Draft — not yet in force. Prepared while GetFlyPass is in closed testing. Not reviewed by a lawyer; placeholders in square brackets are filled once the operating company is registered.
Privacy Policy
1. Who is responsible
The controller of your personal data is [COMPANY NAME], [REGISTERED ADDRESS].
Our representative in the European Union, where required, is [EU REPRESENTATIVE].
Data protection contact: info@getflypass.com
These entries will be completed before launch. Until then GetFlyPass operates as a closed test and is not open to the public.
2. What we collect
You give us
- Account: email address, password (stored only as a hash), name
- Profile: photo, short biography, languages, home city and country
- Listings: flight route and times, tags, item descriptions, links, dates
- Messages: what you write to other members, and any images you attach
- Reports: what you tell us when you report someone
Created automatically
- Account creation date, last sign-in, verification timestamps
- Counters derived from your activity: trips posted, deliveries completed, cancellations
- Server logs kept by our hosting provider, which include IP addresses
- Aggregate visit statistics that do not identify you (see section 10)
From other services
- If you sign in with Google or Facebook, we receive your email address, your name and your profile picture. We never receive your password with either, and we cannot see anything else in those accounts — not your contacts, not your friend list, not your posts. See section 5.
Photographs you upload are resized in your own browser before they are sent to us. This removes the metadata cameras write into image files — including the GPS coordinates of where the photo was taken. That data never reaches our servers.
3. Why, and on what basis
| Purpose | Data | Legal basis |
|---|---|---|
| Run your account and show your listings | Account, profile, listings | Performance of a contract |
| Deliver messages between members | Messages, attachments | Performance of a contract |
| Tell you by email when someone first messages you about a listing | Email address, notification preference | Performance of a contract — you can turn it off at any time |
| Verify identity and build trust | Email, phone, ID check results | Contract and legitimate interest in a safe marketplace |
| Prevent fraud and abuse, handle reports | Reports, message content where reported, activity data | Legitimate interest, and legal obligation where applicable |
| Keep the service available and secure | Server logs | Legitimate interest |
| Understand how many people visit | Aggregate, non-identifying statistics | Legitimate interest |
We do not sell personal data, we do not share it with advertisers, and we do not build advertising profiles.
4. What other members see
Your public profile shows:
- Your first name and the initial of your surname — never the full surname
- Your photo, biography, languages and home city, if you filled them in
- Which verifications you have completed
- Your rating, review count and activity counters
- Your active listings and the month you joined
Never shown: your email address, your phone number, your exact address, your date of birth, any identity document, or your full name.
The shortening of your surname happens in the database, not in the page. Someone querying our public interface directly still cannot read your full name.
5. Who processes data for us
| Service | Purpose | Location |
|---|---|---|
| Supabase | Database, authentication, file storage | Frankfurt, Germany (EU) |
| Resend | Transactional email (confirmation, password reset, message notifications) | Ireland (EU) |
| Cloudflare | Aggregate visit statistics, no cookies | Global network |
| Natro | Web hosting and server logs | Turkey |
| Sign-in with Google, only if you choose it | Global | |
| Meta (Facebook) | Sign-in with Facebook, only if you choose it | Global |
Each of these processes data on our instructions and for no other purpose. We chose EU hosting for the database and for email deliberately: that is where your account data and your messages live.
If you sign in with Google or Facebook
We receive your name, email address and profile picture from the provider, and nothing else. We do not receive your friend list, your posts, or anything you do outside GetFlyPass, and we never post anything on your behalf.
The provider learns that you signed in to GetFlyPass. That is unavoidable — it is what makes the sign-in work. If you would rather they did not know, register with an email address instead; nothing on the site depends on which method you chose.
Removing the connection from your Google or Facebook settings does not delete the GetFlyPass account it created. The data deletion page explains both steps.
6. Where data is stored
Your account, profile, listings and messages are stored in the European Union (Frankfurt). Web hosting for the site itself is in Turkey, and server logs are generated there.
Where data leaves the European Economic Area, transfers are made under [TRANSFER MECHANISM].
7. Messages and moderation
Messages between members are private. They are not read routinely, they are not scanned for advertising, and they are not used to train anything.
A moderator may open a specific conversation in two situations: someone reported it, or there is a credible indication of harm or illegality. Every such access is written to a log that records who opened it, which conversation, when, and why. That log cannot be reached from the website by anyone, including us through the normal interface.
We built it this way for a simple reason: a platform that can read private messages without leaving a trace has no way to prove it did not abuse that power.
Edited and deleted messages
When a message is edited or deleted, the previous text is kept for 180 days and then removed automatically. Both members still see only the current version; the earlier text is not shown to anyone on the website.
This exists because the conversation is the only record either side has. If you agree a price and the other person later edits their message to say something else, a platform that has overwritten the original cannot help you. A moderator can retrieve the earlier text when a report is being investigated — and, as above, that access is logged.
Deleting a message still removes it from the conversation immediately and permanently for both of you. What survives is a copy that only moderation can reach, only for the period stated, and only for resolving disputes and abuse.
8. How long we keep it
- Account and profile: until you delete your account
- Listings: until you remove them, or they expire after the flight
- Messages: until the conversation or the account is deleted
- Earlier text of edited or deleted messages: 180 days, then removed automatically. Reachable only by moderation, and only through a logged request — see section 7
- Reports and moderation logs: kept after account deletion where needed to defend a claim or meet a legal obligation
- Server logs: as retained by the hosting provider, typically a short period
9. Your rights
Depending on where you live, you can:
- Ask what data we hold about you and get a copy
- Correct anything inaccurate — most of it you can edit yourself in Settings
- Delete your account and your data (see data deletion)
- Ask us to restrict or stop certain processing
- Receive your data in a portable format
- Withdraw consent where processing is based on consent
- Complain to your national data protection authority
Write to info@getflypass.com. We answer within one month.
11. Children
GetFlyPass is for adults. You must be 18 or older to hold an account. If we learn that an account belongs to someone younger, we close it and delete the data.
12. Changes
When this policy changes we update the date at the top. Material changes are announced on the site and, where we have your address, by email.