Privacy Policy

Controller: Eloy Rubio, Zurich, Switzerland. Contact: privacy@weekendflights.app.

weekendflights.app is a commercial service. The calendar is free and needs no account. Pro is a paid plan.

Short version

• You can use the free calendar without an account.
• If you buy Pro, we store your email and your subscription status, and we set a login cookie.
• If you give us your email in a form, we use it only for the email that you asked for.
• For 30 days we keep a log of visits with your IP address, so we can see how people find the site and where they stop.
• We do not sell your data. We use no advertising cookies and no tracking cookies.

Flight prices

The prices on this site are collected automatically from public flight search results. When you open a route, our servers search for that route, those dates and your filters. That search carries no information about you: no IP address, no email and no cookie.

Pro account and login

Pro is sold through Link, a Stripe service, as the merchant of record. We never see your card number. Stripe tells us your email, your Stripe customer and subscription IDs, the session and payment IDs of a pass, your subscription status, the end of your current period and whether a payment was refunded. We store these in your account record.

To log in, you ask for a login link by email. We store the link's code only as a SHA-256 hash, and the link works once, for 15 minutes. After you pay, the checkout page can also log you in directly. When you log in, we set the wf_session cookie (see Cookies below).

When you click to buy Pro, the link to Stripe carries the random ID of your page view. This lets us see which visit led to a payment. It carries nothing else about you.

AI assistants

If you connect an AI assistant to your Pro account, we store a connection record. It holds your email in encrypted form and the assistant's access keys. An access key works for 24 hours. The connection ends 30 days after the assistant last renews it.

Email you give us

Some forms ask for your email, for example "Get weekly prices" on a route page. When you send one, we store your email, what you asked for (a route, a city or a plan) and the time. We use this data only for the email that you asked for. Legal basis: your consent (GDPR Art. 6(1)(a); FADP Art. 31(1)). To withdraw it and delete the record, email privacy@weekendflights.app.

Weekly route emails. If you ask for weekly prices on a route, we send one email to confirm the request. We store your email, the route, when you asked, when you confirmed and when we emailed you, and we use them only to send that weekly email: weekly prices, plus occasional offers for weekendflights Pro. Every email has a link to unsubscribe from that route or from all emails. We delete a request that is not confirmed within 7 days, and the consent record 12 months after you unsubscribe. We do not accept addresses from disposable email services.

Emails we send to travel writers and press

We sometimes email travel writers, website owners and journalists to present weekendflights and to ask whether they would like to write about it. We use only an email address that the recipient or their publication published on a website, and we note the page where we found it. We store the address, the name if it was published with it, that page, and the date and text of each email and reply. Legal basis: our legitimate interest in presenting weekendflights to people who write about travel (GDPR Art. 6(1)(f); FADP Art. 31(1)). We send at most two emails, a first email and one follow-up, unless you write back. You can object at any time: reply "stop" or email privacy@weekendflights.app. We then stop at once, delete the other data, and keep only your address, the date and the reason on a do-not-contact list, so that we never write to you again. If you do not object, we delete the data 12 months after our last contact.

Visit log

We measure how visitors reach the site and where they stop, so we can fix the parts that fail. Legal basis: our legitimate interest in operating and improving the service (GDPR Art. 6(1)(f), FADP Art. 31).

We write a record when a route page or an Anywhere page opens, and when its prices appear. We also write one when you open a weekend, change a filter or click a link to another flight search site. Other records mark when the Pro offer opens, when you click to buy Pro, when you ask for a login link, when we send you the login email after a payment and when you log in.

Each record stores: your IP address, the country and city that Cloudflare derives from it, approximate coordinates of that city, and whether your device is a phone or a desktop computer. It also stores the route, the Pro feature that you tried to open, the referring page, any campaign parameters in the link, the first page that you opened, a random ID for the page view, the event name and the time.

We read your browser's user-agent string to find the device type, but we do not store the string in this log. Each record also holds a visitor key: a SHA-256 hash of your IP address, your browser's user-agent string, the date and a secret key. The visitor key changes every day, so it links your records of one day only.

When you pay, we add one record with the page-view ID and no IP address. When we send you the login email after the payment, we add one more record with the same fields. This log holds no name and no email. These records are deleted automatically 30 days after they are written. Each day we also make a summary of these records, with counts, cities, visitor keys and page-view IDs. A daily summary is deleted automatically at most 31 days after the end of its day.

Cloudflare Web Analytics also counts page views. It sets no cookies.

