Privacy Policy

Last updated: September 6, 2026

Introduction

GlobePilot (“we,” “our,” or “us”) is committed to protecting your privacy. This Privacy Policy explains how we collect, use, and safeguard your information when you use our website at globepilots.com and our travel planning tools.

By using GlobePilot, you agree to the collection and use of information in accordance with this policy. If you do not agree, please discontinue use of our services.

Data We Collect

We are designed to be privacy-friendly. Here is what we collect and store:

Account Data

If you create a GlobePilot account, we collect the following information depending on your sign-up method:

  • Google OAuth — Your name, email address, and profile picture as provided by Google.
  • Email/password — Your email address, display name, and a bcrypt hash of your password. We never store your password in plain text.

Saved Activity & Profile Data

When you use GlobePilot while signed in, we store your saved trips, Travel Passport stamps, badges, streak data, destination quiz results, and leaderboard entries in our database so they persist across sessions and devices.

Local Storage (Browser-Side Only)

We use your browser's localStorage to save preferences and session data that never leaves your device. This includes your preferred currency, default origin airport, recent search history (origin airports, budget preferences), and trip history. You can clear this data at any time through your browser settings.

Search History

When you use our tools, we may temporarily cache your search parameters (origin airports, destination preferences, budget ranges, travel dates) on our server to improve performance. Server-side search caches are automatically cleared after 1 hour.

Third-Party Services

We integrate with the following third-party services to provide our travel planning tools:

  • SerpApi — Provides Google Flights and Google Travel Explore data including live flight prices and destination suggestions. We send origin/destination airports, dates, and budget parameters. No personal data is shared. SerpApi Privacy Policy.
  • TravelPayouts — Provides affiliate flight search results and booking links. We send origin/destination airports and travel dates. TravelPayouts may set cookies when you click booking links.
  • DeepSeek AI — Generates mystery destination itineraries, hotel recommendations, and local tips. We send destination names, budget tier, and travel preferences. No personal data (name, email, account info) is sent to DeepSeek.
  • Supabase — Our database and infrastructure provider (PostgreSQL). Stores user accounts, saved trips, and activity feed data in the EU (Frankfurt). All data is encrypted at rest and in transit.
  • Google OAuth — Powers “Sign in with Google” authentication. We receive your name, email address, and profile picture from Google. We do not access your Google contacts, calendar, or any other Google data.
  • PostHog — Provides optional product analytics and session replay after you choose “Allow analytics.” Form inputs and all rendered text are masked in replays, and URL query strings are removed before capture. We use a random anonymous identifier unless you sign in, when your internal account ID connects sessions. We do not send your email address or name to PostHog.
  • Frankfurter API — Provides currency exchange rates (free, open-source). No user data is sent — only currency codes.
  • Open-Meteo — Provides weather forecast data for destinations. No user data is sent — only destination coordinates.
  • Wikipedia — Provides nearby attraction information. No user data is sent — only destination coordinates.
  • Pexels — Provides destination photos. No user data is sent — only destination names.
  • Resend — Handles transactional emails including contact form replies and price alert notifications. We send your email address to Resend for delivery purposes only.

Cookies & Local Storage

GlobePilot uses a cookie consent banner to give you control over cookie usage. Here is how we use cookies and browser storage:

  • Essential cookies — Used for authentication sessions when you sign in to your account.
  • Affiliate cookies — Third-party booking partners (e.g., TravelPayouts) may set cookies when you click affiliate links.
  • localStorage — We store your preferred currency, default origin airport, and trip history in your browser's localStorage. This data never leaves your device and can be cleared at any time via your browser settings.
  • Optional analytics — PostHog analytics and privacy-masked session replay load only after you allow analytics. You can decline them and still use GlobePilot.

We do not use analytics for advertising or build advertising profiles.

Data Retention

  • Account data — Retained until you request deletion of your account. You can request account deletion at any time by emailing us.
  • Saved trips & profile data — Retained as long as your account is active. Deleted when your account is deleted.
  • Server-side search cache — Automatically cleared after 1 hour.
  • localStorage data — Controlled entirely by you. Persists until you clear it through your browser settings or our in-app controls.

Affiliate Links

GlobePilot contains affiliate links to third-party booking platforms. When you click these links and complete a purchase, we may earn a commission at no additional cost to you. These affiliate partners may use their own cookies and tracking technologies, which are governed by their respective privacy policies.

Analytics

Vercel Web Analytics provides aggregate, cookie-free traffic measurement. If you allow optional analytics, our first-party Supabase event store and PostHog record page views and feature interactions; PostHog also provides device and referral breakdowns and privacy-masked session replays so we can find usability problems. Inputs and page text are masked and URL query strings are stripped before replay data is sent. You can change your preference at any time.

Data Security

We take reasonable measures to protect your information. Browser-stored data remains on your device. Server-side personal data (account information, saved trips) is stored in the European Union (Frankfurt) and protected through industry-standard encryption and security practices provided by Supabase. Passwords are hashed using bcrypt and are never stored in plain text.

Your Rights

Under the General Data Protection Regulation (GDPR) and similar privacy laws, you have the following rights:

  • Right of Access — You may request a copy of the personal data we hold about you.
  • Right to Rectification — You may request that we correct inaccurate or incomplete data.
  • Right to Erasure — You may request that we delete your personal data, including your account and all associated data. For locally stored data, you can clear your browser's localStorage at any time.
  • Right to Data Portability — You may request your data in a structured, machine-readable format.
  • Right to Object — You may object to the processing of your personal data at any time.

To exercise any of these rights, including account deletion, please email us at privacy@globepilots.com. We will respond to all requests within 30 days.

Children's Privacy

GlobePilot is not intended for children under the age of 13. We do not knowingly collect personal information from children. If you believe we have inadvertently collected data from a child, please contact us and we will promptly delete it.

Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated “Last updated” date. We encourage you to review this policy periodically.

Contact Us

If you have any questions about this Privacy Policy or wish to exercise your data rights, please contact us at:

privacy@globepilots.com