Privacy notice

In short

• FlyDown only processes the data it needs in order to work: your account, your watches and, if you switch them on, notifications.
• No advertising, no profiling, no third-party analytics, no data sold to anyone. We record how FlyDown is used (pages viewed, buttons pressed) solely to improve it, without cookies and without IP addresses.
• Data is stored on a virtual server from OVHcloud in the United Kingdom, a country the European Union recognises as protecting data adequately; the website is reached through Cloudflare, which protects it and makes it fast. Fonts, maps and photos come from our own server: your browser does not contact any other services while you use FlyDown.
• From your profile you can download all your data and delete your account whenever you like.

1. Who the data controller is

The controller is Domenico Pasquale, Via Pola 18B, 75012 Bernalda (MT), Italia (VAT no. IT01391390778), who operates FlyDown. For any questions about your data, write to privacy@getflydown.com.

FlyDown has not appointed a data protection officer (DPO): it is not mandatory for a service of this size.

2. What data we process

To handle email delivery problems, we store the recipient, the sent email’s identifier, the mail server’s response code, delivery status and attempt dates. Reports returned to [email protected] are read automatically in read-only mode: their bodies and attachments are not copied into the database. Delivery failure events are kept for 90 days; the current status remains until receipt is confirmed, the problem is resolved or the account is deleted. This information is included in your data export. The purpose is to operate requested communications and prevent repeated sends to unreachable inboxes (Article 6(1)(b) GDPR).

Account

Email address, name (optional), chosen plan, date of sign-up and of last login, version and date of acceptance of the terms of use. Your password is never stored: we only keep a non-reversible hash (PBKDF2-SHA256), from which the password cannot be derived.

Use of the service

The watches you create (airports, destinations, countries, dates, budget, number of passengers, airlines, settings for visiting more cities), the destinations you exclude, your notification preferences (including your device's time zone), the deals found for your watches, the flights you choose to follow (route, dates and the reference price for alerts; they are deleted when you stop following them or after departure) and, if you ask to be notified, the paid plans you are on the waitlist for. We also record the day you last used FlyDown.

Invitation request

If you request an invitation without having an account, we only keep your email, the date and the channel you came from, so we can write to you when a place becomes available. Legal basis: your consent, which you can withdraw at any time by writing to us. We delete it after inviting you or, at the latest, after 12 months.

Emails with news and offers (only if you choose to receive them)

If you tick the box when signing up or switch on the option in your profile, we use your email address to write to you occasionally about FlyDown news and offers, for example when the new plans arrive. We keep the date of your consent. Legal basis: your consent, which you can withdraw at any time from your profile or by writing to us. If you are on the waitlist for a plan, we only write to you about that plan.

Automatic emails: address confirmation, login and password

When you sign up, we send you a welcome email with a link to confirm your address (valid for 7 days); we record the date of confirmation. If you signed up with just your email, or choose to log in without a password, we send you a login link, single-use and valid for 30 minutes. If you ask to reset your password, we send you a single-use link valid for 60 minutes. Some emails contain buttons that do something with one tap (logging in, widening a watch): they are valid for 30 days at most and can be used only once. Of all these links we only keep a non-reversible hash, which is deleted after it expires. Legal basis: performance of the service.

For the service emails we send you (flight alerts, welcome, suggestions) we keep the recipient, subject, text and delivery outcome for 90 days: it lets us check what actually went out when something doesn't arrive. After 90 days they delete themselves; if you delete your account, immediately. Legal basis: our legitimate interest in running the service and answering you.

To recover a confirmation after an error, we keep the sending request, including the address, language, template data and attempt outcomes, for up to 7 days. The request is included in your data export and deleted with your account. The queue does not store the link code in plain text.

Invite a friend

Every account has a personal link for inviting other people. If you sign up through someone's link, we save in your account who invited you, so that they can be given the extra watch provided for when you create your first watch. The person who invited you only sees how many friends have signed up through their link, never who they are. Legal basis: performance of the service. The link between the two is deleted when either account is deleted.

