Privacy policy

Last updated: October 31, 2026. This page describes what Sparkfare actually collects and shares today; it has not yet had a legal review, so treat it as accurate, not as legally vetted.

Sparkfare stores basic account information needed to personalize flight alerts and improve the service.

We collect your email address, saved home airport, trip preferences, and subscription status. This allows us to send relevant deal alerts and keep your saved preferences working. If you click a flight deal while signed in, we also record the destination, price, and departure date so we can track whether that fare was booked.

Your browser also stores a couple of small preferences locally (your last-selected origin city and sort order for the deal board) using localStorage. This stays on your device — it isn't sent to us or anyone else, and clearing your browser data clears it. Separately, if you arrive through a friend's referral link, we set a first-party cookie (ref) for up to 30 days so we can credit that referral if you sign up; unlike the localStorage preferences, this cookie is sent to our own server on later visits, but never to anyone outside Sparkfare.

If you use the Leave-ready checklist (/leave), the answers you pick (how long you will be away, and yes, no or skip for five questions about pets, plants, someone checking in, mail and your water shutoff) are sent to our server to build your list. We log each answer as an anonymous usage event (the question and your answer, never free text, and not linked to your email) and count how many people reach the result. If you are signed in, we also save your answers to your account so we can use them later; if you are not signed in, we do not save them on our servers. To show your open items on the Away Mode page, your browser keeps that list (the item names and the official pages, no dates and no email) in session storage for this tab only; it is deleted when you close the tab or start the checklist again. If you then sign up for deal alerts, that is the normal alert signup described above.

We do not sell personal data. We share data with the following service providers, each strictly for the purpose of running the service:

Clerk — handles sign-in and account authentication.
Resend — delivers the emails we send you (deal alerts, verification, Away Mode follow-ups). Resend also tracks whether you open an email (not what you click — click tracking is off) so we know a subscriber is still reasonably active; if an email to your address bounces or you mark one as spam, we stop sending to that address.
Cloudflare — hosts the site and stores account data in its database.
Travelpayouts — the booking-link network our fare links route through. If you click a tracked fare link, a sub-ID tied to your click is included so we can confirm whether the fare was booked; Travelpayouts is the party that ultimately processes any resulting booking, not Sparkfare.

Your browser also loads a few third-party resources directly as a normal part of loading our pages, independent of anything described above:

SparkLoop — a newsletter-recommendation widget that loads automatically on our homepage, our embeddable partner widget, and every individual route page. After you submit an alert signup, it may offer you other newsletters to join; if you opt into one, SparkLoop shares your email with that newsletter's publisher directly — we never see which, if any, you choose.
Unsplash — destination photos across the site (homepage, blog, and route pages) are loaded directly from Unsplash's own servers rather than ours.

Loading any of these sends your browser's normal request information (such as your IP address) straight to that company, under its own privacy policy — not through Sparkfare. We don't pass your email, account, or trip data to any of them ourselves.

The typefaces on our pages are served from sparkfare.com itself, not from a font service, so loading them involves no third party.

Analytics and activity logging. We keep an internal log of activity on the site — for example when you sign up, when an alert email is sent or opened, when you click a booking or Away Mode partner link, or when you refer a friend. If you use the time-off planner (/time-off), we also log that you viewed it, the range of PTO days and the set of holidays you chose (not dates), and whether you downloaded or shared the plan; those entries are not tied to your account unless you sign up from that page. If you view an embedded calendar (/time-off/embed) on an external site, we serve the schedule directly without tracking cookies, third-party analytics, or personal data collection. Each entry can include your account ID, the relevant route or partner, and a timestamp. When you first sign up, we also record a one-line consent entry (your email, the date, which signup flow it came from, and a one-way cryptographic hash of your IP address — never the IP itself) to document that you opted in; a similarly hashed IP is used briefly to prevent abuse of our referral program and our public widget. If you arrive from a link carrying a source tag (for example a launch post), we keep that tag for the rest of your browser session and record it with your signup, so we can tell which post brought you; it is not stored in a cookie and is not shared with anyone. We also count visits as daily totals, grouped by where they came from: a tagged link (for example a launch post), the kind of site that sent you (search, social, email or another site), or a direct visit. To count each visit once, your browser keeps a short note for that tab, deleted when you close it. This count stores no IP address, cookie or identifier and is never linked to you. If you sign up, we also keep that kind of source, once, next to your email address. We also keep, on your subscriber record, where you signed up (for example the homepage, the price checker, the time-off planner, a partner widget or a friend’s referral link), and we log the time you confirm your email address; our growth reports show these only as counts by source, so we can see which pages bring in subscribers who confirm. If the homepage shows the email sign-up card at the end of today’s deals, we log one entry that it was shown, with the airport you chose, how many columns it filled, whether the visit looks automated, and the time; it carries no email address, account ID or other identifier. Outbound clicks are logged with the type of partner and a coarse trip-length range (for example "7-10 days"), taken from your saved preferences when the link carries a trip you tracked, to understand which services are useful. When the link carries a trip you tracked, the entry also records your home airport, the number of travelers you saved, which part of the site the link was on and that trip's internal ID (which ties the click to that trip); without a tracked trip those fields stay empty. Each entry also notes whether the visit looks automated, such as a search crawler. Away Mode partner links carry no travel dates; a flight link to the booking site carries the route and dates of the fare you chose. We don't currently have an automatic deletion schedule for these internal logs — they're kept indefinitely unless you ask us to delete your data, as described below.

