Privacy Policy

1. Who we are

MileSeat (“we”, “us”, “our”) operates the website at mileseat.com. We provide an award flight availability search service that helps travellers find and monitor Business and First Class award seats.

If you have questions about this policy, contact us at hello@mileseat.com.

2. Information we collect

Account information

When you create an account we collect your email address and, if you sign in via Google, your Google profile name and profile photo URL. Passwords (when using email/password sign-in) are hashed and managed by Supabase — we never store your plaintext password.

Alert preferences

When you create a seat alert we store the route details you provide: airline code, origin, destination, cabin class, and date range. This is used exclusively to send you email notifications when matching seats become available.

Usage data

We may collect standard server logs including IP addresses, browser type, pages visited, and timestamps. This data is used only for security monitoring and improving the service.

3. How we use your information

• To create and manage your account
• To send you seat availability alert emails you have explicitly requested
• To improve and maintain the MileSeat service
• To respond to your support enquiries
• To comply with legal obligations

We do not sell your personal data. We do not use your data for third-party advertising.

4. Third-party services

Supabase

We use Supabase for authentication and database storage. Your account credentials and alert data are stored on Supabase infrastructure. Supabase is SOC 2 Type II certified. See Supabase's Privacy Policy.

Google OAuth

If you choose to sign in with Google, we receive your name, email address, and profile photo from Google. We do not receive or store your Google password or access tokens beyond the authentication session.

Vercel

Our website is hosted on Vercel. Vercel may process request logs as part of hosting the service. See Vercel's Privacy Policy.

5. Cookies

MileSeat uses cookies strictly necessary for authentication (session tokens). We do not use advertising cookies or third-party tracking cookies. By using the site you consent to these essential cookies.

6. Data retention

We retain your account data and alert preferences for as long as your account is active. If you delete your account or request deletion, we will remove your personal data within 30 days, except where we are required to retain it by law.

7. Your rights

Depending on your location, you may have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data
• Object to or restrict certain processing
• Data portability

To exercise these rights, email us at hello@mileseat.com.

8. Security

We use industry-standard security practices including HTTPS encryption, hashed passwords, and access controls. However, no internet transmission is completely secure and we cannot guarantee absolute security.

9. Children

MileSeat is not directed at children under 13. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

10. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will update the effective date above. Material changes will be communicated via email to registered users or via a notice on the website.