Telegram (only if you connect it)

If you connect the FlyDown bot on Telegram, we keep your chat identifier and the date you connected it, so we can send you alerts there and reply to you. Messages pass through Telegram (Telegram Messenger Inc.), which processes them according to its own privacy notice and may be located outside the European Union. You can disconnect it whenever you like from your profile, or by blocking the bot. Legal basis: performance of the service you asked for.

"Help" chat

If you write to Sir Flappy, the help chat, we keep your messages and our replies, the page you are writing from, the language and, if you do not have an account, the email address you leave us so we can reply. A real person answers you: the messages reach the controller on Telegram. If you do not have an account, your browser keeps a random code to find the conversation again. Legal basis: answering your request (Art. 6(1)(b) GDPR). Conversations are deleted 12 months after the last message, or immediately if you delete your account, and they are included in "Download my data".

Session

When you log in, your browser receives a technical cookie containing a session code. On the server we only keep its hash, together with the expiry date and an indication of the browser used (user agent), so you can recognise the sessions in your exported data.

Push notifications (only if you switch them on)

Your browser gives us a delivery address with its notification service and the public keys for encrypting messages. We also keep the browser type and the date of the last successful delivery.

Technical data

For each request, the web server and the service log record the IP address, date and time, requested page and browser. This data is used to protect the service from abuse and faults. Login, sign-up and password recovery attempts are counted per IP address in memory only, for a few hours, to block anyone who gets it wrong too many times, creates accounts in bulk or sends too many requests.

Usage statistics

To measure waiting time, we also retain for 90 days the time when the server receives the browser’s report of the first visible deal card for a new watch. This measurement is linked to the watch, included in your data export and deleted with the watch. It is not collected when the browser sends Global Privacy Control.

To understand what works and what does not, we record interactions with FlyDown: pages viewed, clicks on links and buttons (the name of the button, never what you type), clicks on "Book" with airline and route, and account actions (sign-up, login, watch created, edited or deleted, waiting list, notifications). For each action we store the date and time, the page, the language of the page and of the browser, the type of device (phone, computer, app), the country (two letters, for example "IT"), the channel you came from (for example "instagram") and the domain of the website that referred you here. We also note whether there was at least one gesture on the page (scrolling, tapping, using the mouse or keyboard), yes or no: it keeps automated programs that read pages from being counted as people.

For statistics we do not store IP addresses, email addresses or typed text, we do not use cookies and we do not store identifiers in your browser. To know how many people visit us, and not just how many pages are opened, we compute a code from your IP address and your browser mixed with a random number that changes every day: the code cannot be turned back into the address, the address is never stored anywhere, and tomorrow the same visitor has a different code, so we cannot follow you from one day to the next. The country is worked out by Cloudflare, which carries the website to us, from the IP address of your connection and passed to us with the request: we keep only the two letters, not the address. The arrival channel is passed from one page to the next within the links. If you are logged in, the action is linked to your account. If your browser sends the Global Privacy Control signal, we do not record interactions on the page.

The data is seen only by the controller. We show airlines at most aggregate figures (for example how many clicks on "Book" an airline has received), never data relating to an individual. Legal basis: legitimate interest in improving the service and measuring its use (Art. 6(1)(f) GDPR); you can object by writing to us. Your recorded actions are included in "Download my data".

Payments (only if you buy Plus)

If you buy Plus, payment takes place on Stripe (Stripe Payments Europe, Ltd., Ireland). Stripe receives your email address and the card details you enter and processes them under its own privacy policy (stripe.com/privacy). FlyDown does not see or store card details: it keeps only the customer and subscription identifiers at Stripe, the amounts, the dates of the paid periods and the outcomes of payments (succeeded, failed, refunded, disputed).

What we do not process

Card details (only Stripe handles them, if you buy Plus), location, contacts, sensitive data. We do not create profiles for advertising purposes and we do not make automated decisions that produce legal effects concerning you: alerts only follow the rules you set.

