Privacy notice

Who operates the service

For data-protection purposes, the person or legal entity that operates SkyyTrust is the controller of personal data processed for the service. Privacy-rights requests can be sent directly to privacy@skyytrust.com.

Information we use

Account data includes your email address, username, authentication records and account identifiers. Public contributions can include reviews, ratings, posts, questions, comments, replies, travel details you choose to add, timestamps and resolution updates. Reports, moderation notes and account restrictions are available only to authorized moderators or service operators.

Saved posts, account preferences and grouped reply notifications are private to your account. Unpublished post and comment drafts are stored in your browser rather than sent to the server. One post draft and up to five recent comment drafts expire after seven days and are cleared when published, when you log out, or when browser storage is cleared.

Why we process personal data

We process account and contribution data to provide the service you request, including account access, publishing, replies, saved content and community features. Where EU/EEA data protection law applies, this processing is generally based on performance of the service contract or steps you request before entering it.

We also process limited data for security, fraud and abuse prevention, moderation, service integrity, debugging and protection of users. Where applicable, this is based on our legitimate interests in operating a safe and reliable community, balanced against user rights. We may process data where necessary to comply with legal obligations, respond to valid legal requests or establish, exercise or defend legal claims. Where consent is the appropriate basis for an optional feature, you can withdraw that consent for future processing.

Your email address is not displayed with public posts.

Providers, browser storage and transfers

Supabase provides authentication and database infrastructure. Cloudflare Workers and related Cloudflare services provide production hosting, delivery and security infrastructure. Airline logos that are not bundled with the app may be loaded through jsDelivr. If Google sign-in is enabled, Google and Supabase process the OAuth sign-in request. If Cloudflare Turnstile is enabled, Cloudflare processes the verification request.

SkyyTrust uses system fonts and currently does not add advertising cookies. The browser stores the login session and limited local application state needed for features such as draft recovery. Optional analytics are disabled unless enabled in production configuration; when enabled, the client is designed to exclude usernames, email addresses, post text and search queries from analytics events.

Some providers may process data outside the country where you live. Where EU/EEA transfer rules apply, transfers must rely on an applicable adequacy decision or other legally recognized safeguards, such as contractual safeguards, according to the provider and configuration in use.

Retention and deletion

Account information is kept while your account is active and for as long afterwards as reasonably necessary for account security, dispute handling, fraud prevention or legal obligations. Public contributions generally remain available until they are deleted, removed through moderation, or anonymized or disassociated where appropriate after an account-deletion request.

Moderation, abuse-prevention and security records are retained only for as long as reasonably necessary for the relevant investigation, appeal, repeat-abuse prevention, dispute or legal obligation and are reviewed periodically. Hosting and security logs are retained according to the shortest operational period reasonably necessary under the production provider settings. Deleted information can remain temporarily in backups until those backups are overwritten in the normal backup cycle; backup copies are not used for ordinary product access.

Moderation and automated signals

SkyyTrust may use automated signals to identify spam, manipulation, abuse or security risks. Significant moderation restrictions can also involve human review. SkyyTrust does not currently use solely automated decision-making that is intended to produce legal or similarly significant effects on users. If content or account access is materially restricted, you may request a review using the in-service appeal option when available or by contacting legal@skyytrust.com.

Your choices and rights

Depending on applicable law, you may request access, correction, deletion, restriction or portability of your personal data, object to certain processing, or withdraw consent where processing relies on consent. Contact privacy@skyytrust.com to make a privacy request. We may need to verify that the request relates to your account before acting on it.

You may also complain to the data-protection supervisory authority in the country where you live or work, or where you believe an infringement occurred. Do not send passwords, full identity documents, payment details or private booking information in a public post.

Children

SkyyTrust accounts are intended for users aged 16 or older. If applicable law requires parental or guardian authorization for your use of an online service, you may use SkyyTrust only with that authorization.