Privacy Policy

1. Who we are

Route Explorer (the “Service”) is operated by StaffTraveler Solutions B.V. (“StaffTraveler”, “we”, “us”, or “our”), the data controller for the personal data described in this policy.

This includes Route Explorer accounts. When you create a Route Explorer account, we are the controller of that account and the data it holds, such as your email address and, if Google or Apple shares it, your name. Route Explorer accounts are kept in Route Explorer’s own systems, separately from StaffTraveler member accounts. If you sign in with a StaffTraveler account instead, see §2.

2. Scope

This policy applies to the Route Explorer website at route-explorer.com and to the Route Explorer apps for iOS and Android. Route Explorer lets you explore flight routes and connections worldwide. You can use most of it without an account.

You can sign in in two ways. You can create a Route Explorer account, which we operate and which this policy fully covers. Or, if you are a StaffTraveler member, you can sign in with your StaffTraveler account. In that case some data is read from the StaffTraveler service, and your StaffTraveler account itself is governed by the StaffTraveler Privacy Policy. This policy covers only what Route Explorer does with your data.

3. Information we collect

Route Explorer account (only if you create one)

Creating an account is optional. Route Explorer accounts are managed with Firebase Authentication (a Google service). You can sign up with an email address and password, with Google, or with Apple. We receive your email address, an account identifier, the sign-in method you used and, if Google or Apple shares them, your name and profile photo. Your password is sent directly to Firebase Authentication and never reaches or is stored on our servers.

If you sign up with email and password, we send a verification email to confirm the address is yours, and you can ask us to send a password-reset email. If you sign in with Apple, you may use Apple’s Hide My Email feature, in which case we receive a relay address rather than your personal one. When you sign in with Apple in our mobile apps, we also store a token issued by Apple so that, if you delete your account, we can tell Apple to revoke Route Explorer’s access.

StaffTraveler sign-in (only if you choose it)

If you sign in with your StaffTraveler account (email and password, an emailed sign-in link, Google, or Apple), StaffTraveler’s sign-in service verifies your identity and we receive your email address and your StaffTraveler account identifier. We then create a linked Route Explorer session record under a pseudonymous identifier derived from your StaffTraveler account, so the Route Explorer service can recognise your session. It holds your StaffTraveler account identifier and whether you have StaffTraveler Pro, but not your email address or name. Route Explorer cannot be used to open a StaffTraveler account: if you use the StaffTraveler option with an identity that has no StaffTraveler account, the sign-in record this can briefly create at StaffTraveler is deleted straight away.

StaffTraveler profile and non-rev agreements

When you are signed in with StaffTraveler, we read your StaffTraveler profile (your name, profile photo, airline, preferred currency and whether you have StaffTraveler Pro) and your non-revenue airline agreements to power features — for example, to highlight routes covered by the airlines you can travel on, and to decide which Route Explorer features are included for you. We do not use this data for advertising.

Subscription status

If you purchase Route Explorer Pro, the purchase is processed by the Apple App Store or Google Play and managed through RevenueCat, our subscription-management processor. We receive your subscription and entitlement status. When a purchase completes, the app also records a purchase analytics event (see Analytics below) containing the product identifier, the plan’s price and currency, and the transaction identifier issued by Apple or Google for that purchase. Apple or Google can link that identifier to your store account; we cannot, and we never receive or store your card number or other payment-card details.

We also keep a record of your subscription status and, if you start a free trial, the date you used it, linked to your account identifier. We use this to give you access to the features you are entitled to when you sign in, and to make sure each account uses a free trial only once.

The mobile apps also connect to RevenueCat when they start, under an anonymous identifier, or under your account identifier while you are signed in, so they can show which plans are available and whether you already have access.

Searches and usage

Airport and route searches are processed to return results and are rate-limited to protect the Service. For visitors who are not signed in, searches are not linked to a personal profile.

Tracked flights and notifications (only if you use them)

When you are signed in, you can track flights to get status alerts. For each tracked flight we store the airline, flight number, departure airport, arrival airport and scheduled departure time, linked to your account. We also store your notification settings for tracked flights. To get status updates, we send the StaffTraveler flight-status service only the flight itself. We do not send your name, email address or account identifier with it. A tracked flight leaves your list about two days after its scheduled departure. Our shared record of the flight is then deleted automatically. The entry on your account is deleted by an automatic clean-up within about a day after that, even if you never open the app again, and in any case when you delete your account.

