Privacy Policy

Information we collect

Account information. When you sign up, we collect:

• your email address;
• your password, which is stored only as a one-way hash by our authentication provider and is never visible to us;
• account status, such as when you signed up and whether your account has been approved.

Activity on the site.While you're signed in, we record:

• the flight searches you run, including the filters you choose (airports, dates, airlines, loyalty programs, cabin, stops, points) and how many results came back;
• when you click to book, open the details of, or share a flight, along with that flight's route, date, airline, program and price.

These records are linked to your account. We don't record searches or clicks from visitors who aren't signed in.

API requests. The member API at /apiis available only to signed-in, approved members. To check access, we look up your account from your login session. We don't add API requests to your search or click history, but they appear in the technical information described below.

Technical information. Like most websites, our hosting provider automatically receives standard request data such as your IP address, browser type, the pages you request and the time of the request. It is used to deliver the site, keep it secure and fix problems.

How we use your information

• To create and secure your account, sign you in, and send emails needed to run it, such as sign-up confirmation and email-change confirmation.
• To review new accounts before granting access to member features.
• To understand which routes, programs and features people use, so we can decide what to track and improve. Only site administrators can see this activity.
• To prevent abuse, investigate problems, and enforce our Terms of Service.

We don't sell your personal information or share it for advertising.

Password safety check

When you choose a new password, we check whether it has appeared in a known data breach using the Have I Been Pwned "Pwned Passwords" service. Only the first five characters of a one-way hash of your password are sent, so neither the service nor anyone watching the request can learn your password.

Cookies

We use only the cookies needed to keep you signed in. They are set by our authentication provider and are removed when you log out. We don't use analytics, advertising or cross-site tracking cookies.

Service providers

We rely on a few providers to run the site. They process data on our behalf and only as needed to provide their service:

• Supabase: database, authentication and account emails.
• Vercel: website hosting.
• Have I Been Pwned: the password safety check described above, which receives no personal information.

We may also disclose information if required by law, to protect the rights or safety of our users or others, or as part of a transfer of the site to a new owner, who would remain bound by this policy.

Links to other sites

"Book" links take you to airline and loyalty program websites, and share buttons open social networks such as Facebook and Threads. Those sites have their own privacy policies, and we don't control what they collect once you leave The Points Chaser.

How long we keep information

We keep your account information and activity records for as long as your account exists. When your account is deleted, your profile, searches and click history are deleted with it. Our providers may keep backups and server logs for a limited period before they are overwritten.

Your choices and rights

• You can change your email address and password on your Account page.
• You can ask us for a copy of the personal information we hold about you, ask us to correct it, or ask us to delete your account and its data by emailing nampoints@gmail.com from the address on your account.

Depending on where you live, you may have additional rights under laws such as the GDPR or US state privacy laws. We will honor those requests as the law requires and won't treat you differently for making one. We aim to respond within 30 days.

Security

We use encrypted connections (HTTPS), hashed passwords, and database access rules that let each user read only their own account. Changing your password signs you out on all other devices. No system is perfectly secure, so please use a password you don't use anywhere else.

Children

The Points Chaser is not directed to children under 13, and we don't knowingly collect their personal information. If you believe a child has created an account, contact us and we will delete it.

International users

The site is operated from the United States, and our providers may process data in the United States and other countries. By using the site, you understand that your information may be processed outside the country where you live.

Changes to this policy

We may update this policy from time to time. We'll change the "Last updated" date above, and for significant changes we'll let signed-up users know by email or a notice on the site.

Contact

Questions or requests about your privacy: nampoints@gmail.com.