing more is sent to Anthropic, and the AI summary we stored for you is deleted. If you never turn them on, paxstats works the same apart from those three features.

paxstats uses Google Sign-In solely to authenticate your identity and create your account. We only request the minimum profile information needed (name, email, profile photo) and do not use this data for any purpose beyond providing and personalizing the paxstats service.

paxstats uses Sign in with Apple solely to authenticate your identity and create your account, on both the website and the iOS app. We only request the minimum information Apple provides (name and email, shared only the first time you sign in) and do not use it for any purpose beyond providing and personalizing the paxstats service. If you choose to hide your email from us, Apple's private relay forwards mail to your real address without ever giving it to us.

Our primary database and authentication infrastructure is hosted in the EU. Some of the providers listed above are US companies, or may process data in the United States, even where the data itself is stored in the EU. For each of them, the transfer is protected as follows:

• Vercel (hosting and analytics): the EU Standard Contractual Clauses in Vercel's data processing agreement, and the EU–US Data Privacy Framework.
• PostHog (product analytics): data is stored in the EU; any access from the United States is covered by the EU Standard Contractual Clauses in PostHog's data processing agreement.
• Sentry (error monitoring): the EU Standard Contractual Clauses in Sentry's data processing agreement, and the EU–US Data Privacy Framework.
• Cloudflare (photo storage and email delivery): the EU Standard Contractual Clauses in Cloudflare's data processing agreement, and the EU–US Data Privacy Framework.
• Google and Apple (sign-in, and push notifications through Apple's service or your browser's): the EU Standard Contractual Clauses in each provider's data processing terms, and the EU–US Data Privacy Framework.
• Supabase (database and authentication, a US company, with your data stored in Ireland): the EU Standard Contractual Clauses in Supabase's data processing agreement.
• Anthropic (optional AI features): the EU Standard Contractual Clauses in Anthropic's data processing agreement.
• Resend (backup email delivery): the EU Standard Contractual Clauses in Resend's data processing agreement.
• Stripe (web payments): the EU Standard Contractual Clauses in Stripe's data processing agreement, and the EU–US Data Privacy Framework.
• RevenueCat (App Store subscriptions): the EU Standard Contractual Clauses in RevenueCat's data processing agreement.
• Printful (printing and shipping shop orders, a US company): the EU Standard Contractual Clauses in Printful's data processing agreement.
• RapidAPI (the gateway to AeroDataBox, see above): only flight numbers, dates and aircraft registrations are sent, with no name, email or account identifier, so no personal data about you is transferred.

You can ask us for more detail on any of these safeguards at the address below.

We retain your account and flight data for as long as your account is active. Accounts that are created but never finish signing up, or that never get access to paxstats, are deleted automatically after 30 days. If you delete your account from Settings, your account, logbook, and uploaded photos are permanently deleted, typically within minutes and no later than a reasonable period afterward, except where a copy must be retained longer for legal or legitimate business reasons (for example, abuse-prevention logs).

Boarding passes you scan aren't added to your logbook: the image is read once and only the flight details it produced are saved. An email you forward to log@paxstats.app is deleted as soon as we have processed it, whether or not it produced a draft flight, including one we couldn't match to an account. Anything we haven't been able to process is deleted automatically after 7 days.

Concretely, for the data that is not your logbook itself:

• Beta access requests (the email you leave on the landing page) are kept until we have actioned them and for at most 12 months after they were submitted; older requests are deleted automatically.
• Rate-limit and abuse-prevention records are deleted automatically after 35 days.
• Error reports are kept by our error-monitoring provider for 90 days.
• Payment records. The record of each change to a subscription is kept; the details that came with it, which can include your email address, are deleted after 13 months, or when you delete your account. Invoices are kept by Stripe or Apple for as long as tax law requires.
• Flight lookup log (which flight number you looked up with auto-fill, and whether it was found) is deleted automatically after 90 days.
• Push tokens for a phone whose app hasn't checked in with us for 60 days are deleted automatically.
• Draft flights from a scan, a wallet pass or a forwarded email stay in your account, including ones you dismissed, until you delete your account.
• Reports you file are deleted with your account. A report about you is kept for moderation if you delete your account, without the link to you.
• Cached third-party lookups (flight, aircraft and weather data) are shared caches that hold no personal data and are refreshed on their own schedule.

You can access, update, or delete your flight data at any time from within the app, and delete your account entirely from Settings.

Settings > Export gives you two files. The first is your logbook as a CSV: every flight with its dates, times, route, airline, aircraft, seat, lounges, award and jump-seat flags and confirmed companions, in a format you can import again. The second is one JSON file with everything else on your account: your account and profile details and settings (including your notification and AI choices), every flight with its lounges and links to its photos, the companions you tagged or were tagged by, your pax buddies, your badges, drafts waiting for review, the comments and reactions you've written on flights you can still see, the accounts you've blocked, the reports you've filed and your invite codes. Your photos are included as links to download them, not as the image files. For a copy of anything not in those files, such as comments on a flight you can no longer see, write to us at the address below.

If you're located in the EU, EEA, UK, or another jurisdiction with similar protections, you additionally have the right to:

• Access the personal data we hold about you.
• Rectify inaccurate or incomplete data.
• Erase your data ("right to be forgotten").
• Restrict or object to certain processing of your data.
• Port your data to another service in a structured, machine-readable format.
• Withdraw consent for any processing that relies on it, at any time, without affecting what was done before.
• Lodge a complaint with your local data protection supervisory authority — in France, the CNIL (cnil.fr).

paxstats makes no decisions about you by automated means that have legal or similarly significant effects.

To exercise any of these rights, or to ask a question about how your data is handled, contact us at the address below.

paxstats is not directed at children. You must be at least 16 to use it, or the age of digital consent where you live if that is lower (15 in France, 13 in the United Kingdom and the United States), and we do not knowingly collect personal information from anyone younger.

We may update this Privacy Policy from time to time. Material changes will be reflected by updating the "Last updated" date above.

If you have questions about this Privacy Policy or your data, contact us at contact@paxstats.app.