Security & Trust

Every table in paxstats' database — your flights, photos, profile, pax buddy connections — has row-level security (RLS) turned on at the database layer. In practice this means the rule "you can only see and change your own data" is enforced by Postgres itself on every single query, not by application code that could contain a bug and accidentally leak someone else's rows. A request for another user's logbook doesn't get filtered out after the fact — the database refuses to return it in the first place.

Connecting with another pax buddy requires both people to accept the request — neither side can add the other unilaterally. Tagging a buddy as a companion on a flight works the same way: it sends them an invite they have to accept or decline before anything appears on their logbook. Your profile and flight history are private by default; making a logbook public is an opt-in choice from Settings, and you separately control whether your flight list, photos, and profile picture are each visible.

paxstats sets only strictly-necessary cookies — one to keep you signed in, and one while you try the demo — nothing for advertising or cross-site tracking, and no ad scripts. We do use two third-party services that see your requests: Vercel's cookieless analytics, which counts page views without setting a cookie or building a profile, and Sentry for error monitoring (see below). Neither is used for advertising and neither follows you to other sites. Your IP address is only ever used to rate-limit abuse of requests made without an account (the "request access" and invite-code forms, the demo, and viewing shared photos while signed out), never to profile or track you. We don't sell personal data, and we don't use it for advertising, to anyone, ever.

We use Sentry to catch and fix bugs. It receives error reports only — we don't use session replay, so nothing records your screen or what you type. Sign-in tokens, cookies and request contents are stripped before a report is sent, and no name, email or account identifier is attached. We never see your flight data, photos, or account details through this tool.

paxstats doesn't run its own servers. It's built on a small number of established infrastructure providers, each of which maintains its own independent security certifications that you can verify directly:

• Supabase (database, authentication) is SOC 2 Type II and ISO 27001 certified. Our database and auth infrastructure is hosted in the EU (Ireland).
• Vercel (hosting) is SOC 2 Type II and ISO 27001 certified.
• Cloudflare (photo storage, via R2) is SOC 2 Type II and ISO 27001 certified.

The full list of providers that process data on our behalf, and exactly what each one is used for, is in the Privacy Policy.

You can export your full logbook as a CSV, and everything else on your account as one JSON file, at any time from Settings. Deleting your account from Settings deletes your account, logbook, and photos, typically within minutes — it's not a soft delete or a deactivation.

If you believe you've found a security vulnerability in paxstats, please report it responsibly rather than disclosing it publicly. Email contact@paxstats.app with details and, if possible, steps to reproduce it. We'll acknowledge reports as quickly as we can and keep you updated as we work on a fix. This contact is also published at /.well-known/security.txt per RFC 9116, so security researchers and automated tools can find it without having to search the site.

If anything here is unclear, or you want more detail on how a specific part of paxstats works, contact us at contact@paxstats.app.