Your data, plainly.

01 / The short version

We collect what a flight search needs. Nothing else.

SquadJet - operated by SquadJet LLC ("we") - prices one trip for a whole group, each person flying from their own home airport. To do that we keep an account (your email), your search inputs, and a record of what you bought. We run no advertising trackers and no third-party analytics, and we never sell or share your data for marketing. Payments are handled by Stripe - card numbers never touch our servers.

02 / What we collect

Six kinds of data.

• Account. Your email address and optional name. Your password is held by our login service (AWS Cognito) and used only to sign you in - we never see or store it, and it never appears in logs.
• Searches. Party size, each passenger's home airport, travel dates, destination, and preferences (cabin class, airlines, direct-only), plus the names you type for passengers. The name field is just a label for the results - first names or nicknames are all we need, and those names are never sent to our flight-data providers.
• SquadBook. The travel companions you save - their names, and any email or home airport you add for them. They're stored with your account on our servers, so they're there wherever you sign in.
• Purchases. Which credit bundle you bought, when, and for how much. The payment itself happens on Stripe's checkout page (see 04).
• Operational logs. Service activity - logins, searches run, results picked, purchases - tied to your account email. We use these to operate the service, debug problems, and compute aggregate statistics (for example, which meetup cities squads actually choose). Logs never contain passwords, session tokens, or card data.
• Referrals. If you invite someone - by referral link, squad invite, or SquadBook invite - we keep a record connecting your account to the account they create, so we can grant each reward only once per invited person and catch abuse. That connection is stored as the same kind of one-way scrambled identifier described in 07, not as a readable pair of email addresses. Who sees what: a referral link is anonymous - the person who opens it learns nothing about you unless you tell them - while squad and SquadBook invites identify you to the person you invited, by design.

03 / What we don't collect

No cards, no trackers, no sale of data.

• No card numbers - Stripe processes payments; we receive only a confirmation of what was purchased.
• No advertising cookies, tracking pixels, or fingerprinting to profile or track you. The browser signals SquadJet itself reads are the ones our bot check (04) uses to tell a person from a bot, and they are used for that security purpose alone. Embedded third-party content receives signals of its own - see 04.
• No third-party analytics scripts watching you browse.
• No sale, rental, or sharing of personal data for anyone's marketing, ever.
• No precise location - your "home airport" is whatever you choose to type.

04 / Where your data goes

Every third party has a narrow job.

• Amazon Web Services (AWS) hosts SquadJet - our servers, database, and login service run on AWS in the United States. Your data is stored and processed in the US. Our emails (verification links, receipts, price alerts) are delivered by Resend, or by Amazon SES if we switch senders.
• Stripe processes payments. When you buy credits you are on Stripe's pages and Stripe's privacy policy applies to the payment details you enter there.
• Cloudflare runs the bot check (Turnstile) that guards forms such as our support form from automated abuse. The check runs when the page loads, not when you submit. To tell a person from a bot it reads your IP address and signals from your browser, and hands our server a one-time pass/fail token. It is not given your name, email, or account data, and Cloudflare does not use it to track you or serve ads.
• Flight & hotel data providers (currently SerpAPI, querying Google Flights and Google Hotels data) receive only the route, dates, and search preferences needed to price a trip - never names, emails, or account identifiers.
• Airport directory sources (Duffel, OurAirports) supply the airport list we search against. No personal data is sent to them.
• Fonts. Our typefaces are self-hosted - the font files are served from SquadJet's own servers, not a third-party font CDN. Your browser never requests them from Google or anyone else, so no font provider ever sees your IP address.
• Booking sites. SquadJet doesn't sell tickets. When you click a booking option you leave SquadJet for the airline or travel site, and their privacy policy takes over from there.

Subprocessor list

The maintained list of the third parties that host or process SquadJet data, the job each one does, what it receives, and where it runs. We update this list when a subprocessor is added or removed.

• Amazon Web Services (AWS) - hosting, database, identity (Amazon Cognito), and alternate email delivery (Amazon SES). Receives account and service data. United States.
• Stripe - payment processing for credit purchases. Receives the payment details you enter on Stripe's pages and a record of what you bought. United States.
• SerpAPI - flight and hotel pricing (querying Google Flights and Google Hotels data). Receives only route, dates, and search preferences - never names, emails, or account identifiers. Each traveller is priced as a single adult, so party size is not sent. United States.
• Cloudflare - bot and abuse protection (Turnstile) on forms such as our support form. Receives your IP address and signals from your browser to tell human visitors from automated ones, and returns a one-time verification token. It does not receive your name, email, account details, or search data, and is not used to track you or serve ads. See Cloudflare's Turnstile Privacy Addendum. United States (global provider).
• Resend - transactional email delivery (account, booking and support messages). Receives your email address and the contents of the messages we send you. United States.
• Google Maps - the interactive maps on SquadJet: the hotel picker on the home page, and the trip and stay pages. The map is loaded from Google in your browser, so Google receives your IP address and browser signals when a map opens. It does not receive your name, email, account details, or the contents of your searches. If the map does not load, the page still works without it. See the Google Privacy Policy for how Google handles that data. United States (global provider).
• Duffel and OurAirports - airport and airline reference data. Receive no personal data; they supply the directory we search against.

05 / Cookies & storage

One cookie, and it's essential.

Logging in sets a single cookie (sj_id) holding your login session token. The app sets it in your browser, it lasts one hour (refreshed automatically while you use the site, cleared on logout), it is restricted to same-site requests, and on the live site it is sent only over encrypted connections. It exists solely to keep you signed in. SquadJet sets no other cookies. The bot check on our forms (Cloudflare Turnstile, 04) uses a one-time token that is sent with your form and then discarded - it is not a cookie and is not stored on your device.

