Privacy

Who is responsible

Airportly is run by Tómas Elí Stefánsson, a private individual in Denmark (not a company), who is responsible for your data (the "controller"). Contact: hello@airportly.net.

When you browse

• Our hosting provider, Vercel, processes your IP address and request details to deliver pages and protect the service. Vercel keeps its own technical logs for a short time under its own policies.
• To see how Airportly is used, we look at how many requests each page receives in our host's statistics, and count reports and flags per airport in our own database. Neither uses cookies or code in your browser.
• Airportly doesn't set cookies or use your browser's storage, and shows no ads. Pages load only from Airportly's own website; links to airports and other sources take you to those sites.

When you share a report

• Your answers are published without your name or contact details. The airport page shows each report's day and whether you were asked to take out laptops and liquids, and includes your optional answers (terminal, whether larger containers were allowed, queue time) only in its counts. For trips 2–7 days earlier, the day is approximate.
• Reports contain no names or contact details, but details such as the airport, day and terminal could, in rare cases, let someone who knows your travel plans recognise a report as yours.
• An optional private note is read only by the Airportly editor. It is never published and is deleted after 90 days, or sooner if the report is removed. Please don't include personal details.
• A keyed hash of your IP address and browser user agent is stored with the report, to limit repeat submissions and spot abuse. We don't store your IP address itself, and the hash is cleared after 30 days.
• Before a report or flag is saved, Vercel BotID runs an invisible check in your browser, using technical signals from it, to tell people from automated programs. The check doesn't set cookies or store anything in your browser.
• Sharing a report is voluntary, and you don't need to give any contact details.

When you flag a report

We store the reason you chose and the same kind of keyed hash, so one person can't flag a report repeatedly. The hash is cleared after 30 days, and the flag is deleted with the report. Three flags from different people hide a report until the editor has reviewed it. This concerns the report, not you; no decision about you is made automatically.

When you email us

We use your email address and message only to answer you or handle your request. Emails to hello@airportly.net are received in our Google Workspace mailbox, which Google runs for us as our processor. We keep them for 12 months after our last correspondence, unless the law requires us to keep them longer.

Our own logs

Airportly's logs record events such as "report accepted" or "report rejected", without IP addresses, notes or browser details.

Why we may do this

We rely on legitimate interests (Article 6(1)(f) GDPR): running a useful, honest service, keeping it free of abuse, understanding how it is used, and answering you. You can object at any time (see below). Where the law requires us to keep something longer, we keep it for that reason (Article 6(1)(c) GDPR).

Who processes it, and where

• Vercel Inc. (United States) hosts the website and provides the bot protection, so some processing may take place outside the EU/EEA. Vercel is certified under the EU-U.S. Data Privacy Framework and processes data under its data processing agreement.
• Supabase Inc. hosts the database in Frankfurt, Germany, under its data processing agreement, which includes the EU Standard Contractual Clauses.
• Google hosts our email (hello@airportly.net) in Google Workspace, as our processor under its Cloud Data Processing Addendum. Google may process email outside the EU/EEA; the addendum provides for the EU Standard Contractual Clauses or another recognised transfer mechanism.

How long we keep it

• Keyed hashes on reports and flags: 30 days.
• Private notes: 90 days.
• Reports are shown on the airport page for 30 days and included in its counts for up to 90 days. After that they are no longer shown, but we keep them (the answers and the day) for moderation and to see how Airportly is used. Each report, with any flags on it, is deleted 12 months after it was shared.
• Backup copies of the database are deleted within 30 days, so deleted data can remain in a backup until then.
• Emails: 12 months after our last correspondence, unless the law requires us to keep them longer.

Your rights

You can ask for access to, correction or deletion of your data, ask us to restrict its use, or object to it, by writing to hello@airportly.net. We reply within one month.

Reports aren't linked to an account, a name or an email address, and we don't store IP addresses. To find a report, we need you to tell us the airport, the day and your answers, or the text of your private note, and even then we may not be able to tell your report apart from someone else's. If we can't identify your data, we'll tell you; the GDPR then doesn't require us to act on the request (Article 11), unless you can give us details that do identify it. We can still remove a report you describe, for example one shared by mistake. Emails you have sent us can be found for as long as we keep them.

You can also complain to Datatilsynet, the Danish Data Protection Agency (datatilsynet.dk).

Changes

If this policy changes, the new version will be on this page with a new date. See also the terms of use.