Privacy Policy

1. Who we are and the scope of this policy

Sky Spy (“Sky Spy”, “we”, “us”) operates the flight-comparison website at skyspy.deals. We are responsible for the personal information described in this policy. You can contact our privacy contact at hello@skyspy.deals. You may also ask for a copy of this policy in another accessible form.

Sky Spy compares fares and sends you to an airline, comparison site or booking partner to complete a booking. We do not sell tickets, take payment, access your booking, or require a user account. This policy applies to Sky Spy's website, emails and support communications. A third-party site's own policy applies after you leave Sky Spy.

2. Information we collect and how we collect it

You can browse and search without identifying yourself. Depending on how you use the service, we collect or process:

• Search and fare information — the origin, destination, travel dates, trip type, cabin and other filters you submit, search results, and any fare snapshots you ask us to email.
• Contact and preference information — your email address, newsletter choice, the date, source and version of that choice, unsubscribe or delivery status, and communications you send us.
• Travel context linked to an email — the coarse suggested departure airport and up to three recent origin/destination selections, when available, so we can tailor relevant deal lists. Older records may not contain this context.
• Newsletter engagement — for campaigns where tracking is enabled, whether an email was apparently opened, whether a tracked content link was clicked, the campaign and destination link, the time, and whether the interaction appears automated. We use the user-agent briefly to classify likely automated activity but do not store the raw user-agent in those event records.
• Technical and usage information — IP address, approximate location derived from IP, request time, page or referring page, browser, device and operating-system information, performance measurements, errors and security logs processed by our hosting and infrastructure providers.
• Local device information — saved fares, a saved email address, newsletter preference, recent searches, suggested airport, display currency and cached exchange rates, and return-trip setting stored in your browser as described below.

We collect information directly from you when you search, save an email, request a fare summary, subscribe or contact us; automatically from your browser and device; and from service providers such as our host, email provider and advertising or affiliate partners.

Our host may derive a coarse city and nearby airports from your IP address to suggest a departure airport. Sky Spy's suggestion endpoint receives only the coarse location headers and does not request precise device location. It does not return or persist the source IP or coordinates. The suggested airport is linked to your email only if you choose to save that email.

3. Browser storage, cookies and similar technologies

Sky Spy uses browser local storage for functional preferences and saved content. This includes saved fare snapshots, your saved email, newsletter preference, recent search pairs, suggested airport, currency and exchange-rate cache, and return-trip setting. This information remains on that device until you clear it, use an available clear control, or your browser removes it. Travel context and your newsletter choice are also sent to us when you submit an email form.

Vercel Web Analytics is configured as cookie-free analytics. Advertising and affiliate technology, including Google AdSense and Travelpayouts, may use cookies, pixels, scripts or local storage to deliver, limit, personalise and measure ads or attribute a referral. Their technology may process identifiers, IP address, device and browser information, pages viewed, referrals and ad or link interactions.

You can block or delete cookies and site data using your browser. You can manage Google ad personalisation in Google's Ads Settings and use the privacy choices shown to you by an applicable consent platform. Blocking storage may stop saved preferences from working.

4. Why we collect, use and disclose information

• Provide and operate flight search, fare comparison, saved-email and requested bookmark-summary features.
• Remember device preferences and suggest relevant departure airports or deal lists.
• Send marketing only when you have chosen to receive it, maintain consent and suppression records, and honour unsubscribe requests.
• Understand aggregate usage, measure website performance and email engagement, troubleshoot faults, and improve the service.
• Display and measure advertising, attribute affiliate referrals, prevent fraud and abuse, secure the service, enforce our rights, and comply with law.
• Respond to questions, privacy requests and complaints.

Where applicable law requires a legal basis, we rely on your request to provide a service, your consent (including for marketing and where required for advertising technology), our legitimate interests in operating, securing and improving Sky Spy, and compliance with legal obligations. You may withdraw consent at any time; this does not affect processing already carried out lawfully.

Providing an email is optional. If you do not provide it, you can still search and compare fares, but we cannot save the address on our systems, send a requested fare summary or send newsletter emails.

5. Analytics and performance measurement

We use Vercel Web Analytics to understand page use and feature interactions. Vercel Web Analytics stores anonymised data and does not use cookies. It can include page, filtered query parameters, referrer, coarse geolocation, browser, operating system and device type. Its daily visitor identifier is not associated with an IP address and resets after 24 hours.

Our custom events may include predefined airport, country or region selections, route codes, whether a search returned results, and booking or deal-link interactions. We do not intentionally send email addresses, names, free-form search-box text or payment information in analytics events. See Vercel's analytics privacy information.

6. Advertising and affiliate links

We use Google AdSense to display advertising. Google and its advertising partners may use information from your visits to Sky Spy and other sites to provide and measure personalised or non-personalised ads, depending on your location, settings and consent choices. Learn more in Google's information for partner sites.

Sky Spy is also funded by affiliate commissions. Travelpayouts and booking partners may process a click and set attribution technology when you use a Book or partner link. If you make a purchase, we may receive a commission and aggregated reporting, but we do not receive your payment-card details or manage your booking. Depending on the destination, partners can include Aviasales, Kiwi.com, Booking.com, Google Flights, airlines and other travel providers. Their privacy policies govern information they collect directly from you.

