Privacy

The data controller is Denys Zvarych, a private individual running the Uwillfly service. Contact for anything concerning data: kontakt@uwillfly.net.

• Two identifiers in cookies. One for the conversation, one for the browser. Both are set by the server, marked HttpOnly and unreadable by scripts on the page.
• A visit-source marker — written only when you arrived through a tagged link, for example from a social media post. The cookie holds just the campaign name and the domain of the site you came from, so we know which links work. This one is written by the browser, so it is not marked HttpOnly. It contains no data about you, is not used for advertising and is not passed on.
• Your chosen language — if you change the language without signing in, we store just its code in a cookie (pl, en or uk) so the service still speaks that language after a page refresh. The browser writes it, so it is not marked HttpOnly. Once signed in, the same information goes to your profile.
• An account, if you have one: the email address and display name from your Google account, or — for an account with a password — a username and a password hash (scrypt; we store no password in any reversible form).
• The content of conversations and searches — what you type into the chat, plus the parameters of flight queries and the routes you build.
• Events in the service: card clicks, results opened, visit duration. They are used to judge which parts of the service work.
• A hash of your IP address — not the address itself. The address is passed through a hash function with a secret value and only the result reaches the database. We use it solely for the daily cost limit, never to identify people or for statistics.

We do no advertising profiling and embed no ad-network scripts.

• So that search works and the conversation remembers earlier questions.
• So that signing in means something — an account has to recognise its owner.
• To limit costs: every query to the language model and to the flight data supplier costs money, so we count them per day per person, per network and in total.
• To know what in the service works and what does not.

The service would not run without a few suppliers. Each receives only what its task needs:

• Anthropic — the content of the conversation goes to the language model that interprets the question and comments on the results.
• Kiwi.com — the search parameters (cities, dates, number of people). After you click "Select" you go to the Kiwi.com site and their privacy policy applies from there.
• Supabase — the database where all of this is stored.
• Stay22 — after you click "Find a place to stay" on the route summary screen, you go to the partner's site with the city name, stay dates and number of people in the address; from there the privacy policies of Stay22 and of Booking.com, which Stay22 redirects to, apply. Nothing is sent before the click.
• Vercel — hosting of the application.
• Mapbox — turning city names into coordinates for the route map.

Some of these suppliers process data outside the European Economic Area. We sell data to nobody and share it with nobody beyond this list.

• Personal data — 90 days from when it is saved. After that it is deleted automatically.
• Saved search results — 24 hours. They are large and go stale fast.
• Completed routes stay longer, but the person's identifier is cut from them: after 90 days they are cities, dates and prices with no link to anyone.
• Daily cost counters — 90 days.

You have the right to access your data, to have it corrected or deleted, to restrict its processing and to object. Deleting your account deletes the messages, searches, events and saved routes linked to it; completed routes remain in the database with the identifier removed.

To exercise any of these rights, write to kontakt@uwillfly.net. You may also lodge a complaint with the President of the Personal Data Protection Office (UODO), the Polish supervisory authority.

We use only the cookies the service needs to work: the conversation identifier, the browser identifier, the chosen language, the visit-source marker and — once signed in — the session cookie. There are no advertising or analytics cookies from third parties, which is why we show no consent banner: there is nothing to consent to.

We also use a measurement tool from Vercel, where the service is hosted. It measures page loading speed and nothing else. It stores no cookies or identifiers in the browser, is not linked to your conversation or account and is not used for advertising. It receives the page address, the country derived from the IP address, and the browser and device type.