To send you alerts, we store a notification token for each phone or browser where you allow them. On iPhone, if you use Live Activities, we also store the tokens Apple issues to update the Live Activity on your Lock Screen. We keep at most 10 devices per account. We remove a token when the notification service reports that it no longer works, when you sign out on that device, and when the device has not been seen for 90 days (checked by an automatic clean-up, even if you never open the app again). Live Activity update tokens are deleted about two days after the flight’s scheduled departure.

Calendar sync (mobile apps only, optional)

If you have Route Explorer Pro, you can let the mobile app find flights in the calendars you choose and track them for you. You turn this on in Settings, and you can turn it off there at any time. The app reads your calendar on your device, and your calendar text never leaves it. For each flight it finds, the app sends only the flight number, the departure date and time, and the airports, together with a random identifier for this install of the app. These flights then become tracked flights, as described above.

Analytics

We use Google Analytics (GA4) to understand how the Service is used — for example, which features are popular. In the mobile apps, analytics is collected on your device by the Google Firebase Analytics SDK and transmitted to Google. In the mobile apps when you are signed in with either kind of account, and on the website when you are signed in with StaffTraveler, and in each case have consented to analytics, we attach a pseudonymous account identifier to your analytics so we can understand usage across your signed-in sessions and devices; otherwise no such identifier is used. We use analytics to improve the Service, not to serve you ads, and we do not sell it.

Firebase Analytics also automatically collects limited technical information — such as your device model, operating-system and app version, a coarse location derived from your IP address (approximate country or region), and a resettable app-instance identifier. It does not collect an advertising identifier.

Crash reports and performance diagnostics

The mobile apps collect crash reports through Sentry and app performance diagnostics (such as launch and navigation timing, and unhandled-error reports) through Expo. These diagnostics are keyed to an install-scoped anonymous identifier, do not include your name, email, or StaffTraveler account identity, and are used only to find and fix problems in the app.

Technical and server logs

Our servers automatically record limited technical information such as your IP address, request time, the endpoint requested and, when you are signed in, your pseudonymous account identifier. We use this for security, rate-limiting, and abuse prevention, and we retain it only for a short period.

Security checks

To protect the Service from automated abuse, the website uses Google reCAPTCHA and the mobile apps use Apple App Attest or Google Play Integrity to confirm that requests come from a genuine copy of Route Explorer. reCAPTCHA collects information about your browser, device and interactions with the page and sends it to Google, under Google’s Privacy Policy and Terms of Service.

Data stored on your device

When you sign in on a mobile app, your session is stored in the app’s protected storage on your device (on iOS, the keychain) and is used to keep you signed in. The app also stores your preferences and recent searches on your device. This data stays on your device.

On the website, your browser’s storage keeps your sign-in session so you stay signed in, and preferences and conveniences such as your cookie-consent choice, your preferred currency, your recent searches, the date until which free access runs, and, while you complete an emailed sign-in link, the email address you entered. Google reCAPTCHA and, if you accept analytics, Google Analytics also store data in your browser. Route Explorer’s own browser data stays in your browser, and you can clear it at any time in your browser settings.

4. How we use your information

• To provide, personalize, and maintain the Service.
• To authenticate you and keep your session secure.
• To process and manage your Route Explorer Pro subscription.
• To keep the Service secure and available — including rate-limiting and preventing abuse or fraud.
• To understand and improve the Service using analytics.
• To comply with our legal obligations.

5. Legal bases for processing

Where the EU General Data Protection Regulation (GDPR) applies, we rely on the following legal bases: performance of a contract (to provide the Service and your subscription); our legitimate interests (to secure and improve the Service, and to prevent abuse such as repeated free trials); your consent (for analytics cookies, where required); and compliance with legal obligations, including keeping a minimal record that shows an account deletion was carried out (see §12).

6. Cookies and analytics

On the web, we use analytics with Google Consent Mode and show a cookie consent banner so you can accept or decline analytics storage. When you accept and are signed in, a pseudonymous, account-derived identifier may be attached to your analytics (see §3). We do not use advertising cookies. You can change your choice at any time through the banner or your browser settings. In the mobile apps, you can accept or decline analytics when you first open the app and change your choice at any time in Settings.

7. What we do not do

• We do not show ads in Route Explorer.
• We do not sell your personal data.
• We do not track you across other apps or websites. On iOS, Route Explorer does not use App Tracking Transparency tracking and does not request permission to track you.