The leave-by plan and the passport check. If you use the leave-by plan (/plan) or the passport check (/passport), your plan is worked out in your own browser. The dates you enter, your answers to its questions and your passport's expiry month and year are not sent to us, saved, or put in a link. We do log that you opened the plan and which page you came from, the country you chose, how long your trip is as a range such as "7-10 days", how many items your plan listed, which items you ticked as done, and which partner link you clicked from it. We also count visits to Away Mode so we can compare the two. These entries are not tied to your account or email address, and none of them contains a date, a passport detail or anything you typed. We never ask for a passport number. If you ask for reminders, we then store your email, the dates of your trip and your answers so we can send them. We email you first to confirm, and nothing else is sent until you do; a plan you do not confirm is deleted after a week. We delete everything about a confirmed plan 30 days after your trip ends, and every reminder has a link that stops them all. To send them at the right time we also keep the home airport you chose on the site, and which items you marked done, so the email the evening before you leave can say what is done and what is still open. If you make a Home card for the person staying behind, we store the tasks and notes you type, the days of your trip and a fingerprint of the two links, until a day after the card expires, which is a week after you are back. We refuse anything that looks like a code or a password. The link is not searchable and shows no ads or partner links. When someone opens it we count the visit and nothing else about it. You can remove the card at any time and its contents are deleted.

Page measurement. Pages are measured with Cloudflare Web Analytics, which Cloudflare adds at its edge to count page views and measure how fast pages load. Cloudflare describes it as working without cookies and without following individual visitors across sites; its handling of that data is covered by Cloudflare's own privacy policy. Sparkfare does not combine it with your account or email address.

Pinterest. Sparkfare has one connected Pinterest account, its own, which we use to publish Pins. We store the access and refresh tokens for that account in encrypted form. This connection does not send visitors' or subscribers' personal data to Pinterest.

Search indexing. When we publish or update public pages, we notify search engines via the IndexNow protocol with the changed page URLs; these notifications include only public web addresses and never include personal or user data.

Push notifications. We're building an optional push-notification channel as an alternative to email; it isn't turned on for any user yet. Once available, turning it on would store your browser's push subscription (a destination address and encryption keys, tied to your account) so we can send you a notification, and turning it off deletes that record immediately.

Airport requests. If you use "Don't see your airport?" to ask for an airport, we store what you typed and a one-way hash of your IP address (used only to limit repeat requests). We do not ask for your email and we do not contact you about it; we count requests to decide which airports to add.

Plus waitlist. If you join the Sparkfare Plus waitlist (/pricing), we store your email address, the page you joined from, and the times we sent the confirmation link and you confirmed it. We use it only to tell you if Plus opens. An address that is never confirmed is not on the list. Nothing is charged and no payment details are collected. To be removed, email hello@sparkfare.com.

Long-weekend watches. If you ask to watch a long-weekend travel window (/time-off), Sparkfare stores the travel window you ask it to watch, uses it only to email you about fares for it, and deletes it 30 days after the window ends.

We retain your account data for as long as your account is active. If you unsubscribe, we stop sending alerts but keep enough of your record to honor that choice (e.g., to avoid re-adding you later). To request deletion of your data entirely, email us at the address below.

You can unsubscribe or update preferences at any time via your account or email preference center.