Privacy

To find a swap and tell you about it, we need your flight, your seat numbers and an email address. Nothing more.

Your email address

Your address is encrypted in the database and used only to send you notifications about your registration and swap proposals. We never show it to anyone — not to the other side of a swap, not to other passengers.

What the other side sees

A swap proposal shows each side only its own seats: before the swap and after it. Nobody sees who the other side is, how many seats they have, or how to reach them.

How long

1. The registration expires

   It stops taking part in swaps 30 minutes before departure, and expires a day after the flight. If the address was never confirmed, it expires 24 hours after registering, or at departure if that comes first.

2. 7 days later

   The data that says something about you — email address, seats, wish and flight — is permanently deleted from the database.

3. 30 days later

   The entry itself disappears later, once it no longer has anyone left to explain itself to.

Deletion

You do not have to wait. Your registration page has a "Delete registration and my data" button. The registration then stops taking part in swaps, your email address is removed at once, and pending proposals are cancelled — the other side only learns that the swap did not go ahead.

Once a registration has expired, its page has a "Delete my data" button — until the automatic deletion.

Everything else goes on the dates described above.

Backups

Once a day we copy the database, so that the service can be restored after a failure — and we use the copy for nothing else. A copy is kept on the hosting for 7 days and on the backup server for 14 days, then deleted. What this page calls deleted — at once or on its date — therefore leaves the copies after 14 days at the latest.

Private links

Your registration and your proposals are reached through links in emails. Each works once and for a limited time. Opening one stores a permission in your browser and takes you to the address without the secret, so it does not reappear in server logs. Do not pass these links on to anyone.

Notifications in your browser

Only if you turn them on for a registration, we keep the address your browser's notification service gave it and the keys that encrypt the messages — nothing that names you. They serve that registration alone and are deleted when you turn notifications off, when the notification service drops them, and at the latest together with the registration's data. Email goes on either way.

Statistics

We count how the service is used on our own server, with no outside tools and no tracking scripts. A count records what happened — for example that the form was opened, which field sent it back, or which channel a visit came from when the address names one (an ad, a post, a shared link) — and the language of the page, never what you typed, your address, your seats or anything else that names you. The individual records are deleted after 14 days; only the numbers per day remain.

Account

You do not need an account. If you create one, its email address is encrypted the same way, and you sign in with a one-time link from an email, with no password.

Why we may do this

• Your flight, seats and email address — to find a swap and tell you about it, at your request: performing the service you asked for (Article 6(1)(b) GDPR).
• Keeping the service safe from abuse — limits on how often the form may be sent (counted for an hour against a keyed hash of the IP address, never the address itself) and the record of what is done in the admin panel: our legitimate interest (Article 6(1)(f) GDPR).
• Statistics that name nobody — our legitimate interest in improving the service (Article 6(1)(f) GDPR).
• Notifications in your browser — only with your consent, which you withdraw by turning them off (Article 6(1)(a) GDPR).

Who else handles it

Our hosting provider stores the database and its copies and sends our emails on our behalf — acting only on our instructions.

Like any web server, theirs writes the IP address, the time, the address of the page opened and the name of the browser to an access log. The provider keeps that log and decides how long; we look into it only to explain a failure or to check security.

We also download the database copies to our own backup server at netcup GmbH in Germany.

If you turn on browser notifications, each one is carried by your browser's notification service (for example Google, Mozilla or Apple). The content is encrypted so that the service cannot read it; the service may operate outside the European Economic Area.

If you choose a partner offer, you go to the partner's site. The partner receives only our publisher identifier and a random identifier of the click — nothing about you or your trip.

We sell and share nothing about you beyond what this page describes.

Proposals arranged automatically

Swap proposals are arranged by a program, from the flight and the seats alone. This is not profiling and has no legal effect on you — whether a swap happens is up to you.

Cookies

We use two, both needed for the service to work: a session cookie, when you open the form, send it or open a private link, and a cookie with the language you choose yourself. No advertising or tracking cookies.

Your rights

You have the right to access your data, to have it corrected, erased, restricted or transferred, and to object to processing based on our legitimate interest. Write to contact@sidebysky.com — we answer within a month.

You may also lodge a complaint with the Polish supervisory authority, the President of the Personal Data Protection Office (Prezes UODO, ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl).

Who is responsible for your data

The controller of your data is HapIT Solutions Marcin Albrecht, NIP 7651563854, REGON 364464631, ul. Poznańska 107g, 61-160 Daszewice. For anything about your data, write to contact@sidebysky.com.