Privacy policy

Version 2026-11-08 · Русский · Terms of use

Who runs Enroute360

Enroute360 is run by Roman Maliushkin, a private person, who is the controller of your data. Questions and requests about your data: privacy@enroute360.app.

What we store and why

• Your email, and your Google account id if you sign in with Google, to give you an account and to send you password-reset emails.
• A password hash if you set a password. We never see or store the password itself.
• The flights you add or import, with everything you enter for them (seat, class, booking reference, notes), to show your log, statistics and map.
• Your settings: language, an optional username and whether your dashboard is public.
• Which invite link you joined through, to count sign-ups per link.
• A session cookie that keeps you signed in.

We store all of this to provide the service you signed up for, which is the legal basis (GDPR Art. 6(1)(b)). We don't sell data, show ads, build profiles or make automated decisions about you.

Who sees it

Only you can see your flight log. If you turn on the public dashboard, anyone with its address can see its statistics and map, but never your individual flights. The operator has technical access to the database and only looks at a journal if you ask.

Where it is processed

• Contabo GmbH: hosting, on a VPS in the EU.
• Cloudflare: DNS, map tiles, and forwarding of mail sent to privacy@enroute360.app to the operator's Google mailbox.
• Google: sign-in, only if you choose to sign in with Google.
• A transactional email service, used only to send password-reset emails.

Transfers to Cloudflare and Google rely on the EU–US Data Privacy Framework, with Standard Contractual Clauses as the fallback.

Cookies and logs

One cookie keeps you signed in. It is strictly necessary, so there is no consent banner. Your theme choice stays in your browser. There are no analytics or tracking cookies. To slow down password guessing, the server keeps the IP addresses of failed sign-ins in memory for a short time and does not write them to the database. The server does not keep access logs.

How long we keep it

We keep your data while your account exists. When you delete your account or ask us to, the data is removed from the database at once. Backups are kept on the server for 7 days, so deleted data is gone from all copies within 7 days. Names of airports, airlines or places you added stay in the shared list, without any link to you.

Your rights

You can ask for a copy of your data in a portable format, have it corrected or deleted, and object to how it is processed. You can export your data and delete your account in Settings, or write to privacy@enroute360.app. You can also complain to a data protection authority, for example the one where you live.

Changes

When this policy changes in substance, the version date at the top changes too.