Privacy

Flight Roulette is built so that the sensitive parts of your trip never reach us, and so that what does reach us stays on our own servers.

Who we are: Flight Roulette is run by Tekstak Ltd (Registered in England and Wales, company number 17154786), the data controller for everything below. Questions or requests about your data: contact us.

• Never post your boarding pass. The barcode holds your booking reference, which someone could use to change or cancel your trip. Never share a photo of it.
• Your booking reference stays on your phone. We never store or send your booking reference. Your phone turns it into a one-way code, used only to stop the same boarding pass being used twice. Booking references are blacked out of uploaded confirmations before they are stored.
• What is public. Your public run page shows your route, distances, fares and destination photos. Never your boarding pass, booking or booking reference.
• Where you are now stays private for a while. Anywhere public (the live feed, the ticker, the leaderboard, maps and your public pages), a city you have just landed in is only named once you fly on, or 6 hours after landing. A flight in the air never shows where it is going.
• Free Roam trips are private. A Free Roam trip is yours alone unless you make it public. A public trip shows only stops you have already reached, under the same 6-hour rule, and is never ranked.

What we hold, and why

• Your account: your email address (to sign you in and for game notices), your player name, optional display name, home airport, currency and units, and your passport surname. The surname is used only to check that boarding passes are yours. It is never shown to anyone else.
• Boarding passes are scanned and decoded on your phone. The image is thrown away straight after decoding; it is never uploaded or stored, and never shown publicly. We receive the flight details on the pass (route, flight, date, seat, name), not the image.
• Your booking reference (PNR) is never stored or sent in plain text. Your phone turns it into a salted one-way code, and we key it again before storing it, only to stop the same boarding pass or booking being used twice.
• Booking confirmations you upload are read by our own text reader, on our own servers (no third-party OCR service). The file you upload is never written to disk. Booking references are blacked out before anything is stored, and only our review team can see the stored copy, through links that expire after minutes.
• Destination photos are shown on your public run page. Location data inside the photo file is removed. Separately, the app records where your phone was when you took the photo, to check you were at your destination; that position is shown only to you (on your own map) and our review team. Public maps show cities only.
• Your public run page shows your player name, profile picture, route, distances, fares, destination photos and the photos you've made Public. Your newest city stays hidden until you fly on, or for 6 hours after you land.
• Free Roam trips are private unless you make one public.
• Push notifications use Google's Firebase Cloud Messaging (Apple's service on iPhone) to reach your phone; they hold a device token, not your name or email.

Your profile picture and bio

• Both are optional. Both are screened (see Moderation, below) before anyone else sees them.
• Once through, they're public: anyone can see them on your profile, your runs and trips, and in the feed. The only exception is people you've blocked.
• Your picture is cut to a square and resized, with a small thumbnail. Location data inside the file is removed.
• Your public profile shows your player name, display name, bio, home airport, country, how many friends and followers you have (not who they are), your distances, badges, countries, past season runs and your Public photos.

Photos and posts

• You choose who sees them: Only me, Friends, Public. Set it for a whole run or trip, and change it for one photo. A photo's own setting wins. On a Free Roam trip that isn't public, nothing goes further than Friends.
• EXIF is stripped: every file we store has its metadata removed, GPS position included. Photos are resized to 1600 px on the long side, with thumbnails.
• Where a photo was taken comes from your phone when you add it, never from the file, and is kept separately. It's shown exactly only to you, your trusted contact and friends you let see you live. Everyone else, friends included, sees the city.
• Photos at your newest city wait like the city does: others see them once you fly on, or 6 hours after you land. You and the people who can see you live see them straight away.
• Photos are shown through signed links that stop working after a while.

Friends and followers

• Friends are mutual. One of you asks, by player name or with an invite link, and the other accepts. Friends see each other's Friends photos and posts.
• Removing a friend takes away their access at once, to past trips and runs too.
• Followers don't need your say, and only ever see what's Public. Only the number of followers is shown, not who they are.
• Blocking works both ways: neither of you sees the other's profile, runs, trips, photos, pins or feed items, and any friendship, follow or live sharing between you ends.

Sharing where you are

• Live location sharing is off by default, and you switch it on friend by friend. A friend you share with sees your newest city straight away (no 6-hour wait), where a flight is going while you're in the air, and your exact position. Switch it off and they stop seeing it at once.
• Your trusted contact is one person you choose, for safety. You invite them and they accept. During an active run or trip they see your exact live location. Either of you can end it at any time.
• Your phone's position is sent only while the app is open, and only while someone can see you live. We keep just the latest one, replacing it each time. It's deleted after 48 hours, or as soon as nobody can see it.