3. Why we process it and on what basis

Email and password are required to have an account; without them, FlyDown cannot be used. Your name is optional. Notifications are always optional and can be switched off from your profile or in your browser settings.

4. Where the data is and who sees it

• Server: a virtual private server (VPS) provided by OVHcloud in its Erith data centre, in the United Kingdom. The European Commission has adopted an adequacy decision for the United Kingdom: data there is protected as it is in the European Union, with no further safeguards needed. OVHcloud hosts the server as a processor and does not use the data for any other purpose.
• Cloudflare: the website is reached through Cloudflare, Inc. (United States), which protects it from attacks and abuse and makes it faster. As requests pass through, Cloudflare sees the IP address, browser and requested page, acting as a data processor under its own data processing agreement; the transfer is covered by the EU-US Data Privacy Framework and by the European Commission's standard contractual clauses.
• Stripe: if you buy Plus, Stripe Payments Europe, Ltd. (Ireland), with group companies also in the United States, collects the payment and runs the customer portal for card, invoices and cancellation. It receives your email and payment details. Transfers outside the European Economic Area take place with the safeguards provided by Stripe.
• Backups: every night a copy of the database is made, checked and kept for 14 days on the same server; a second copy, also kept for 14 days, is held by Oracle Cloud Infrastructure in Milan (European Union), which stores it as a data processor.
• Telegram (only if you connect the bot or write in the "Help" chat): the alerts you ask for on Telegram, and the chat messages that reach the controller, pass through Telegram Messenger Inc., which may be located outside the European Union and processes them according to its own privacy notice.
• Browser notification services (only if you switch notifications on): the message passes through your browser's service, for example Google (Chrome, Android), Apple (Safari, iPhone), Mozilla (Firefox) or Microsoft (Edge). The content travels encrypted and the service cannot read it; it only sees the delivery address. These services may be located outside the European Union: transfers take place with the safeguards provided for by the GDPR, such as the EU-US Data Privacy Framework or the European Commission's standard contractual clauses.
• Email: if you write to FlyDown, your email is handled by the controller's mailbox provider. The mailbox and the sending of automated emails (welcome and address confirmation, password links, and news and offers if you have chosen to receive them) are entrusted to Hostinger International Ltd. (Cyprus, European Union), which acts as a data processor.

Nobody else receives your data. We do not sell it or share it for advertising.

Links to airlines and FlixBus. When you tap "Book" or a bus journey, you open that company's website, which processes data according to its own privacy notice. The link only contains the route, dates and number of passengers, not your data. The "Book" button of some airlines (today Vueling) and the links to services at your destination are affiliate links: they contain a code identifying FlyDown, never you. The services at your destination carry the words "affiliate link". The partner may use its own cookies once you have opened its website; see How FlyDown makes money.

5. How long we keep it

6. Your rights

At any time you can ask to access your data, rectify it, erase it, restrict its processing, receive it in a machine-readable format (portability) and object to processing based on legitimate interest (Arts. 15–21 GDPR).

• By yourself, straight away: in your profile you will find "Download my data", which produces a file with everything FlyDown holds about you, and "Delete account".
• By email: write to privacy@getflydown.com. We reply within 30 days.
• Complaint: if you believe your data is not being processed correctly, you can contact the Garante per la protezione dei dati personali (the Italian Data Protection Authority, garanteprivacy.it) or the authority of the country where you live.

7. Security

Passwords, session codes and email links are stored only as non-reversible hashes, cookies are protected from access by scripts, repeated logins with a wrong password are blocked and notification messages travel encrypted. No system is 100% secure: in the event of a personal data breach affecting you, we will notify you as required by the GDPR.

8. Minors

FlyDown is restricted to adults. If we become aware that an account belongs to a minor, we will delete it.

9. Changes

If FlyDown changes the way it processes data, for example by adding payments or new providers, this notice will be updated before the change, with the new date at the top. Significant changes will be flagged to you in the app.