Privacy notice

Last updated: 24 September 2026

flighthelp collects as little personal data as it can. Browsing the site and using the tools needs no account, sets no tracking cookies, and loads no analytics, advertising or social-media scripts.

If you only browse

• We process your IP address for up to about an hour to apply rate limits to the public API, and our hosting providers keep standard server logs for security and reliability.
• If you choose a language in the language menu, we store that choice in a cookie called fh_lang for one year. It holds only the language code.
• The claim-letter generator runs entirely in your browser. Nothing you type into it is sent to us.

If you create an account

To provide API keys and the account area, we store:

• your email address, and the name and organization you give us (optional);
• a scrypt hash of your password — never the password itself;
• sessions: a cookie called __Host-fh_session (or fh_session in development) holding a random token, of which we store only a hash, and the browser description of the device; a second cookie, fh_signed_in, holds no data beyond the fact that you are signed in, so the site can show the right menu;
• your API keys, stored only as hashes, and the number of requests each key makes per day;
• a security log of sign-ins, password changes and key events, with the IP address and browser description, kept for 180 days;
• any application you make for the non-profit tier.

The legal basis is the contract you enter into when you create an account (GDPR Article 6(1)(b)), and our legitimate interest in keeping accounts secure (Article 6(1)(f)) for the security log.

Who processes your data for us

• Hosting of the website and API (Vercel and Fly.io).
• Database hosting (MongoDB Atlas), in the European Union.
• Transactional email — confirmation and password-reset links and account notices (Brevo).

We do not sell or share personal data with anyone else, and we do not use it for marketing.

Your rights

You can do these yourself, at any time, from your account:

• download everything we hold about you as a JSON file (access and portability, Articles 15 and 20);
• correct your name and organization (rectification, Article 16);
• permanently delete your account and all associated data (erasure, Article 17).

For anything else, or to object to processing, write to privacy@flighthelp.net. You also have the right to complain to your data-protection authority.