Checking the All You Can Fly session…

Privacy Policy

Last updated: 21 September 2026. Data controller: , . Requests about your data go to that address.

What we process and why

Account: email, password (stored only as a scrypt hash, which cannot be reversed), chosen language, time of registration. Purpose: running your account; performance of the contract.
Saved routes and alerts: which routes you watch, whether alerts are on, and which flights we have already told you about. Purpose: providing the service.
All You Can Fly login details (only if you enter them): your Wizz Air email and password. The password is stored encrypted (AES‑256‑GCM) with a key held on the server — it has to be recoverable so the hourly check can run while you are logged out. Anyone with access to both the server and the key could read it. You can disconnect at any time, which deletes it. Purpose: searching on your account; legal basis: your explicit choice.
Payments: Stripe gives us a customer identifier, subscription status and email. Card details are handled by Stripe alone. Purpose: performance of the contract; accounting.
Availability history: which routes and dates were queried and what came back, not linked to any user. Purpose: not asking the same question twice.
Technical records: failed sign‑in attempts (email and IP address, 15 minutes) to stop password guessing; error reports and performance data in Sentry (EU servers) without deliberate identification of people. Legal basis: legitimate interest in a secure, working service.

Cookies

We use exactly two cookies: the sign‑in session (strictly necessary) and your chosen language (functional, set by your own choice). No analytics or advertising cookies, which is why we do not ask for consent.

Who we share data with

Wizz Air — availability queries are sent to their systems, from our account or from yours if you connected it.
Stripe Payments Europe — payments.
Google (Gmail) — sending alert emails; Google sees the recipient and the content.
Functional Software (Sentry) — error reports, processed in the EU.

We do not sell data or use it for advertising.

How long we keep it

account and saved routes: until you delete the account
sign‑in sessions: 30 days from sign‑in
failed sign‑in attempts: 15 minutes
records of alerts sent: 30 days
availability history (not linked to a person): 90 days
payment records at Stripe: as long as accounting rules require

Your rights

You have the right of access, rectification, erasure, restriction, portability and objection. You can delete your account yourself, including saved routes and any All You Can Fly details, under Favourites (“Delete account”); send other requests to . You may also complain to the Czech Office for Personal Data Protection (uoou.gov.cz).

Children

The service is not intended for anyone under 16 and we do not knowingly collect their data.