Privacy policy

Last reviewed: August 4, 2026.

This privacy policy describes how The Frequent Flier collects, uses, and shares information about visitors to thefrequentflier.com. It applies to the website and to any tools or content we publish on it. It does not apply to third-party sites we link to — including airline pages and other external sites — which are governed by their own policies.

This policy works alongside our terms of use and our advertising disclosure.

Who runs this site

The Frequent Flier is an independent aviation publication. It is currently operated as an unincorporated individual project based in the United States; it is not yet a registered legal entity. If that changes, this page will be updated to identify the entity directly.

For all questions about this policy, contact hello@thefrequentflier.com.

What information we collect

We try to keep this minimal. The categories below reflect what the live site actually collects today, plus future categories we have specifically planned. The site does not currently support user accounts or public comments.

Server logs

Our backend is hosted on Heroku, a Salesforce subsidiary based in the United States. Standard web request logs are generated for each request and include your IP address, your browser's user-agent string, the path and method of the request, the response status, and the timestamp. These logs are retained per Heroku's platform defaults and are used for security, debugging, abuse prevention, and operational monitoring.

Analytics

Our frontend is hosted on Vercel, also based in the United States. We use Vercel's first-party analytics (@vercel/analytics) and speed insights (@vercel/speed-insights) to understand site traffic and performance. These tools are cookieless. They record aggregate signals such as page views, approximate country and region (derived from IP), referring URL, and anonymized Core Web Vitals. They do not assign persistent identifiers to individual visitors and do not, on their own, allow us to identify you.

We also use Google Analytics 4 (Google LLC, United States) for site traffic measurement. Unlike the Vercel tools, Google Analytics sets first-party cookies (typically _ga and _ga_<container>) that assign a pseudonymous client identifier to your browser, and it collects information including your IP address, user-agent, the pages you view, the referring URL, and engagement signals (session duration, scroll depth, outbound link clicks). Google processes that data on our behalf to produce aggregate audience and behavior reports, and may also process it for its own purposes per Google's privacy policy and the Google Analytics terms.

Information you send us

If you email hello@thefrequentflier.com, we receive whatever information you include — your email address, your name if you sign it, and the contents of your message. We use this information to respond to you and, where reasonable, to improve the site.

Private briefing feedback

Briefing posts may include a private feedback panel. If you use it, we collect the reaction you select, any optional note you choose to submit, the briefing page it relates to, and technical signals used for abuse prevention, delivery, and editorial context. Those signals can include your IP address, browser user-agent, device class, viewport size, browser timezone and locale, and approximate location inferred by Vercel from your IP address, such as city, region, country, and timezone. We store hashed versions of the IP address and user-agent with the feedback record, and server logs may still contain the raw request metadata described above.

This is private editorial feedback, not a public comment system. Do not send sensitive personal information through it.

Browser storage

The site keeps a small amount of first-party client-side storage in your browser to remember your preferences and the things you've looked at — for example your light or dark mode choice, any airports you've pinned to a watchlist, and recently viewed pages. None of it contains personal information, and the contents stay in your browser rather than being stored on our servers. Clearing your browser storage resets all of it.

We do measure how these features are used, in aggregate and without identifying you, so we can tell which parts of the site are worth continuing to build. That measurement is covered under Analytics below.

Advertising

The site carries display advertising served by Google AdSense (Google LLC, United States). The AdSense script (adsbygoogle.js) loads on our main content pages, and when it runs Google sets its own cookies and similar identifiers and may collect information including your IP address, user-agent, the page you're viewing, and signals Google has previously associated with your browser, in order to select ads, cap frequency, and report performance. Google processes that data for its own purposes under its own privacy policy. We receive aggregate revenue and performance reporting from Google, not your individual ad-targeting profile.

Embedded YouTube videos

Route, airline, and aircraft-type pages may list trip reports published on YouTube. The site uses YouTube API Services to retrieve the video titles, channel names, thumbnails, durations, and publication dates shown in those listings. That data is requested by our backend, not by your browser, so building the listing itself sends nothing about you to Google.

