Privacy Policy

• Account details. Your name, email address, and password. Passwords are stored only as a salted hash; we can't read them. If you sign in with Google, we receive your name, email address, and profile photo from Google.
• Trip briefs. The trips you ask us to watch: departure airports, destination, date window, cabin, number of travelers, and the points balances you enter for each loyalty or credit-card program.
• Playbooks and usage. The award options we find for you, which ones you mark as booked or dismissed, and simple monthly counters (checks run, alerts sent) used to apply plan limits.
• Billing details. If you subscribe, Stripe collects your payment card and billing address. We never see or store your full card number. We store your Stripe customer ID, subscription status, and the date your access runs through.
• Push notification token. If you allow notifications in the mobile app, we store the device token needed to send you alerts.
• Technical data. For each signed-in session we store the IP address and browser or device type, to keep your account secure. Our hosting provider also keeps standard server logs.

We don't use advertising or analytics trackers, and we don't collect your airline or bank logins. The only cookies we set are the ones that keep you signed in.

• To run the service: check award availability for your trips, build playbooks, and alert you when an option fits your points.
• To send account email you need, such as email verification, password resets, and trip alerts.
• To process payments and apply your plan's features and limits.
• To keep the service secure, prevent abuse, and fix problems.
• To meet legal, tax, and accounting obligations.

We don't sell your personal information, share it for cross-context behavioral advertising, or use it to train AI models. We don't send marketing email unless you opt in.

We use a small number of service providers, each only for the job listed:

• Vercel hosts the website and API.
• Neon hosts our database.
• Stripe processes subscriptions and payments.
• Resend delivers our email.
• Expo delivers push notifications to the mobile app, if you turn them on.
• Google handles sign-in, only if you choose “Continue with Google”.
• Award availability data providers receive search details (routes, dates, cabin), never your name, email, or points balances.

We may also disclose information if the law requires it, to protect people's safety or our rights, or to a buyer as part of a merger or sale of the business, in which case this policy would continue to apply to your information.

We keep your information while your account is open. When you delete your account, we cancel any active subscription and remove your account, trip briefs, playbooks, sessions, and push tokens from our live database right away. Copies may remain in encrypted database backups for a limited period, typically no more than 30 days, before they are overwritten. Stripe keeps payment and invoice records as the law requires.

• Delete your account at any time from Account on the web or the Account tab in the app.
• Edit or remove any trip brief, and turn push notifications off in your device settings.
• Access, correct, or export your information by emailing privacy@awarddesk.app.

Depending on where you live (for example California or another U.S. state with a privacy law), you may have additional rights to know, correct, delete, or port your personal information and to opt out of its sale or sharing. We don't sell or share it, and we will honor these requests for every user. We will not treat you differently for making one. We may need to confirm your identity before acting on a request.

Data is encrypted in transit and at rest with our providers, passwords are hashed, and access to production systems is limited. No system is perfectly secure; if a breach affects your information, we will notify you as the law requires.

Award Desk isn't for children. You must be at least 18 to create an account. If you believe a child has given us information, contact us and we will delete it.

We and our providers process data in the United States. By using the service from elsewhere, you understand your information will be handled in the U.S.

If we make a material change, we will update the date above and let account holders know by email or in the app before it takes effect.

Rellim Enterprises LLC, Award Desk · privacy@awarddesk.app