Privacy Policy

1. Who we are

Route Explorer (the “Service”) is operated by StaffTraveler Solutions B.V. (“StaffTraveler”, “we”, “us”, or “our”), the data controller for the personal data described in this policy.

2. Scope

This policy applies to the Route Explorer website at route-explorer.com and to the Route Explorer apps for iOS and Android. Route Explorer lets you explore flight routes and connections worldwide. You can use most of it without an account.

Route Explorer works with your existing StaffTraveler account. When you sign in, some data is read from the StaffTraveler service, which is governed by its own StaffTraveler Privacy Policy. This policy covers only Route Explorer.

3. Information we collect

Account information (only if you choose to sign in)

Signing in is optional. If you sign in, we use Firebase Authentication (a Google service) to verify your identity. Depending on the method you choose — email and password, an emailed sign-in link, Google, or Apple — we receive your email address and an authentication identifier. If you sign in with Apple, you may use Apple’s Hide My Email feature, in which case we receive a relay address rather than your personal one.

StaffTraveler profile and non-rev agreements

When you are signed in, we read your StaffTraveler profile and your non-revenue airline agreements to power features — for example, to highlight routes covered by the airlines you can travel on. We do not use this data for advertising.

Subscription status

If you purchase Route Explorer Pro, the purchase is processed by the Apple App Store or Google Play and managed through RevenueCat, our subscription-management processor. We receive your subscription and entitlement status only. We never receive or store your card number or other payment-card details.

Searches and usage

Airport and route searches are processed to return results and are rate-limited to protect the Service. For visitors who are not signed in, searches are not linked to a personal profile.

Analytics

We use Google Analytics for Firebase (GA4) to understand how the Service is used in aggregate — for example, which features are popular. Analytics data is anonymized and is used to improve the Service, not to identify you.

Technical and server logs

Our servers automatically record limited technical information such as your IP address, request time, and the endpoint requested. We use this for security, rate-limiting, and abuse prevention, and we retain it only for a short period.

Data stored on your device

When you sign in on a mobile app, your session tokens are stored securely in the device keychain (iOS) or keystore (Android). They stay on your device and are used to keep you signed in.

4. How we use your information

• To provide, personalize, and maintain the Service.
• To authenticate you and keep your session secure.
• To process and manage your Route Explorer Pro subscription.
• To keep the Service secure and available — including rate-limiting and preventing abuse or fraud.
• To understand and improve the Service using aggregate analytics.
• To comply with our legal obligations.

5. Legal bases for processing

Where the EU General Data Protection Regulation (GDPR) applies, we rely on the following legal bases: performance of a contract (to provide the Service and your subscription); our legitimate interests (to secure and improve the Service); your consent (for analytics cookies, where required); and compliance with legal obligations.

6. Cookies and analytics

On the web, we use analytics with Google Consent Mode and show a cookie consent banner so you can accept or decline analytics storage. We do not use advertising cookies. You can change your choice at any time through the banner or your browser settings.

7. What we do not do

• We do not show ads in Route Explorer.
• We do not sell your personal data.
• We do not track you across other apps or websites. On iOS, Route Explorer does not use App Tracking Transparency tracking and does not request permission to track you.

8. Sharing and processors

We share personal data only with service providers that process it on our behalf, and only as needed to run the Service:

• Google (Firebase and Google Cloud)— authentication (Firebase Authentication), account and profile storage (Cloud Firestore), analytics (Google Analytics for Firebase), and backend hosting (Google Cloud Platform).
• RevenueCat— subscription management.
• Apple App Store and Google Play— payment processing for subscriptions, under their own terms.
• Mapbox— map rendering in the mobile app (receives your device’s IP address and map-tile requests).
• Vercel— web application hosting (processes IP addresses and request metadata).
• Upstash— rate-limiting infrastructure for the web service (processes IP-derived request metadata).

We may also disclose information where required by law or to protect the rights, safety, and security of our users and the Service.

9. International transfers

Some of our processors are located outside the European Economic Area, including in the United States. Where personal data is transferred internationally, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses.

10. Data retention

Data tied to your StaffTraveler account is retained for as long as that account exists. Server and security logs are kept only for a short period. Analytics data is retained in aggregated form.

11. Your rights

Depending on where you live, you may have the right to access, correct, delete, or export your personal data, to object to or restrict certain processing, and to withdraw consent. To exercise these rights, contact privacy@stafftraveler.com. You may also lodge a complaint with your local data protection authority.

12. Deleting your data

Data associated with your StaffTraveler account is removed when you delete that account through StaffTraveler. For any other Route Explorer data, or if you need help, contact support@stafftraveler.com and we will assist you.

13. Children

Route Explorer is not directed to children under 13, and we do not knowingly collect personal data from them. If you believe a child has provided us with personal data, please contact us so we can remove it.

14. Security

We protect your data with appropriate technical and organizational measures, including encryption of data in transit and secure storage of session tokens in the device keychain or keystore. No method of transmission or storage is completely secure, but we work to protect your information.

15. Changes to this policy

We may update this policy from time to time. When we do, we will revise the “Last updated” date above and, where appropriate, notify you within the Service.

16. Contact us

For privacy questions, contact StaffTraveler Solutions B.V. at privacy@stafftraveler.com.