1. Who We Are
flymatch.app is operated by an individual based in Italy (the "Operator", "we", "us"), acting as the data controller for the personal data described in this Policy.
The Service is offered to users worldwide. You can contact us for any privacy-related question or request at [email protected].
2. What Data We Collect
a) Data you provide if you create an account
The Service can be used without creating an account. If you choose to sign in (currently via Google), we collect and store:
- Your name and profile picture, as provided by the sign-in provider;
- Your email address, as provided by the sign-in provider;
- The username you choose, which other users can see and search for;
- The information you add to your profile, if you choose to: your friends and friend requests, and the countries you mark as visited or as places you would like to visit;
- Your email preferences (which emails you agree to receive);
- The airport(s) you set as your preferred departure airport(s).
We use this data to save your preferences and to run the account features. Other users can only see your username; your friends can also see your name, profile picture, preferred airports and the countries on your profile.
b) Data from using the Service without an account
If you use the Service without signing in, your search inputs (such as airports, dates, and filter preferences) are used to generate your results in real time. Anonymous usage statistics, described below, are also recorded: they are not linked to you.
c) Data collected automatically
We use Google Analytics to understand how visitors use the Service (such as pages visited, general location, device and browser type, and approximate usage patterns). Google Analytics may use cookies or similar technologies for this purpose. See Section 6 for more on cookies.
We also measure the use of the Service ourselves, with aggregated first-party statistics: the actions taken (for example a search and its departure airports, a destination opened or a click to book), the language, the country (provided by our CDN, Cloudflare) and the type of device. To count visits and visitors, your browser keeps two random identifiers (see the Cookie Policy). If you are signed in, we only record the days on which your account is active, to count active users: what you do on the Service is not linked to your account. We do not store your IP address. For security, we also keep a log of administrative actions and of refused attempts to access the administration area.
3. How We Use Your Data
We use the data described above to:
- Operate and provide the Service, including saving your preferences if you have an account;
- Improve and understand usage of the Service through aggregated analytics;
- Send you emails about your account and your activity on the Service (such as a welcome email and friend requests); you can turn off friend request emails in your profile;
- Maintain the security and proper functioning of the Service.
We do not sell your personal data. We will only send you newsletters or product updates if you have separately agreed to receive them, and you can unsubscribe at any time.
4. Legal Basis for Processing (EEA/UK Users)
Where the GDPR applies, we process your personal data on the following legal bases:
- Performance of a contract: To provide the account features you request when you sign in;
- Legitimate interests: To operate and secure the Service, including a log of administrative actions, and to measure its use with aggregated first-party statistics and cookieless, anonymized statistics;
- Consent: For analytics and advertising cookies, and for optional emails such as newsletters or product updates.
5. Third-Party Services
We rely on the following third-party services, which may process personal data on our behalf or as independent controllers under their own privacy policies:
- Google (Sign-In): Used to let you create an account and log in securely without a separate password;
- Google Analytics: Used to understand aggregated website usage and performance;
- Google AdSense: Used to show advertising; profiling cookies are used only with your consent;
- Hosting, database and content delivery providers: Used to run the Service and to store account data on our behalf, as data processors;
- Email delivery provider: Used to send the emails described above; it receives your email address, your name and the content of the email;
- Map providers (OpenStreetMap, OpenFreeMap): The map background is loaded from their servers, which, as with any web request, receive your IP address and browser information, without cookies;
- Flight schedule data providers: Used to retrieve publicly available flight schedule information. No personal data about you is shared with these providers; only general search parameters (such as airport codes and dates) are used to look up flight schedules when needed.
We encourage you to review Google's own privacy policy for more information on how it processes data through Sign-In and Analytics.
7. International Data Transfers
Because the Service is used by people worldwide and relies on providers that operate globally (such as Google and our hosting, email and map providers), your data may be processed in countries outside your country of residence, including outside the European Economic Area. Where required, such transfers rely on appropriate safeguards, such as the standard contractual clauses offered by these providers.
8. Data Retention
We retain account data (name, email, username, preferred airports, friends and the countries on your profile) for as long as your account is active. You can delete your account at any time from your profile, or ask us to do it: we then delete this data, together with the record of the days on which the account was active, except where we are required to retain limited information for legal or security purposes. Usage statistics and the log of administrative actions are deleted after 13 months. Search inputs used without an account are not linked to you.
9. Your Rights (GDPR & Privacy Protections)
Depending on your location (especially within the EU / EEA and UK), you have the right to:
- Access the personal data we hold about you;
- Request correction of inaccurate data;
- Request deletion of your data (Right to be forgotten);
- Object to or restrict certain processing;
- Request a copy of your data in a portable format;
- Withdraw consent at any time, where processing is based on consent;
You also have the right to lodge a complaint with a competent European Union data protection supervisory authority (in your EU/EEA country of habitual residence, place of work, or place of the alleged infringement pursuant to Article 77 of Regulation (EU) 2016/679 - GDPR).
To exercise any of these rights, contact us directly: [email protected]
10. Children's Privacy
The Service is not directed at children and is not intended for use by anyone under the age of 16. We do not knowingly collect personal data from children under this age. If you believe a child has provided us with personal data, please contact us at [email protected] so we can delete it immediately.
11. Data Security
We take reasonable technical and organizational measures to protect your personal data, but no method of transmission over the internet or method of electronic storage is completely secure. While we strive to use commercially acceptable means to protect your personal data, we cannot guarantee its absolute security.
12. Changes to This Policy
We may update this Privacy Policy from time to time. If we make material changes, we will update the "Last updated" date above. We encourage you to review this Policy periodically to stay informed about how we are protecting your data.
13. Contact Information
If you have questions, feedback, or data requests regarding this Privacy Policy, please reach out to: