Privacy Policy
Last updated 2026-09-14. This describes what Travplane actually does today, not a generic template — it will be updated as the product changes.
What we collect, and why
- Account email and password. Your password is never stored in plain text — it's hashed with PBKDF2-SHA256 before it ever touches our database, and we cannot recover or view your actual password. We use your email only to identify your account; we do not currently send marketing email.
- Trip plan data. Origin, destination, dates, traveler count, and the budget numbers you enter (flight cost, accommodation, daily spending, other costs). This is stored so your plan is there when you come back — nothing here is shared with anyone else.
- A session cookie. A random token (HttpOnly, so page scripts can't read it) that keeps you signed in. It expires automatically after 30 days or immediately when you sign out.
What we don't do
- We don't run advertising trackers, third-party analytics, or fingerprinting scripts on this site.
- We don't sell or share your account or trip data with third parties.
- We never see or store your payment details — no payment happens on this site at all right now.
Third parties we do send data to
When you search flight routes or airport/city names, the route (origin, destination, dates) and your search text are sent to Travelpayouts, our flight-data and affiliate partner, to fetch real price data and airport/city suggestions. No account information (your email, password, or saved trips) is sent to them — only the specific route you're actively searching for at that moment.
Affiliate disclosure
Some links on this site — specifically, links to search or book flights — are affiliate links through the Travelpayouts / Aviasales program. If you book a flight after clicking through, Travplane may earn a commission at no extra cost to you. This doesn't influence the cached price data we show you, which comes from the same source regardless of whether you click through.
Deleting your data
You can permanently delete your account and every saved trip plan yourself, at any time, from the "My trip plan" tab while signed in — no need to contact anyone. This is a real, immediate, irreversible deletion, not a soft-delete or a request queue.
Where your data lives
Account and trip data is stored in a Cloudflare D1 database operated as part of this Cloudflare Worker. Cloudflare processes this data on our behalf as our infrastructure provider.
Changes to this policy
If what we collect or how we use it changes in a material way, this page will be updated and the "last updated" date above will change.