Privacy policy
Last updated 15 October 2026
In short: Wingman keeps only what it needs to watch your flights and reach you. Your data is stored in the EU, nobody gets it for their own purposes, the app has no tracking or advertising (the landing page counts visits without cookies and has partner links only if you allow them), and you can delete your account and everything in it at any time.
Who runs Wingman
Wingman (wingmanfares.com and the app at app.wingmanfares.com) is run by Roman Princ, who decides what happens to your personal data: the controller, in the words of the GDPR. Write to hello@wingman.princdev.com with any question or request about your data.
What Wingman keeps, and why
If you join the waitlist
Your email address, the language of the page, when you joined and confirmed, when you were invited and how many emails Wingman has sent you. They're used for one thing: confirming your sign-up and telling you when you can join. The legal basis is your consent, which you can withdraw at any time with the link in Wingman's emails.
If you have an account
- Account: your email address, your name if you give one, your password (only as an Argon2 hash, which can't be turned back into the password), your plan and language, and when you created the account and last signed in.
- Your watches: the routes, dates, limits and target prices you enter, and the flights, prices and price history Wingman finds for them.
- Alerts: whether you want alerts by email, and for each device you switch notifications on for, the address its browser gives Wingman to reach it and the keys to encrypt alerts for it (no other device details).
- Sign-in sessions: a fingerprint (hash) of the random key in your sign-in cookie, when the session started, when it was last used and when it expires. No IP address or device details.
- Usage: how many searches your watches made each day, to keep to your plan.
All of this is needed to provide the service you signed up for, which is the legal basis (performance of a contract).
For everyone
- Email records: which kind of email went to which account and when, without addresses or content, so that Wingman never sends more than a sensible number.
- Server logs: the web server notes each request's IP address, time, address and browser identification, used only to keep Wingman running and to deal with attacks and abuse.
The legal basis for these two is a legitimate interest in running a secure, reliable service.
The app uses no analytics, advertising or tracking of any kind, and Wingman doesn't sell your data or share it with anyone for their own purposes. The landing page counts its visits with Umami, which runs on Wingman's own server in Frankfurt: no cookies and nothing that identifies you, only which pages are opened, from which site, and the country, language and kind of device and browser. It loads partner links only if you allow them: see Partner links on the landing page.
Flight searches
Wingman searches Google Flights from its own server. Google sees only the route, the dates and the search settings, never who the search is for.
Who else handles your data
- Oracle Cloud Infrastructure hosts Wingman's server in Frankfurt, Germany. Everything above is stored there, including the backups.
- Resend delivers Wingman's emails: waitlist confirmations, invitations, password resets and email alerts. It receives each recipient's address and the email itself. Resend is based in the United States; the transfer is covered by the EU standard contractual clauses in its data processing agreement.
- Your browser's push service delivers the notifications you switch on for a device: Apple for Safari and iPhone, Google for Chrome and Android, Mozilla for Firefox, Microsoft for Edge. Each alert is encrypted for your device before it leaves Wingman's server, so the push service learns only that a message went to that device and when, not what it says. These companies are based in the United States.
Partner links on the landing page
Wingman is a partner of Travelpayouts, an affiliate network of travel companies. The landing page (wingmanfares.com) asks whether you allow partner links. Only if you say yes does it load Travelpayouts' script, Drive, which can turn links to travel companies into partner links and add travel suggestions, so that Wingman earns a commission when you book through one of them.
Your browser then talks to Travelpayouts directly: Travelpayouts sees your visit (your IP address, your browser and the pages you open), and it and the travel companies may set cookies to tell that a booking came through Wingman. They do this under their own policies, as controllers in their own right: see Travelpayouts' privacy policy. Wingman learns from them which bookings earned a commission, not who made them. The legal basis is your consent.
If you say no, nothing is loaded and no cookies are set. Your answer stays in your browser's local storage, and you can change it at any time: Cookies set before you changed your mind stay until they expire or you delete them in your browser.
How long it's kept
| What | For how long |
|---|---|
| Waitlist, not confirmed | Deleted after 7 days. |
| Waitlist, confirmed | Until you remove your address with the link in Wingman's emails, or ask us to. |
| Account, watches, alerts | Until you delete your account. Daily search counts older than 400 days are deleted sooner. |
| Sign-in sessions | Until you sign out, or 30 days after you last used Wingman. |
| Notifications on a device | Until you switch them off there, sign out there or delete your account, or the push service reports the device gone. |
| Password reset links | Work for 60 minutes; deleted a day later. |
| Invitations | Work for 14 days; unused ones are deleted 30 days after that. |
| Email records | 30 days. |
| Server logs | 14 days. |
| Backups | A copy of the database every night, kept for 14 days. Deleted data is gone from the backups 14 days later. |
Your rights
You can ask for a copy of your data, have it corrected or deleted, restrict how it's used, get it in a machine-readable form to take elsewhere, and object to uses based on a legitimate interest. You can withdraw your consent to the waitlist or to partner links at any time.
Much of this you can do yourself: change your name, alerts and password in Settings, delete your account there (it deletes your watches and history right away), and leave the waitlist with the link in Wingman's emails. For anything else, including a new email address, write to hello@wingman.princdev.com. You'll get an answer within a month.
You can also complain to a data protection authority: in the Czech Republic, the Office for Personal Data Protection (uoou.gov.cz), or the one where you live.
Cookies and browser storage
wingman_session: a cookie that keeps you signed in to the app, for up to 30 days. Scripts can't read it.sidebar_state: a cookie that remembers whether the app's sidebar is open, for 7 days.- Your chosen language and colour theme, in your browser's local storage.
- A service worker: a small script of Wingman's that your browser keeps to show notifications. It stores nothing.
They're all Wingman's own and none of them track you. The landing page keeps the language you pick in its menu and your answer about partner links, in your browser's local storage; Travelpayouts' cookies come only if you allow partner links (see above). Which language you see first is decided in your browser from its time zone and language settings; nothing about it is sent anywhere.
Security
Everything travels over HTTPS. Passwords and sign-in keys are stored only as hashes, the database isn't reachable from the internet, and the server takes logins only with keys, not passwords.
Changes to this policy
If this policy changes in a way that matters, account holders hear about it by email before the change applies. The date at the top always shows the current version. See also the terms of use.