Security & Trust

Every table in paxstats' database — your flights, photos, profile, pax buddy connections — has row-level security (RLS) turned on at the database layer. In practice this means the rule "you can only see and change your own data" is enforced by Postgres itself on every single query, not by application code that could contain a bug and accidentally leak someone else's rows. A request for another user's flight log doesn't get filtered out after the fact — the database refuses to return it in the first place.

Connecting with another pax buddy requires both people to accept the request — neither side can add the other unilaterally. Tagging a buddy as a companion on a flight works the same way: it sends them an invite they have to accept or decline before anything appears on their logbook. Your profile and flight history are private by default; making a logbook public is an opt-in choice from Settings, and you separately control whether your flight list, photos, and profile picture are each visible.

paxstats sets a single strictly-necessary cookie to keep you signed in — nothing for advertising or cross-site tracking, and no ad scripts. We do use two third-party services that see your requests: Vercel's cookieless analytics, which counts page views without setting a cookie or building a profile, and Sentry for error monitoring (see below). Neither is used for advertising and neither follows you to other sites. Your IP address is only ever used to rate-limit abuse of the logged-out "request access" form, never to profile or track you. We don't sell personal data, and we don't use it for advertising, to anyone, ever.

We use Sentry to catch and fix bugs, including limited session replay to understand what happened around an error. Replay is configured to mask all text and block all media by default — it captures layout and interaction, not the literal content of your screen. We never see your flight data, photos, or account details through this tool.

paxstats doesn't run its own servers. It's built on a small number of established infrastructure providers, each of which maintains its own independent security certifications that you can verify directly:

• Supabase (database, authentication) is SOC 2 Type II and ISO 27001 certified. Our database and auth infrastructure is hosted in the EU (Ireland).
• Vercel (hosting) is SOC 2 Type II and ISO 27001 certified.
• Cloudflare (photo storage, via R2) is SOC 2 Type II and ISO 27001 certified.

The full list of providers that process data on our behalf, and exactly what each one is used for, is in the Privacy Policy.

You can export your full flight log as a CSV at any time. Deleting your account from Settings deletes your account, flight log, and photos, typically within minutes — it's not a soft delete or a deactivation.

If you believe you've found a security vulnerability in paxstats, please report it responsibly rather than disclosing it publicly. Email contact@paxstats.app with details and, if possible, steps to reproduce it. We'll acknowledge reports as quickly as we can and keep you updated as we work on a fix. This contact is also published at /.well-known/security.txt per RFC 9116, so security researchers and automated tools can find it without having to search the site.

If anything here is unclear, or you want more detail on how a specific part of paxstats works, contact us at contact@paxstats.app.