Privacy policy

• Account: your email address when you create an account. If you sign in with Google or Apple, we receive what the provider shares (email, and possibly name and profile picture).
• First visit at registration: to understand which channels lead to registrations, we store once the landing path without query fields, the category and host of a referrer (not its full link), and any UTM source, medium and campaign. This is used only for aggregate reporting.
• Content you save: saved trips, the journey builder and alerts (the route, date and cabin you want watched). Alerts are used to email you when award seats open.
• Subscription: if you take out a paid plan, our payment provider Stripe processes your card details. They are never stored with us. We keep only a customer reference and the subscription status.
• Anonymous usage statistics: which routes are searched, counted once per session via a random session cookie, with no link to your identity. The statistics are used to prioritise which routes we monitor. Visit statistics (Vercel Analytics and DataFast) are cookie-free and aggregated: they count page views and where the visit came from, with no cookies and no identifier that follows you once the tab is closed. If you are signed in, the visit is linked to your user id — never to your name or email. If you take out a subscription, DataFast receives the Stripe reference for the purchase, so we can see which channel it came from.
• Product analytics (only with your consent):if you consent to analytics, PostHog measures how the tools are used: which pages you open, which features you reach for, how long you stay, and which site or search engine you arrived from. PostHog processes this on servers in the EU (Germany). If you are signed in, the measurements are linked to your user ID, never to your email address; if you are not signed in, no profile is created. If you consent, we also record how you move through the pages (session replay): clicks, scrolling and navigation. Anything you type into a field is masked before it leaves your browser, so we never see what you write, and recordings are kept by PostHog for up to 90 days. If you decline, neither analytics nor recording runs, and you can withdraw your consent at any time via «Cookie settings» in the footer.
• Security check at sign-in: when you request a login code, an automated security check runs (Cloudflare Turnstile). Cloudflare receives your IP address and technical signals from your browser in order to tell a person from a script. The check protects against mass sending of login emails; it does not profile you, and is not used for anything else.

Searching and browsing without an account involves no processing beyond the anonymous statistics above, plus the product analytics if you have consented to them.

• Contract (GDPR art. 6(1)(b)): providing your account, saved trips, alerts and subscription.
• Legitimate interest (art. 6(1)(f)): operation and security, including the check that protects sign-in from abuse, and anonymous statistics to prioritise which routes we monitor.
• Consent (art. 6(1)(a)): the map loads content from Mapbox, and only does so once you have consented in the cookie settings.

• Necessary: sign-in cookies (Supabase) that keep you logged in, and a random session id that counts a route search once per session. Sign-in is per site, so you log in separately on each of our country domains.
• Visit measurement:DataFast sets no cookies. A session id is kept in the browser’s sessionStorage and is deleted when you close the tab. Because it does not survive the session it is strictly necessary for the measurement and requires no consent.
• Local storage in your browser: theme and your cookie choice. These settings stay on your device and are not sent to us.
• Temporary registration signal: the same limited first-visit information is stored locally for at most 30 days before registration. It is removed locally when bound to a new account.
• Security check: Cloudflare Turnstile may set a short-lived cookie on the sign-in page to remember that the check passed. It is strictly necessary and therefore requires no consent.
• Map (optional): map content from Mapbox loads only after consent.

You can change your choices at any time via the "Privacy and cookies" link at the bottom of the page.

We use a small set of providers to run the service:

• Supabase: database and sign-in
• Vercel: hosting and cookie-free visit statistics
• DataFast: cookie-free visit statistics
• Stripe: payment and subscriptions
• Resend: sending email (login codes and alerts)
• Cloudflare: security check (Turnstile) at sign-in
• Mapbox: map rendering, only after consent
• PostHog: product analytics and session replay in the EU, only after consent

Some providers may process data outside the EEA. Such transfers rely on a valid transfer mechanism, such as the EU-U.S. Data Privacy Framework or the EU standard contractual clauses.

Account details and content you have saved are kept until you delete them or ask us to delete the account; this includes the registration signal. Payment records are kept for as long as accounting law requires. Anonymous statistics are kept as aggregate figures.

You have the right of access to, correction of and deletion of your data, as well as restriction, data portability and to object to processing based on legitimate interest.

You can delete your account yourself under Profile. This permanently removes your profile, saved trips, journeys and alerts. If you have an active subscription, cancel it first. To exercise the other rights, email kontakt@bonusinsider.no. Requests are answered without undue delay.

If you believe we process your data incorrectly, you can complain to Datatilsynet (Norway), or to the supervisory authority in your own country of residence.

For material changes to this policy the date at the top is updated, and you are notified in the service if the change affects you. See also the terms of use.