Privacy

• Your name, nationality, email address and phone number.
• Your date of birth, and for each travel document you add: the type, the number, the issuing country and the expiry.
• Your seat preferences, the tone you asked for, and which app you want the boarding pass sent to.
• A record of each check-in we attempt: the airline, the flight, whether it worked, and whether we charged you for it.
• A Stripe customer reference and a payment method token. We never see or store your card number.

Your document number and your date of birth are encrypted by our server before they reach the database, with AES-256-GCM and a key the database never sees. Anyone reading the database directly, or a stolen backup, gets ciphertext. We keep the last four digits of a document in the clear so we can show you which one we hold.

Every decryption is written to an internal log with a timestamp. Today only the founder can perform one, and only to complete a check-in you asked for.

To perform the service you asked for, and for nothing else. We do not sell data, run advertising, share anything with brokers, or use your details to train anything. There is no analytics profile of you.

• Supabase, which hosts our database.
• Stripe, which holds your card and processes payments. They never receive your passport details.
• The airline you are flying, which receives whatever their check-in form requires, because that is the point.

That is the whole list. If it changes, this page changes with it.

Your profile stays while your account exists. Check-in records are kept for as long as we might need them for billing questions or tax, currently seven years, with the document details already encrypted throughout.

Ask and it goes. Deleting your account detaches your card at Stripe and removes your profile, your documents and your check-in history from our database. We aim to do it immediately and will confirm within 24 hours.

You can also ask for a copy of what we hold, ask us to correct something, or object to us holding it at all, in which case we stop and delete. Write to hello@nocheckin.com.

We are based in Italy and our database sits in the EU. If you are in the EU or the UK, the lawful basis for holding your document details is performance of the contract you entered into with us, and you have the rights described above under the GDPR. You can complain to your local data protection authority if we handle this badly.

If we start holding something new, or a new company starts touching your data, we will say so here and tell you in the thread we already use to message you. No quiet edits.