Route pages and Anywhere pages also send speed and error reports. A report holds load times, the route, the filters in use, the weekends that you open and the links to other flight search sites that you click. It also holds your screen and window size, your browser's user-agent string and the random page-view ID. It also holds the referring page, the campaign parameters of the link you arrived on and the first page that you opened. On the Anywhere page, a report also records whether you have Pro. These reports hold no IP address and no email.

We use the speed and error reports to find slow pages and to compare the speed of the site over time. We do not delete them automatically. They stay until we delete them.

For 24 hours we also keep, for each page view, a shortened IP address (the last part removed), the city, the country, the name of your network, the Cloudflare data centre that answered and your browser's user-agent string. After 24 hours this record is deleted automatically.

To ask for access or erasure under Art. 15/17, email privacy@weekendflights.app with your IP address and an approximate time window. Art. 11 applies: without those two facts we cannot find your records.

Abuse limits

To stop abuse, we count requests per IP address on login, on the email forms, on price searches and on the AI assistant connection. Login requests also count per email, and a Pro member's assistant connection counts per account. These counters delete themselves after at most 25 hours.

Cookies and browser storage

Cookies:

• wf_session is set when you log in to Pro. It holds your email, your Pro status and an end date, signed so that nobody can change it. HttpOnly, 30 days. It is strictly necessary for your login, so it is exempt from consent under ePrivacy Art. 5(3).
• wf_ccy is set only when you pick a currency. It holds the currency code. 1 year.
• wf_lang is set only when you pick a language or close the language suggestion. It holds the language code and remembers your choice. 1 year.
• wf_anon holds a random ID with no link to your email. Our server can set it on some Pro searches. 1 year.

Your browser also keeps some data that it does not send with every request:

• In localStorage: your last filter choices (cabin, direct flights, passengers), your currency, and whether you closed or used the email card.
• In sessionStorage, cleared when you close the tab:
  • wf_touch holds the referring page, any campaign parameters of the link you arrived on, and the first page that you opened. The site sends it only to our own server, with the visit log and the speed reports.
  • Two flags: one stops the email card from showing twice, and one stops the filter error report from sending twice.
  • For each route and set of filters, the time when its price animation last ran. If you reload the same search in the next 10 minutes, the animation does not run again.

We use no advertising cookies and no tracking cookies.

Who processes data for us

• Cloudflare (US, Data Privacy Framework-certified): hosting, storage, the visit log and Web Analytics.
• Stripe, through its Link service, is the merchant of record for Pro. Stripe is a separate controller for your payment data, and its own privacy policy applies.
• Resend (US, Data Privacy Framework-certified): the login email, the confirm email and the weekly route emails.
• Google (Workspace; US, certified under the EU-U.S. and Swiss-U.S. Data Privacy Frameworks): sending our outreach emails, the inbox for emails that you send us, including replies to our outreach emails, and our outreach records.
• Zoho (EU data centre): the inbox for emails that you send us until 14 October 2026, and our first outreach emails. Those emails stay in the Zoho mailbox until we close the account.

Legal bases

Pro account, login and the AI assistant connection: to fulfil our contract with you (GDPR Art. 6(1)(b)). Invoices: our legal duty to keep business records (Art. 6(1)(c)). Visit log, speed reports and abuse limits: our legitimate interest in running, securing and improving the service (Art. 6(1)(f)). Email forms: your consent (Art. 6(1)(a)). Outreach emails: our legitimate interest (Art. 6(1)(f)).

Retention

• Login cookie: 30 days. Login link: 15 minutes.
• Account record: while you have Pro, and after that until you ask us to delete it.
• Email form records: until you ask us to delete them.
• Visit log: 30 days. Daily visit summaries: at most 31 days after the end of their day. Abuse counters: at most 25 hours.
• Speed and error reports: no automatic deletion. They stay until we delete them. The shortened IP address that we keep with them: 24 hours.
• AI assistant connection: 30 days after the assistant last renews it.
• Outreach records: 12 months after our last contact, or at once if you object.
• Do-not-contact list: while we send outreach emails.
• Stripe keeps payment records for as long as the law requires.

Your rights

You may request access, rectification, erasure, portability, restriction, or object to processing at any time by emailing privacy@weekendflights.app. We respond within 30 days. You may also lodge a complaint with the Swiss FDPIC or your local EU data protection authority.

Children

Not for users under 16.

Changes

If this policy changes, the "Last updated" date above changes too.