Your data, plainly.
We collect what a flight search needs. Nothing else.
SquadJet - operated by SquadJet LLC ("we") - prices one trip for a whole group, each person flying from their own home airport. To do that we keep an account (your email), your search inputs, and a record of what you bought. We run no advertising trackers and no third-party analytics, and we never sell or share your data for marketing. Payments are handled by Stripe - card numbers never touch our servers.
Five kinds of data.
- Account. Your email address and optional name. Your password is held by our login service (AWS Cognito) and used only to sign you in - we never see or store it, and it never appears in logs.
- Searches. Party size, each passenger's home airport, travel dates, destination, and preferences (cabin class, airlines, direct-only), plus the names you type for passengers. The name field is just a label for the results - first names or nicknames are all we need, and those names are never sent to our flight-data providers.
- Purchases. Which credit bundle you bought, when, and for how much. The payment itself happens on Stripe's checkout page (see 04).
- Operational logs. Service activity - logins, searches run, results picked, purchases - tied to your account email. We use these to operate the service, debug problems, and compute aggregate statistics (for example, which meetup cities squads actually choose). Logs never contain passwords, session tokens, or card data.
- Referrals. If you invite someone - by referral link, squad invite, or SquadBook invite - we keep a record connecting your account to the account they create, so we can grant each reward only once per invited person and catch abuse. That connection is stored as the same kind of one-way scrambled identifier described in 07, not as a readable pair of email addresses. Who sees what: a referral link is anonymous - the person who opens it learns nothing about you unless you tell them - while squad and SquadBook invites identify you to the person you invited, by design.
No cards, no trackers, no sale of data.
- No card numbers - Stripe processes payments; we receive only a confirmation of what was purchased.
- No advertising cookies, tracking pixels, or fingerprinting to profile or track you. The only browser signals we read are the ones our bot check (section 04) uses to tell a person from a bot, and they are used for that security purpose alone.
- No third-party analytics scripts watching you browse.
- No sale, rental, or sharing of personal data for anyone's marketing, ever.
- No precise location - your "home airport" is whatever you choose to type.
Six third parties, each with a narrow job.
- Amazon Web Services (AWS) hosts SquadJet - our servers, database, and login service run on AWS in the United States, and our emails (verification links, receipts, price alerts) are delivered through Amazon SES. Your data is stored and processed in the US.
- Stripe processes payments. When you buy credits you are on Stripe's pages and Stripe's privacy policy applies to the payment details you enter there.
- Cloudflare runs the bot check (Turnstile) that guards forms such as our support form from automated abuse. To tell a person from a bot it reads your IP address and signals from your browser, and hands our server a one-time pass/fail token. It is not given your name, email, or account data, and Cloudflare does not use it to track you or serve ads.
- Flight & hotel data providers (currently SerpAPI, querying Google Flights and Google Hotels data) receive only the route, dates, party size, and search preferences needed to price a trip - never names, emails, or account identifiers.
- Airport directory sources (Duffel, OurAirports) supply the airport list we search against. No personal data is sent to them.
- Fonts. Our typefaces are self-hosted - the font files are served from SquadJet's own servers, not a third-party font CDN. Your browser never requests them from Google or anyone else, so no font provider ever sees your IP address.
- Booking sites. SquadJet doesn't sell tickets. When you click a booking option you leave SquadJet for the airline or travel site, and their privacy policy takes over from there.
Subprocessor list
The maintained list of the third parties that host or process SquadJet data, the job each one does, what it receives, and where it runs. We update this list when a subprocessor is added or removed.
- Amazon Web Services (AWS) - hosting, database, identity (Amazon Cognito), and transactional email (Amazon SES). Receives account and service data. United States.
- Stripe - payment processing for credit purchases. Receives the payment details you enter on Stripe's pages and a record of what you bought. United States.
- SerpAPI - flight and hotel pricing (querying Google Flights and Google Hotels data). Receives only route, dates, party size, and search preferences - never names, emails, or account identifiers. United States.
- Cloudflare - bot and abuse protection (Turnstile) on forms such as our support form. Receives your IP address and signals from your browser to tell human visitors from automated ones, and returns a one-time verification token. It does not receive your name, email, account details, or search data, and is not used to track you or serve ads. See Cloudflare's Turnstile Privacy Addendum. United States (global provider).
