Privacy Policy

1. Plain-English summary

Departure Club is a flight search tool. We collect the minimum information needed to deliver the service: your account details so you can sign in, the searches you run so we can show you results and (optionally) alert you to new availability, and the routes you save as favourites. We don't sell your data, we don't show third-party ads, and we don't use behavioural tracking.

2. What we collect

• Account details — your email address and authentication credentials (managed by our auth provider, Supabase). We don't store passwords in plain text.
• Search history — origin, destination, cabin, dates, program filters, and timestamp for each search you run. Used to log activity to your account and to power "recent searches".
• Saved routes (favourites) — the routes you save with the heart icon, including a snapshot of the route details at the time you saved it.
• Flight alerts — the search criteria for any alerts you create, so we can email you when matching reward seats appear.
• Subscription / billing — if you join a paid plan, payment processing is handled by Stripe. We receive a customer reference and subscription status, but never your card details.
• Essential cookies / local storage — used to keep you signed in and to remember your search preferences (last search, map open/closed state). No analytics or advertising cookies.

3. How we use it

• To deliver and improve the search experience.
• To send the email alerts you've explicitly opted into.
• To process subscription payments (via Stripe).
• To respond to support enquiries you send us.

We do not use your data for behavioural advertising, sell it, or share it with brokers.

4. Sub-processors

The third-party services we rely on to run Departure Club:

• Supabase — authentication and database.
• Stripe — subscription billing (if you have a paid plan).
• Vercel — hosting and content delivery.
• Seats.aero — reward flight availability data.
• Duffel — cash fare pricing for hybrid routes.
• An email provider (TBC) for transactional emails and alerts.

Each of these providers has their own privacy practices, which we encourage you to review. We do not knowingly route data to providers outside the AU/EU/US.

5. Your rights

You can access, update or delete your account and the data associated with it at any time from the Account page, or by emailing us. If you're in a jurisdiction with formal data rights (e.g. the Australian Privacy Act, GDPR), those rights apply in full.

6. Data retention

We keep account-linked data for as long as your account is active. When you delete your account, all rows referencing your user ID (favourites, alerts, search history) are cascade-deleted from our database. Anonymised analytics (e.g. aggregate query counts) may be retained.

7. Security

Data in transit is encrypted via HTTPS. Data at rest is stored in Supabase's managed Postgres, which enforces row-level security so that each user can only access their own rows. No system is 100% secure — if you believe your account has been compromised, contact us immediately.

8. Children

Departure Club is intended for users aged 16 and over. We don't knowingly collect data from children.

9. Changes to this policy

When we make material changes we'll update the "Last updated" date at the top of this page and notify active users by email.

10. Contact

Questions about this policy or about your data: hello@departureclub.au (replace with your preferred contact when ready).