Privacy
This is a price watcher. It needs an email address to tell you a fare dropped, and it needs the route you asked about. That is the whole of it.
Who holds it
FlightWatch decides what is collected here and why, which makes it the data controller in the sense the GDPR means, reachable at easyflighttracker@gmail.com.
What is stored
Two different things, depending on how you use the site.
If you make a tracker without an account
A guest record with no email address on it, identified by a random token held in this browser's session cookie. Against it sit the trackers you made — airports, dates, trip lengths, passenger counts, cabin, currency, your price — the fares found for them, the price history behind those fares, and the alerts raised.
That record carries a second random token as well: the one in your recovery link, which exists so that clearing cookies does not lose your trackers. Anyone holding that link is holding the account, so it is closer to a password than to a bookmark worth sharing.
If you ask for alerts by email, the address you give is stored on that same record, with the moment you confirmed it. It is where alerts go and nothing more: it is not an account, and nobody can sign in with it.
If you make an account
The same, plus your email address and a hash of your password. The password itself is never stored and cannot be recovered from the hash — PBKDF2 over HMAC-SHA256 with a random salt — which is why a forgotten one is reset rather than sent to you.
Against either kind of record sit three more things: when it was made, when it was last used, and whether you want alerts by email, in the app, or neither. The last-used date is not a profile of your visits; it is the one field that decides when an abandoned guest record is deleted.
What is not stored
- No analytics, no tracking pixels, no advertising identifiers.
- No third-party scripts of any kind. Every page loads one stylesheet and one script, both served from this domain — enforced by a Content-Security-Policy, not by good intentions.
- No payment details. Nothing here is paid for, and booking happens on the airline or agent's own site, not on this one.
- No browsing history. This site knows which trackers are yours and nothing at all about where else you have been.
Cookies
FlightWatch sets one on everybody, and it is the session cookie. It holds a signed reference to your guest record or account and nothing else — no profile, no history, no identifier shared with anyone. There is no consent banner because there is nothing to consent to: without that cookie the site cannot know which trackers are yours, which is the only thing it is for, and a cookie strictly necessary for the service you asked for is one that needs no permission.
There is a second only if you use the light/dark switch in the header:
theme, which holds the word light or
dark and nothing else, so the next page is drawn the way you
set it. It lasts a year, and pressing the switch back to whatever your
system is set to deletes it. It is set because you pressed the switch, and
it needs no permission for the same reason.
The site sits behind Cloudflare, which may occasionally set its own
__cf_bm cookie when traffic looks automated. It exists to tell
people from bots, expires after 30 minutes, and is never read by
FlightWatch — strictly necessary in the same sense, and set by
Cloudflare rather than by this site.
Clicking through to book
Every link out of here to somewhere a fare can actually be bought goes
through /go, which writes one row and then sends you on: the
date, which of the fare sources found the price, which tracker it came off,
and the hostname you went to. Deliberately not in that row: no account, no
session, no IP address, and not the full destination URL — that one
carries a search session's tokens and the dates you are travelling on. The
only question the table exists to answer is which sources people act on, and
the route alone answers it.
No affiliate markers are attached on this instance, so the site you land on is told nothing beyond the ordinary fact of a visitor arriving from here. What it does once you arrive is covered by its privacy policy rather than this one.
IP addresses
Your address is used to rate-limit signing in, resetting a password and creating trackers, so that one visitor cannot spend the allowance meant for everybody. Those counters live in the running process's memory, expire within the minute, and are never written to the database or joined to an account. Beyond that, the hosting and CDN layers below keep their own request logs, as every web server does.
You are emailed when a fare on one of your own trackers drops under the limit, and to reset a password or answer something you asked for. Never anything else — no digest, no newsletter, no “prices may be rising”. Alerts are only ever sent to the address given for the trackers that raise them, and only once somebody who reads that address has clicked the link sent to confirm it. Every alert has a link that stops it, and Settings switches them all off.
That confirmation link is the one thing an unconfirmed address is ever sent, and any one address is sent at most three a day, however many people type it in. To count them, a keyed hash of the address — not the address — is kept for a day. Alerts to a tracker made without an account carry its recovery link, since that is the only way back to it.
How long it is kept
- Guest trackers are deleted after 30 days without a visit, along with their price history. This is automatic and needs no action from you. If their alerts go to a confirmed email address they are kept while any of them has dates still ahead — waiting for that email is the point — and the same rule applies once none has.
- Accounts are kept until you delete them.
- Price history is pruned at 120 days, whether or not the tracker that collected it is still running.
- Alerts are dropped once they are both over a year old and no longer among the newest fifty on the account — either rule alone gets it wrong, so it takes both.
- Cached fares are keyed by the question that produced them rather than by whoever asked it, and are cleared out shortly after they expire.
Deleting it
Settings has the button, once you are signed in or back in your guest session. It is a real delete, not a flag: your address, your trackers, their price history and their alerts are removed from the database outright. There is no copy kept and no undo.
Who else sees it
Fares come from SerpApi, which queries Google Flights, and from a handful of airlines' own fare endpoints. What goes to them is a route and a pair of dates. Your email address, your price limit and the fact that a particular person is watching a particular route are never sent to any of them. SerpApi answers from the United States, so those searches are handled there — carrying, as above, nothing that identifies you.
The site runs on Render, which hosts the application and its database, behind Cloudflare. Both necessarily handle the requests you make and keep ordinary server logs of them, on our behalf and for no purpose of their own.
Alerts and password resets leave through the SMTP server this instance is configured with, which necessarily sees the address and the message.
Nothing is sold, and nothing is shared for advertising.
Why it is allowed to hold it
Your email address, your password hash and your trackers are held in order to do the thing you asked for, which is the contract you entered by asking. The rate-limit counters, the click rows and the server logs are held because a site that cannot defend itself or tell what it is doing is a worse site — legitimate interests, weighed against the fact that not one of them names you. Nothing here rests on consent, because nothing here goes beyond the service itself.
Your rights
If you are in the EU or the UK, the GDPR gives you the right to see what is held about you, to correct it, to have it deleted, to take it elsewhere, and to object to anything held on the basis of legitimate interests. The delete is a button, described above. For the rest, write to easyflighttracker@gmail.com.
If you think any of it is being handled wrongly, you can complain to your national data protection authority. In the Netherlands that is the Autoriteit Persoonsgegevens; elsewhere in the EU or the UK it is the regulator where you live.
Children
This is not a service for children and nothing here is aimed at them. No account is knowingly made for anybody under 16; if one has been, write to the address above and it will be deleted.
Changes
When what the site does changes, this page changes with it, and the date below is this file's own — it moves when the text moves, not when somebody remembers to move it. Old versions are not kept.
Last updated 23 September 2026.