- Duffel and OurAirports - airport and airline reference data. Receive no personal data; they supply the directory we search against.
One cookie, and it's essential.
Logging in sets a single cookie (sj_id) holding your login session token.
The app sets it in your browser, it lasts one hour (refreshed automatically while you
use the site, cleared on logout), it is restricted to same-site requests, and on the
live site it is sent only over encrypted connections. It exists solely to keep you
signed in. There are no other cookies.
The bot check on our forms (Cloudflare Turnstile, section 04) uses a one-time token that is
sent with your form and then discarded - it is not a cookie and is not stored on your device.
Your browser's local storage holds your login session, saved contacts, and interface preferences. Most of it never leaves your device - the exception is the login token, which is sent to our servers with your requests (that is how you stay signed in). It is never sent anywhere else.
Kept while you have an account. Yours on request.
Account data is kept for as long as your account exists. Activity logs keep their link to your account for up to one year, which covers support, debugging, and security review. After that we strip the identifying fields and keep only anonymous usage statistics (for example, which meetup cities squads actually choose) that we never attempt to re-link to anyone. Share links delete themselves after 24 hours.
The fastest way to access, correct, export, or delete your data is your own account page: the "Your data" section packages a full copy into a ZIP you can download (one export every 5 months - each download link works for 7 days), your profile details are editable in place, and account deletion lives in the danger zone. Prefer email, can't sign in, or already deleted your account? Email privacy@squadjet.io and we'll handle it - that route is always available and is how former account holders reach their retained purchase records. Deletion removes your account and personal data. One exception: purchase records are kept for about 7 years after the purchase, as required for tax, accounting, and payment-dispute reasons, even if you delete your account. Those records are tied to a one-way scrambled identifier - it lets us match a returning purchaser, but it cannot be turned back into your email address. The same one-way identifier keeps the referral program's one-reward-per-person check working even if an account is later deleted - the record can say 'this inbox was already rewarded' without saying whose inbox it is.
The data controller is SquadJet LLC (doing business as SquadJet). You can also reach us by mail at SquadJet LLC, PO Box 813231, Smyrna, GA 30081.
We don't sell or share personal information.
For the California Consumer Privacy Act (CCPA), plainly: SquadJet does not sell personal information and does not share it for cross-context behavioral advertising, and we have not done either in the preceding 12 months. There are no ad trackers here to opt out of, so no "Do Not Sell or Share My Personal Information" link is needed - there is nothing it would turn off. We do not use or disclose sensitive personal information for any purpose beyond signing you in, so there is no use of it to limit.
In the CCPA's categories, here is everything we collect. It comes from you directly, with one exception: a squadmate may save your name, email, or home airport to their SquadBook to plan a trip with you.
- Identifiers. Your email address, optional name, and optional home airport - plus the names, emails, and airports you choose to save for travel companions in your SquadBook - and, if you use referrals, the stored connection between your account and the accounts you invited.
- Commercial information. Credit purchases and purchase history.
- Internet activity. The searches you run and the operational logs described in 02.
- Account credentials. Held by our login service (AWS Cognito) and used only to authenticate you.
Each category is used for the purposes in 01 and 02, disclosed only to the service providers in 04, and kept on the schedule in 07. No category is sold or shared, and we collect no precise geolocation and no biometric information.
California residents can ask to know and access what we hold, correct it, delete it (with the purchase-record exception in 07), or receive a portable copy. The quickest route is self-service: your account page downloads a portable copy on the spot - available once every 5 months, more often than the two requests per year the CCPA guarantees - and handles deletion directly. Or email privacy@squadjet.io from your account email address - that address match is how we verify an emailed request is yours, and we may ask a follow-up question if something doesn't line up. The email route works even if you no longer have an account, and an authorized agent may use it for you with your written permission. We answer emailed requests within 45 days (if we ever need the one 45-day extension the law allows, we will tell you why and when to expect us), and exercising any of these rights never costs you anything or changes how SquadJet treats you - same prices, same service, same features.
Accounts are for adults.
SquadJet accounts are for people 16 and over, and we don't knowingly collect data from anyone younger. Adding a child as a passenger on a search is fine - use a first name or a nickname; it's only a label.
The date at the top is the version.
If this policy changes, the effective date above changes with it, and material changes will be flagged on the site before they apply. Questions, complaints, or requests: privacy@squadjet.io.