Your browser's storage holds your login session and a few interface preferences, such as whether you've dismissed the cookie notice. It also briefly holds things we need to finish something you started: a referral code from a link you followed, a sign-in that's in progress, a trip you asked to re-run, or an invite link you just created. Your SquadBook contacts aren't kept here. They're stored with your account on our servers (see 02).

Most of this never leaves your device. The exceptions are your login session, which is sent to our servers with your requests and to our login service (AWS Cognito) to keep you signed in; a referral code, which is sent to our servers once, after your first login; and a trip you re-run, which is sent to our servers as a new search. Nothing in your browser's storage is sent anywhere else. Logging out clears your login session and these short-lived items from this browser.

06 / Share links are public

Sharing a quote publishes it - briefly.

When you create a share link, that quote - cities, prices, and the passenger names you typed - becomes viewable by anyone who has the link for 24 hours, after which it expires and is deleted. Don't put anything in a passenger name field that you wouldn't want a link-holder to see.

07 / Retention & your rights

Kept while you have an account. Yours on request.

Account data is kept for as long as your account exists. Activity logs keep their link to your account for up to one year, which covers support, debugging, and security review. After that we strip the identifying fields and keep only anonymous usage statistics (for example, which meetup cities squads actually choose) that we never attempt to re-link to anyone. Share links delete themselves after 24 hours.

The fastest way to access, correct, export, or delete your data is your own account page: the "Your data" section packages a full copy into a ZIP you can download (one export every 5 months - each download link works for 7 days), your profile details are editable in place, and account deletion lives in the danger zone. Prefer email, can't sign in, or already deleted your account? Email privacy@squadjet.io and we'll handle it - that route is always available. Deletion removes your account and your personal data from SquadJet. Some things outlive it. Purchase records are kept for about 7 years after the purchase, as required for tax, accounting, and payment-dispute reasons, tied to a one-way scrambled identifier that cannot be turned back into your email address. The same one-way identifier keeps the referral program's one-reward-per-person check working even if an account is later deleted - the record can say 'this inbox was already rewarded' without saying whose inbox it is. And the companies that deliver our email keep their own short-term sending records, which age out on their own schedule after we have deleted ours.

The data controller is SquadJet LLC (doing business as SquadJet). You can also reach us by mail at SquadJet LLC, PO Box 813231, Smyrna, GA 30081.

08 / California privacy rights

We don't sell or share personal information.

For the California Consumer Privacy Act (CCPA), plainly: SquadJet does not sell personal information and does not share it for cross-context behavioral advertising, and we have not done either in the preceding 12 months. There are no ad trackers here to opt out of, so no "Do Not Sell or Share My Personal Information" link is needed - there is nothing it would turn off. We do not use or disclose sensitive personal information for any purpose beyond signing you in, so there is no use of it to limit.

In the CCPA's categories, this is what we collect. Most of it you give us directly. Some does not come from you: a squadmate may save your name, email, or home airport to their SquadBook to plan a trip with you, and your device sends its IP address whenever you load a page.

• Identifiers. Your email address, optional name, and optional home airport - plus the names, emails, and airports you choose to save for travel companions in your SquadBook - and, if you use referrals, the stored connection between your account and the accounts you invited. Your IP address. Your browser sends it with every request. We keep it only as a one-way scrambled value used to limit abuse, and it also reaches the bot check and the maps provider described in 04.
• Commercial information. Credit purchases and purchase history.
• Internet activity. The searches you run and the operational logs described in 02.
• Account credentials. Held by our login service (AWS Cognito) and used only to authenticate you.

Each category is used for the purposes in 01 and 02, disclosed only to the service providers in 04, and kept on the schedule in 07. No category is sold or shared, and we collect no precise geolocation and no biometric information.

California residents can ask to know and access what we hold, correct it, delete it (with the purchase-record exception in 07), or receive a portable copy. The quickest route is self-service: your account page downloads a portable copy on the spot - available once every 5 months, more often than the two requests per year the CCPA guarantees - and handles deletion directly. Or email privacy@squadjet.io from your account email address - that address match is how we verify an emailed request is yours, and we may ask a follow-up question if something doesn't line up. The email route works even if you no longer have an account, and an authorized agent may use it for you with your written permission. We answer emailed requests within 45 days (if we ever need the one 45-day extension the law allows, we will tell you why and when to expect us), and exercising any of these rights never costs you anything or changes how SquadJet treats you - same prices, same service, same features.

09 / Children

Accounts are for adults.

SquadJet accounts are for people 16 and over, and we don't knowingly collect data from anyone younger. An adult can add a child as a passenger on a search or a squad seat - use a first name or a nickname; it's only a label. We also note that the passenger is a child so searches can treat them as one. A child never has an account and can't vote or take part in a squad themselves. A child's seat is kept with the trip or squad it belongs to, and deleted when that trip, that squad, or the adult's account is deleted. People who only have an invite or share link never see a child's name.

10 / Changes to this policy

The date at the top is the version.

Changes on 2026-10-09. Since our 2026-07-10 version we've added three service providers (Cloudflare for the bot check on our forms, Resend for email, and Google Maps for maps; see 04), clarified what is kept after you delete your account and stopped offering to retrieve retained purchase records (07), corrected how we describe your browser's storage (05), and explained how we handle children added as passengers (09).

If this policy changes, the effective date above changes with it, and material changes will be flagged on the site before they apply. Questions, complaints, or requests: privacy@squadjet.io.