Skip to content
Maxii

Privacy Policy

Last updated: [date of publication]

Draft — highlighted details must be completed by the operator and reviewed by a lawyer before launch.

Who is responsible

The controller under the GDPR is [company name, address] (see the Imprint). Contact for privacy matters: [privacy email].

What we collect and why

  • Account data — your email address, to sign you in with a one-time link or code (or with Google, if you choose; we then receive your email address and Google account ID) and to send the alerts you asked for (Art. 6(1)(b) GDPR).
  • Your world — the countries you mark as Been or Want. Before you create an account this list is stored only in your browser; when you sign in it's saved to your account (Art. 6(1)(b)). It's never shared unless you create a share image yourself, which contains only your countries and totals.
  • Your watches (when price watching is available) — routes, travel window, trip length, cabin, stops, optional target price and your home airport. We don't collect names, dates of birth or passport details (Art. 6(1)(b)).
  • Subscription data — if you subscribe to Plus, payment is processed by Stripe. We store your Stripe customer ID and subscription status, never card details (Art. 6(1)(b), and Art. 6(1)(c) for tax records).
  • Technical data — server logs with IP address and request metadata, kept briefly for security and abuse prevention, including rate limiting (Art. 6(1)(f); our legitimate interest is operating a secure service).

Cookies

We only use cookies that are strictly necessary to keep you signed in and to complete a watch you started before signing in. Before you sign up, your map is kept in your browser's local storage so it isn't lost — only because you asked us to remember it. We don't use analytics, advertising or tracking cookies, so we don't ask for cookie consent (§ 25(2) TDDDG).

Service providers

We use processors bound by data processing agreements:

  • Supabase (database and authentication; hosted in the EU, Frankfurt)
  • Vercel (hosting)
  • Resend (sending email)
  • Stripe (payments)
  • Google (only if you choose “Continue with Google” to sign in)
  • [flight data provider, once confirmed]. We would send only route parameters — airports, dates, cabin — never your email or name.

Some providers are based in the United States. Transfers rely on the EU–US Data Privacy Framework and/or EU Standard Contractual Clauses. [verify each provider's transfer mechanism]

How long we keep data

  • Account, your world and watches: until you delete them or your account.
  • Fare observations (not personal data): up to 90 days.
  • Email delivery records: 180 days.
  • Billing records: as long as tax law requires (up to 10 years).

Your rights

You can request access, rectification, erasure, restriction, data portability, and object to processing based on legitimate interests (Art. 15–21 GDPR). You can delete your account at any time in your account settings. You also have the right to lodge a complaint with a supervisory authority, e.g. [competent state authority].