PRIVACY POLICY

Privacy at FlyScout

Effective 11 September 2026. FlyScout AI (“FlyScout”, “we”) runs the FlyScout flight-discovery app and the website flyscoutai.com. This page explains what we collect, why we collect it, how long we keep it and how you can remove it. It covers the mobile app, the website and the price alerts. We never sell your personal data and we never sell airline tickets.

What we collect

• Account details. Your e-mail address, a hashed password, the hash of the six-digit verification code (the code itself is never stored), when you verified it, and an access token for every device you sign in from.
• Preferences. Home airports, budget ceiling, trip length, currency, quiet hours and the specific alerts you asked for, plus the routes you save.
• Alert delivery. Push tokens for the devices you registered and a delivery log so the same deal is never sent twice.
• Purchases. Your PRO pass record: PayPal order id, amount, currency, status and validity window. We never receive your card or bank details — PayPal handles the payment.
• Affiliate clicks. When you open a booking link we record the partner, the placement, an anonymous session id, campaign parameters and, when a creator referred you, the attribution row. This is how we measure whether FlyScout works and how creators are credited.
• Technical data. IP address and user agent in server logs and sessions for security, fraud prevention and rate limiting, plus product events such as deal revealed. Events never contain your precise location.

We do not collect precise location, contacts, photos, health data or other special-category data, and we do not read files on your device.

Why we use it

• Provide the service: rank fares for your budget and show honest price history.
• Send the alerts you asked for, at the speed of your plan — free alerts are delayed, PRO alerts go out immediately.
• Take payment for PRO, prove your entitlement and process refunds.
• Measure affiliate performance and credit creators.
• Keep the service secure, prevent abuse, rate-limit and debug faults.
• Meet accounting and tax obligations.

Legal bases

Where the GDPR or a similar law applies, we rely on performance of a contract (running your account and delivering alerts), legitimate interests (security, fraud prevention, measuring performance), your consent (push notifications and optional analytics) and legal obligation (accounting records). You can withdraw consent at any time by switching notifications off or writing to us.

Who we share it with

We do not sell personal data. We share the minimum necessary with the providers that run the service:

• Hetzner Online GmbH (Germany) — servers, database and backups.
• PayPal — processing PRO payments and refunds.
• Travelpayouts and partner networks — the booking link you choose to open, so the fare and any booking are attributed correctly.
• Google Play (and Apple, if you install on iOS) — app distribution and push delivery.
• Google Maps — map tiles, only when you open the map screen on Android.
• Wikimedia Commons and Pexels — source imagery only; we serve our own copies, so no visitor data is sent to them.

E-mail is delivered by our own mail server. We may disclose data where the law requires it or where it is necessary to protect our rights and our users.

How long we keep it

• Account and preferences: while your account exists, then deleted within 30 days of a verified deletion request.
• Verification codes: 15 minutes, and never in readable form.
• Push tokens: until you sign out or the device stops using the app.
• Purchase and tax records: as long as accounting law requires (up to 10 years).
• Affiliate click and analytics rows: 24 months, then anonymised or deleted.
• Server logs: 30 days. Encrypted backups: up to 30 days.

Your choices and rights

You can ask for a copy, correction, restriction, deletion or a portable export of your data, and you can object to processing based on legitimate interests. Turn off push in the app at any time. Send requests to babacic52@outlook.com; we reply within 30 days. You may also complain to your data-protection authority — in Serbia, the Commissioner for Information of Public Importance and Personal Data Protection.

Delete your account

The request channel is flyscoutai.com/account-deletion: send the request from the address you registered with (or e-mail babacic52@outlook.com), and we remove your account, saved routes, alert preferences, push tokens, subscription record and referral row within 30 days. Anonymised click rows are retained for affiliate reconciliation and cannot be linked back to you, and an in-app delete control is on the release checklist.

Children

FlyScout is not intended for children under 16. If we learn that we hold a child’s personal data we delete it and close the account.

Where we process data

Our servers and database are in Germany (EEA). Some providers listed above may process data in other countries using standard contractual clauses or an equivalent legal safeguard.

Security

Traffic is encrypted with TLS, passwords and verification codes are stored only as hashes, API access is token-based and secrets stay on the server. If a breach ever affects your data, we notify you and the competent authority as the law requires.

Changes to this policy

We update this page when the service or the law changes and always adjust the effective date above. Material changes are announced in the app or by e-mail before they take effect.

Contact

Questions about this policy: babacic52@outlook.com. Our support page is /support, and the rules for using FlyScout are in the terms of use.