05 // privacy
what we store
- Account: email, hashed password (or OAuth provider id), display name (optional).
- Profile: home airport.
- Saved alerts: route + price threshold + notification preference.
- Search cache: origin/dest/window of every scan, anonymized after 30 days.
what we don't store
- Payment information. We never touch your card.
- Passport, frequent-flyer numbers, or any travel doc data.
- Browsing history outside our app.
- Your phone number (unless you add it for SMS alerts later).
third parties
- Firecrawl — performs the scrapes on our behalf. Sees route URLs, not user identity.
- Duffel — fallback flight data (sandbox). Sees route + date, not user identity.
- Lovable Cloud (Supabase) — our database + auth provider. Same data we list above.
- Google / Apple — only if you sign in via OAuth. They get nothing from us beyond the auth handshake.
your rights
Email hello@thirdpolararch.com to:
- Export everything we have on you (within 14 days).
- Delete your account and all associated data (within 48 hours).
- Correct anything that's wrong.
cookies
Auth session cookie only. No marketing/analytics cookies in v0.1. If we add product analytics later, it'll be self-hosted and we'll update this page first.