Privacy Policy

1. Who we are

Listy is operated by [Company/Owner name] (“we”, “us”) in the United States. This policy explains what personal information we collect when you use Listy, how we use it, and the choices you have. It applies together with our Terms of Service.

2. What we collect

Information you give us

• Account: your email address and, if you add it, your name. Passwords are handled by our sign-in provider and stored only as a secure hash; we never see them. If you use Google sign-in, we receive your name, email and profile picture from Google.
• Phone number: we ask for your mobile number once, to text you a one-time code and keep it to one account per number. We never show it to anyone, share it or use it to text you anything else.
• Profile: your home airport(s), the airline you work for or travel on, your relationship to the employee (for example employee, spouse, child, parent, retiree or buddy) and your planning preferences.
• Travelers: names and relationships of people you add to plan trips together, such as family members. Please add people only with their permission.
• Chats and trips: the messages you send, the assistant’s replies, the searches they trigger (places, dates, party size), search results, saved trips, and short facts the assistant remembers from your chats to personalize later answers (for example “usually travels with two kids”).

Information collected automatically

• Usage and logs: IP address, browser and device type, pages and features used, timestamps, errors, and counts of chats and searches used to apply daily limits and control costs.
• Cookies and local storage: see Cookies.

We don’t ask for, and you shouldn’t enter, employee ID numbers, pass or ticket numbers, payment card details, government ID numbers or passwords for other services.

3. How we use it

• To run Listy: plan trips, show results, and remember your profile, travelers, chats and saved trips.
• To process your requests with AI models and flight-schedule data.
• To keep the service secure and available: sign-in, bot checks, abuse prevention, daily limits and spending caps.
• To fix problems and improve Listy, mostly using aggregated or de-identified usage information.
• To send account emails (confirmations, sign-in links) and important notices about the service or these policies.
• To comply with the law and enforce our Terms.

We don’t sell your personal information, we don’t share it for targeted advertising, and we don’t show ads. We don’t use your chats to train AI models, and we use our AI providers under terms and settings that don’t allow them to train on your data.

4. Service providers we use

We share information only with service providers that process it on our behalf to run Listy, under contracts that limit how they can use it:

We may also disclose information if required by law or to protect the rights, safety or property of our users, the public or us, and as part of a merger, acquisition or sale of assets (in which case this policy continues to apply to your information).

5. How long we keep it

• Account, profile, travelers, chats, remembered facts and saved trips: while your account is open, or until you delete them.
• Search results: deleted automatically after about 30 days.
• Server and security logs: typically up to 90 days.
• After you delete your account, its data is removed from our live database right away and from backups within about 30 days. We keep de-identified usage counts (with no link to you) to track overall costs.

6. Your choices and rights

• See and edit: your profile and travelers are editable in the app.
• Delete: you can delete individual chats and saved trips in the app, and delete your whole account from your profile or by emailing [email protected]. We’ll confirm once it’s done, normally within 30 days.
• Get a copy: email us to ask for a copy of your data in a portable format.

Depending on where you live (for example Texas, California or another U.S. state with a privacy law), you may have rights to confirm, access, correct, delete or get a copy of your personal information, and to opt out of its sale, targeted advertising or profiling. We don’t sell personal information or use it for targeted advertising or profiling with legal effects. We honor these requests for every user, wherever you live. If we decline a request, you can appeal by replying to our decision, and if you’re not satisfied you can contact your state attorney general. We won’t treat you differently for using your rights.

7. Cookies

We use only cookies that are strictly necessary: sign-in cookies that keep you logged in (named sb-…-auth-token). We also save your light/dark preference in your browser’s local storage. We don’t use advertising or cross-site tracking cookies.

We don’t use analytics cookies today. If we add analytics later, we’ll update this policy first and ask for your consent where the law requires it. Your browser’s Global Privacy Control signal is honored as an opt-out of sale and sharing.

8. Security

Data is encrypted in transit, each account’s data is isolated with database row-level security, and access to production systems is limited. No service can promise perfect security; if a breach affects your information, we’ll notify you as the law requires.

9. Children

Listy isn’t directed to children, and you must be 18 or older to create an account. Parents and guardians may add children as travelers. We don’t knowingly collect personal information directly from children under 13; if you believe a child has given us information, contact us and we’ll delete it.

10. Where data is processed

Listy is run from the United States, and our database is hosted in the United States. Some service providers may process data in other countries under appropriate safeguards. By using Listy from outside the U.S., you understand your information will be processed in the U.S.

11. Changes to this policy

We’ll update this page when our practices change and change the date at the top. If a change is material, we’ll tell you on the site or by email before it takes effect.

12. Contact

Privacy questions and requests: [email protected]. [Company/Owner name], United States.