Pins

• Place pins are public tips about places (sleep, getting around, food, money saver, tip). They're about places, never people. Others see a pin 6 hours after you add it, so it doesn't give away where you are now.
• I’m here and Meet here pins are private: only the friends you pick, or your trusted contact, see them. They expire after 12 hours.

Reactions

• 👏 and 🔥 on photos, posts and flights. Everyone who can see the thing sees the counts. The person you react to may get a notification that names you.

Private races

• Only the racers see a private race's runs, its board and its feed. Race runs aren't on the season leaderboards, the public feed or your public profile, and their pages don't open for anyone else.

Notifications

• The app can tell you about: friend requests; friend request accepted; a friend or someone you follow landed; you were overtaken; private race invites and results; reactions to your photos; pins a friend sends you; trusted contact changes. Each one can be switched off in the app's settings.
• A notification that someone landed names the city only to the people who can see them live. Everyone else hears once the city shows on their run.

Moderation

• Every image is screened automatically, on our own server, for nudity and violence. Nothing goes to a third party. Until the check is done, only you see the image.
• Anything flagged is held until a person on our team reviews it.
• You can report a player, a photo, a post or a place pin, and block anyone.
• Moderators can hide or remove content, or ban an account. Reports and decisions are kept with the review.

Crash reports

When the app or our servers crash, a report goes to our own error tracker (GlitchTip, running on our server at errors.flightroulette.app). Nobody else receives it.

• What's in a report: the error and where in the code it happened, the app version, the phone model, operating system version and time zone, and for server errors the kind of request (for example "POST /v1/legs/…/photo").
• What isn't: your name, email, player name or account id, your location, your IP address, anything you typed, boarding-pass or booking details, or photos. Request contents and sign-in tokens are stripped before a report is sent.
• Reports are kept for 90 days. You can switch crash reports off in the app: Profile → Settings → Send crash reports.

Usage statistics

To see where people get stuck, the app counts a few steps of the game on our own analytics server (Umami, at stats.flightroulette.app). Nobody else receives them.

• The only things counted: the opening animation watched or skipped; sign-up started and finished; a run started (and which mode and budget); a spin; a flight locked in; proof submitted; a Free Roam trip saved; the share button tapped.
• Nothing personal: no account id, email, player name, airport, city, flight, price or location is attached, and there are no cookies or advertising ids. Umami uses your IP address to work out an approximate location (country, region and city) and a visitor code that changes every day; the IP address itself is not stored.
• You can switch this off in the app: Profile → Settings → Share usage statistics. This website itself doesn't use analytics.

On your phone

• Your sign-in is kept in the phone's secure keystore.
• Screens you've opened (your run, your trips, the map) are kept on the phone so they still work with no signal.
• Proof you add with no signal (a boarding-pass scan, a booking confirmation, a destination photo) waits on the phone until it can be sent, then is deleted from the phone. Signing out or deleting your account clears all of it.

Other services

• Maps are drawn from our own map files; no map company sees where you look.
• Booking links open the airline's or booking site's own page; what you do there is between you and them. We never take bookings or payments.
• Accommodation: the app shows sample listings, and links to Booking.com and Airbnb searches. Those sites see that you came from us.
• Fonts on this website are served from our own server; no font service sees your visit. Run and trip pages load the map library from the cdnjs and jsDelivr networks, which see your IP address when those pages load. This website sets no cookies (see Cookies).
• We don't sell or share your data with anyone, and there is no advertising.

Your data, your choice

• Download my data: in the app, Profile → Download my data gives you a ZIP of everything we hold about you (as JSON files, plus your photos and profile picture), and emails you the link. It includes your profile and bio, runs, trips, posts, photos and where they were taken, friends, who you follow and block, your trusted contact, your reactions, your pins and your private races. The link works for 24 hours.
• Delete my account: in the app, Profile → Delete my account. Without the app: flightroulette.app/delete-account, with a code sent to your email. Deleting removes your account, profile picture and bio, runs, flights, photos and posts, booking copies, trips, friends, follows, blocks, your trusted contact, reactions, pins, your places in private races, and feed items, and takes you off every leaderboard, straight away. Copies in our server backups are removed when those backups are replaced.
• We keep your data while you have an account. Sign-in codes are deleted after a day, private pins after 12 hours, your phone's live position after 48 hours at most, and crash reports after 90 days.
• Under UK GDPR you can also ask us to correct your data, or complain to the Information Commissioner's Office (ico.org.uk).

Questions: contact us from the email address on your account.