Each video is shown first as a static thumbnail image served by YouTube's image host (i.ytimg.com). Loading that image tells Google your IP address, your user-agent, and which page requested it. Nothing plays until you click. When you click, we load YouTube's official embedded player from youtube-nocookie.com — YouTube's privacy-enhanced mode, which does not set personalized-advertising cookies unless you play the video. From that point, YouTube and Google receive information including your IP address, user-agent, the page you are on, the video you are watching, and any signals Google has previously associated with your browser or with your Google account if you are signed in. Google processes that information for its own purposes under its own policies. We receive none of it.

You can review Google's practices in the Google Privacy Policy, and you can review or delete the data Google holds about you at Google My Activity.

Error monitoring

When the site encounters a JavaScript error in your browser session — for example, a tool like the mileage calculator throwing an unexpected exception — the page sends a small diagnostic report to our backend so we can fix the bug. Each report includes the error name, message, and JavaScript stack trace; the path and query string of the page where it happened; and your browser's user-agent string. The report is sent over HTTPS to our own backend (we do not currently use Sentry or another third-party error-monitoring service); the backend forwards a redacted summary to our internal Slack workspace and stores a hashed form of your IP address with the record for abuse prevention. Reports are retained for a limited operational window and then deleted.

Planned future categories

The site is pre-launch. The following categories may become applicable as features ship; each is planned and not yet active, and this policy will be updated before any of them go live:

  • Additional advertising partners. Beyond Google AdSense, we may add other programmatic ad networks or direct-sold sponsorships over time.
  • User accounts. If we add accounts, we will collect what's required to create and operate them and disclose those categories then.
  • Third-party error-monitoring services. If we move error reporting to a service such as Sentry or an equivalent, we will update this policy before sending data to it.

Why we process this information

For visitors in the European Economic Area, United Kingdom, or Switzerland, the GDPR requires us to identify a lawful basis under Article 6 for each category of processing.

  • Server logs: Article 6(1)(f), legitimate interests in security, debugging, and abuse prevention.
  • Vercel analytics and speed insights: Article 6(1)(f), legitimate interests in understanding aggregate traffic and performance. These tools are cookieless and do not identify individuals.
  • Google Analytics 4: Article 6(1)(f), legitimate interests in understanding aggregate site traffic, content performance, and reader behavior so we can improve the site. Google processes the data described in the Analytics section above on our behalf. Visitors who do not want Google Analytics cookies set can opt out via the Google Analytics Opt-out Browser Add-on, a browser tracking-protection extension, or by declining cookies in their browser settings.
  • Information you email us: Article 6(1)(b), to take steps at your request, and 6(1)(f), legitimate interests in correspondence and recordkeeping.
  • Private briefing feedback: Article 6(1)(f), legitimate interests in receiving reader corrections, understanding which coverage is useful, improving editorial quality, and preventing abuse.
  • Error monitoring: Article 6(1)(f), legitimate interests in detecting, diagnosing, and fixing bugs that affect site reliability.
  • Advertising cookies (Google AdSense): Article 6(1)(a), consent — gathered through Google's AdSense Privacy & messaging consent management platform (CMP). Visitors in the EEA, UK, or Switzerland are shown the consent prompt, built on the IAB Transparency and Consent Framework, before advertising cookies are set, and can consent, decline, or manage choices for individual ad partners through that prompt.
  • Future accounts: Article 6(1)(b), to provide an account-based service.

Who we share data with

We share data only with the categories of third parties listed below. We do not sell personal information for monetary consideration.

Hosting and infrastructure

  • Vercel Inc. (United States) hosts the frontend and provides analytics and performance insights.
  • Heroku (Salesforce, Inc., United States) hosts the backend and produces the request logs described above.
  • Slack Technologies, LLC (United States) receives private briefing feedback alerts so we can see reader reactions and corrections promptly.

All three are bound by their own data-processing terms.

Advertising and analytics

  • Google LLC (United States) serves display advertising via Google AdSense and provides site analytics via Google Analytics 4. Google processes the data described in the Advertising and Analytics sections above for its own purposes, in accordance with Google's privacy policy.
  • Google LLC / YouTube (United States) serves the video thumbnails and the embedded video player described in the "Embedded YouTube videos" section above, and receives the information described there directly from your browser when those load. The site uses YouTube API Services to retrieve the video details it displays.