8. Sharing and processors

We share personal data only with service providers that process it on our behalf, and only as needed to run the Service:

• Google (Firebase and Google Cloud) — authentication (Firebase Authentication, including sending verification, password-reset and sign-in emails), security checks (Firebase App Check with Google reCAPTCHA on the website and Google Play Integrity on Android), account, subscription and tracked-flight records (Cloud Firestore), push notifications (Firebase Cloud Messaging), analytics (Google Analytics / GA4, including the Firebase Analytics SDK collecting on-device in the mobile apps), and backend hosting (Google Cloud Platform).
• RevenueCat — subscription management in the mobile apps (receives an anonymous identifier, or your account identifier while you are signed in, and your purchase records).
• Sentry — crash and error reporting for the mobile apps (receives crash stack traces and device metadata; no account identity).
• Expo (650 Industries, Inc.) — app updates and performance monitoring for the mobile apps (update checks, launch and navigation timing and unhandled-error diagnostics under an install-scoped anonymous identifier).
• Apple App Store and Google Play — payment processing for subscriptions, under their own terms. Apple also performs App Attest device checks in the iOS app and, if you signed in with Apple in our mobile apps, receives a request to revoke Route Explorer’s access when you delete your Route Explorer account.
• Mapbox — map rendering on the website and in the mobile apps (receives your IP address, map-tile requests and anonymous map-usage statistics).
• Vercel — web application hosting (processes IP addresses and request metadata).

We may also disclose information where required by law or to protect the rights, safety, and security of our users and the Service.

9. International transfers

Some of our processors are located outside the European Economic Area, including in the United States. Where personal data is transferred internationally, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses.

10. Data retention

Your Route Explorer account data is kept for as long as your account exists and is deleted when you delete the account, except for the minimal deletion record described in §12, which we keep without a fixed end date. Data linked to a StaffTraveler sign-in is kept until you ask us to delete it (see §12). Subscription records expire automatically about 30 days after the subscription ends. The record that an account has used its free trial is kept until the account is deleted, so that each account gets only one free trial. Server and security logs are kept only for a short period. Tracked flights and notification tokens are kept as described in §3. Analytics data is retained by Google for a limited period in line with our Google Analytics data-retention settings; where you are signed in and have consented, some analytics events are associated with a pseudonymous, account-derived identifier during that period (see §3).

11. Your rights

Depending on where you live, you may have the right to access, correct, delete, or export your personal data, to object to or restrict certain processing, and to withdraw consent. To exercise these rights, contact privacy@stafftraveler.com. You may also lodge a complaint with your local data protection authority.

12. Deleting your account and data

Route Explorer account: you can delete your account at any time in Settings → Delete account, on the website or in the mobile apps. Deletion removes your sign-in account, your subscription and trial records, your tracked flights, notification settings and notification and Live Activity tokens, and your record at RevenueCat; asks Google to delete the analytics data linked to your account identifier; and, if you signed in with Apple in our mobile apps, tells Apple to revoke Route Explorer’s access. Deleting your account does not cancel a subscription bought through the App Store or Google Play — cancel it in your store account settings first.

To show that a deletion was carried out and to prevent abuse (for example, deleting and re-creating an account to obtain repeated free trials), we keep a minimal record of each deletion: the pseudonymous account identifier, timestamps, the sign-in method, whether you or our support team started the deletion, and the outcome of each deletion step. It contains no email address or name. If Apple cannot be reached during a deletion, we keep the Apple token only until we retry the revocation.

StaffTraveler account: your StaffTraveler account is deleted through StaffTraveler. For the Route Explorer data linked to it, for help with any deletion, or if you cannot sign in, email support@stafftraveler.com from the address on the account and we will carry out the deletion for you.

13. Children

Route Explorer is not directed to children under 13, and we do not knowingly collect personal data from them. If you believe a child has provided us with personal data, please contact us so we can remove it.

14. Security

We protect your data with appropriate technical and organizational measures, including encryption of data in transit and storing session tokens in protected storage on your device. No method of transmission or storage is completely secure, but we work to protect your information.

15. Changes to this policy

We may update this policy from time to time. When we do, we will revise the “Last updated” date above and, where appropriate, notify you within the Service.

16. Contact us

For privacy questions, contact StaffTraveler Solutions B.V. at privacy@stafftraveler.com.