Fare Sniper
Log in Sign up

Privacy policy

What personal data Fare Sniper collects, why, how long it is kept, who else sees it, and the rights you have over it under the GDPR.

Last updated 2026-08-13

Draft - not yet reviewed by a lawyer

This page was written by the engineer who built Fare Sniper, not by a qualified lawyer, and it has not been reviewed by one. It is an honest description of how the product actually behaves, which is the part we can vouch for. It is not legal advice, and any detail still shown as A_TOKEN_LIKE_THIS is unfilled. Do not rely on this version in a dispute, and do not take money against it until the review is done. The open questions are listed in `BLOCKERS.md` in the repository.

1. Who is responsible for your data

The data controller is DATA_CONTROLLER_NAME of REGISTERED_ADDRESS. For anything about privacy write to vilius@belownil.com or use the contact form with the Privacy category. Our data protection contact is DPO_OR_CONTACT.

2. What we collect

  • Account data: your email address and a scrypt hash of your password. If you sign in with Google or Apple, the identifier that provider returns and the email address on it.
  • Service data: the routes, airports, date windows and trip lengths you ask us to watch, your wishlist, your notification preferences, the searches those produce, and the alerts we sent you.
  • Support data: your name, email, category and message when you write to us, plus the page you were on, your account if you were logged in, your browser's user agent string and the application version, because without those a bug report cannot be answered.
  • Technical data: a salted hash of your IP address used as a rate limit key, and standard server logs containing request paths, status codes and timings.
  • Billing status: which plan you are on and when it renews. Your card details are handled by the payment processor and never reach us.

3. What we never collect

  • Card numbers, bank details or any payment credential.
  • Passenger data - names, passports, dates of birth. Fare Sniper does not book, so it never needs them.
  • Advertising identifiers, cross-site trackers or analytics profiles. There are none in this product.
  • Special category data of any kind.

4. Why we are allowed to use it

  • Performing our contract with you (Article 6(1)(b)): running your account, watching your routes, sending the alerts you asked for, taking payment for a paid plan.
  • Our legitimate interests (Article 6(1)(f)): keeping the service up, preventing abuse and rate limiting, debugging what you report to us, and improving the product. We have weighed these against your rights and use the least data that works, which is why the IP address is stored as a hash.
  • Legal obligation (Article 6(1)(c)): keeping the records tax and accounting law requires.
  • Consent (Article 6(1)(a)): only where we ask for it explicitly. We do not send marketing email, and you can withdraw consent at any time without affecting what was done before.

5. How long we keep it

  • Account data: until you delete your account, then removed immediately along with your sessions, sign-ins, watches and alert history.
  • Sessions: 30 days, or until you log out.
  • Support messages: SUPPORT_MESSAGE_RETENTION, so a complaint can be traced and a recurring bug recognised.
  • Price and route history: kept as anonymous route data. It is about a route and a date, not about a person, and it is what makes the median comparison work.
  • Operational tables: the detailed price calendar for 90 days, the provider request log for 30 days, run logs for 7 days.
  • Billing records: BILLING_RECORD_RETENTION, as required by accounting law.

6. Who else sees it

  • Payment processor: takes your payment and holds your card details under its own privacy policy. We receive only the subscription status.
  • Email delivery: EMAIL_PROVIDER delivers the messages we send you.
  • Hosting: HOSTING_PROVIDER hosts the application and its database.
  • Telegram: only if you switch on Telegram alerts, and only the alert content.
  • Flight data providers: they receive the routes and dates being searched. They do not receive your identity.
  • Content delivery networks: your browser loads fonts and two scripts from Google Fonts, unpkg and the Tailwind CDN. Those services see your IP address and user agent as part of any such request. See the cookie note.

We do not sell personal data, and we never will.

7. Transfers outside the EEA

Some of the processors above may process data outside the European Economic Area. Where that happens the transfer relies on TRANSFER_SAFEGUARD - typically the European Commission's standard contractual clauses or an adequacy decision. You can ask us for details.

8. Your rights

Under the GDPR you have the right to ask for a copy of your data, to have it corrected, to have it erased, to restrict or object to how we use it, and to receive it in a portable form. Where we rely on consent, you can withdraw it.

  • Access, portability and erasure can be done yourself - the account page deletes everything, and Pro accounts can export. Anything else, write to vilius@belownil.com.
  • We answer within one month, as the GDPR requires, and will tell you if a request is genuinely complex enough to need longer.
  • There is no charge, unless a request is repetitive or excessive.
  • If you are not satisfied you can complain to a supervisory authority, in our case SUPERVISORY_AUTHORITY, or to the authority where you live.

9. Security

  • Passwords are stored as scrypt hashes with a per-user salt. Session and reset tokens are stored only as SHA-256 digests. A copy of the database is not a way into an account.
  • Cookies that carry a session are HTTP-only, same-site and, in production, secure.
  • The application sets a content security policy, denies framing and sends no referrer to other sites beyond the origin.
  • No system is perfectly secure. If you find a weakness, please tell us at vilius@belownil.com before telling anyone else.

10. Automated decisions

The ranking of trips is automated, but it makes no decision that has a legal or similarly significant effect on you. There is no profiling for advertising.

11. Children

Fare Sniper is not intended for people under 16 and we do not knowingly hold their data. If you believe a child has an account, tell us and it will be removed.

12. Changes

If this policy changes materially we will tell you by email or in the app before the change takes effect. The date at the top is the date of the current version.

Something here unclear, wrong, or about your own data? Write to us and a person answers.