The site does not use affiliate links or work with any affiliate networks.

Future third parties (planned, not yet active)

  • Additional programmatic ad networks or direct-sold sponsorships
  • Error-monitoring services (e.g., Sentry or equivalent)

We will not enable these in production without updating this policy and, where required, providing notice and a consent mechanism.

International data transfers

The Frequent Flier is operated from the United States, and our hosting providers are also based in the United States. If you visit the site from outside the United States — including from the European Economic Area, the United Kingdom, or Switzerland — your information will be processed in the United States, which has different data-protection laws than your home jurisdiction.

Cookies and similar technologies

Our own first-party storage is the small set of preference and history entries described under Browser storage above. These are localStorage entries rather than cookies.

The cookies you encounter on the site today are set by third parties:

  • Google Analytics 4 sets first-party analytics cookies (typically _ga and _ga_<container>) that assign a pseudonymous identifier to your browser for traffic measurement.
  • Google AdSense sets advertising cookies and similar identifiers on pages where ads are served, for ad selection, frequency capping, and reporting.
  • YouTube sets cookies and similar identifiers only after you click play on an embedded video. We embed via YouTube's privacy-enhanced domain (youtube-nocookie.com), so no YouTube cookie is set merely by viewing a page that lists videos.

For visitors in the EEA, UK, and Switzerland, we use Google's AdSense Privacy & messaging consent management platform (CMP) to present a consent prompt — built on the IAB Transparency and Consent Framework — before advertising cookies are set. Visitors can consent, decline, or manage choices for individual ad partners through that prompt.

For California residents and visitors in other US states with comparable privacy laws, the rights described in the "Your rights" section below apply. To exercise those rights — including opting out of any sharing of your personal information, requesting deletion, or any other right granted by your state's law — email hello@thefrequentflier.com, and we will respond within the timeframe required.

How long we keep data

  • Server logs: retained per Heroku's platform defaults, then rotated and deleted on Heroku's schedule.
  • Vercel analytics data: retained per Vercel's defaults; aggregated and not tied to individual visitors.
  • Google Analytics data: retained per the property's configured retention window in Google Analytics, then aggregated or deleted by Google per its terms.
  • Error monitoring reports: retained for a limited operational window for debugging and abuse prevention, then deleted.
  • Email correspondence: retained for as long as is reasonably useful to maintain the conversation and any related records, then deleted on a routine basis.
  • Private briefing feedback: retained for as long as reasonably useful for editorial review, abuse prevention, and coverage planning, then deleted or archived on a routine basis.

Your rights

If you are in the EEA, UK, or Switzerland

The GDPR gives you the right to access, rectify, erase, port, restrict, and object to processing of your personal data, and to withdraw any consent you have previously given. You also have the right to lodge a complaint with your national supervisory authority.

If you are a California resident

The CCPA and CPRA give you the right to know what personal information we collect, to delete it, to correct it, to opt out of any sale or sharing of it, to limit use of sensitive personal information, and not to be discriminated against for exercising these rights. Because we run display advertising via Google AdSense, the data flow involved may be considered "sharing" for cross-context behavioral advertising under California law. California residents who wish to exercise opt-out, deletion, correction, or other CCPA rights should email hello@thefrequentflier.com, and we will respond within the timeframe required by California law. We do not sell personal information for monetary consideration.

How to exercise your rights

Email hello@thefrequentflier.com with the right you want to exercise and enough information for us to identify the data in question. We will respond within the timeframe required by the applicable law.

Children

The Frequent Flier is not directed at children under 13 (per the US Children's Online Privacy Protection Act) or under 16 (per the GDPR's child-specific provisions). We do not knowingly collect personal information from anyone in those age groups. If you believe we have inadvertently collected such information, email hello@thefrequentflier.com and we will delete it.

Changes to this policy

We may update this policy. When we do, the "last reviewed" date at the top of the page will change. If a change is material — for example, the addition of a new third-party processor or a new category of data we collect — we will note it on the site for a reasonable period before it takes effect.

Contact

For any privacy question or to exercise any of the rights described above, email hello@thefrequentflier.com.