We do not sell your email address for money. Some privacy laws may define interest-based advertising disclosures as a “sale”, “sharing” or targeted advertising even when no money changes hands. Where such laws apply, use the consent or privacy controls presented on the site or contact us to exercise an applicable opt-out right.

7. Email, newsletters and engagement tracking

We use your email to remember the recipient for requested bookmark summaries and to send a summary when you ask for one. We send Sky Spy deal or newsletter emails only when the newsletter option is selected. Every marketing email provides an unsubscribe method. We keep a record of an unsubscribe or delivery suppression so we do not restart marketing accidentally. Unsubscribing from marketing does not prevent a fare summary that you later request through the bookmark feature.

A newsletter may contain signed Sky Spy redirect links or a one-pixel image when the sender enables engagement tracking. Click tracking records the campaign and destination of tracked content links; open tracking is an estimate because mail applications may block, cache or preload images. Unsubscribe links are used to process and record the unsubscribe request. You can disable image loading in your email application to limit open tracking, although tracked links will still record a click if used.

8. Who receives information

We disclose relevant information to:

• Vercel, which hosts the website and provides analytics, performance and coarse-location services.
• Render, which hosts the application programming interface used for search and email functions.
• Supabase, which stores email preferences, travel context, delivery and newsletter engagement records, and operational search/cache data.
• Resend and email infrastructure providers, which deliver requested fare summaries and related service email.
• Google and Travelpayouts and their advertising, measurement and booking partners, as described above.
• Flight-data providers, which receive route, date and search parameters from our server to return fares, but are not intentionally sent your email address or source IP by Sky Spy for that search.
• Professional advisers, regulators, courts, law enforcement or other parties where reasonably necessary to protect rights, investigate misuse, comply with law, or complete a business reorganisation or transfer subject to appropriate safeguards.

These providers process information under their own terms and privacy commitments. We do not provide your saved email or linked travel context to advertising or booking partners for their own direct marketing.

9. Overseas processing

Sky Spy uses cloud and travel providers that operate globally. Personal information is likely to be processed outside Australia, including in the United States. It may also be processed in other countries where Vercel, Render, Supabase, Resend, Google, Travelpayouts, a booking partner or their subprocessors operate. The exact location can vary with network routing, infrastructure configuration and the partner you choose. Those countries may have different privacy protections from your home country. We take reasonable steps to select suitable providers and use available contractual or other transfer safeguards where required.

10. How long we keep information

• Detailed operational search-event records are scheduled for deletion after 30 days; aggregate counts and de-identified fare/cache information may be retained longer.
• Browser-stored information remains until you clear it, use an available clear control, or the browser removes it.
• Email, consent and linked travel-preference records are kept while the feature or subscription is active. After unsubscribe or a deletion request, we may retain a minimal suppression, delivery, consent or request record for as long as reasonably needed to honour the choice, prevent unwanted messages, resolve disputes and comply with law.
• Newsletter engagement, campaign and provider delivery records, security logs, backups and support communications are retained only for as long as reasonably needed for the purposes described above, subject to provider retention schedules and legal requirements.

We delete or de-identify personal information when it is no longer reasonably needed, unless retention is required or permitted by law.

11. Security

We use reasonable technical and organisational safeguards appropriate to the information we hold, including encrypted transport, restricted service credentials, database access controls, validation and rate limits. No internet service is completely secure, so we cannot guarantee absolute security. If a data breach occurs, we will investigate and make notifications where required by law.

12. Your rights and choices

Depending on your location, you may have rights to request access to, correction of or deletion of personal information; object to or restrict processing; withdraw consent; opt out of direct marketing, targeted advertising, sale or sharing; or receive a portable copy of certain information. Australian users may request access and correction under applicable privacy law.

• Unsubscribe from marketing using the link in any newsletter; we will process valid unsubscribe requests within the period required by law.
• Clear the saved email through Search settings and remove other local site data through your browser. This clears the device only and does not delete server records.
• Manage Google ad personalisation and any consent controls presented on the site, or block cookies and local storage in your browser.
• Email hello@skyspy.deals to request access, correction, deletion or another applicable privacy choice. Tell us the email address involved and the nature of the request. We may need to verify your identity before acting.

Some rights have legal exceptions. If we cannot fulfil a request, we will explain why where the law requires. We will not discriminate against you for exercising an applicable privacy right.

13. Privacy questions and complaints

Send a privacy question or complaint to hello@skyspy.deals. Please describe what happened and the outcome you seek. We will acknowledge and investigate the matter and aim to respond within a reasonable period, normally within 30 days.

If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner or, where applicable, your local data-protection authority.

14. Children

Sky Spy is a general-audience travel service and is not directed to children under 16. We do not knowingly collect personal information from a child under 16. A parent or guardian who believes a child has provided personal information can contact us to request its deletion.

15. Changes to this policy

We may update this policy when our service or legal obligations change. We will publish the revised version here and change the “Last updated” date. If a change materially affects how we use information already collected, we will provide additional notice or seek consent where required.