Privacy Policy | Trigger

This Privacy Policy explains how Trigger (triggerprice.app) collects and uses personal data when you use triggerprice.app and its price-alert service. We collect only what we need to run alerts, keep the Service secure and understand how it is used in aggregate. We do not sell personal data, and we do not use advertising or tracking cookies.

1. Who is responsible

The controller of your personal data is Trigger (triggerprice.app).

Privacy questions and requests: support@triggerprice.app
Security issues: security@triggerprice.app

2. The data we collect

Account data

Your email address.
Your name, if you choose to provide it.
Your password, stored only as a secure hash. We never store your password in plain text.
Your language and currency preferences.
If you use Google sign-in, the basic account details Google shares with us to sign you in, such as your email address.

Alert data

The alerts you create and their searches: for flights, route, trip type, dates, date flexibility, cabin, maximum stops and passengers; for hotels, city or hotel, dates, guests, rooms and filters such as star class, guest rating and free cancellation.
Your target prices.
Prices we observe when checking your alerts.

Communication data

A log of the emails we send you, such as which alert an email was about and when it was sent.

Usage and security data

A log of outbound clicks to partner sites: the partner, the time, a hashed version of your IP address and your country.
A hashed version of your IP address used for security and rate limiting.
Session and security tokens needed to keep you signed in and protect forms.
Aggregate, cookieless website statistics from Cloudflare Web Analytics.

We do not collect payment details. Trigger does not sell travel or take payments; bookings happen on partner sites, which have their own privacy policies.

3. Why we use your data and our legal bases

To provide the Service (contract). Creating and managing your account, signing you in, running your alerts, checking prices and sending alert emails.
To keep the Service secure (legitimate interest). Preventing fraud, abuse and automated attacks, rate limiting, and protecting accounts. This includes Cloudflare Turnstile anti-bot checks on forms and hashed IP addresses.
To understand use in aggregate (legitimate interest). Counting visits and outbound clicks in aggregate, so we can improve the Service and account for referrals to partners. We use cookieless analytics and hashed IP addresses for this.
Where consent is required (consent). If we ever need your consent for a specific use, we will ask for it, and you can withdraw it at any time.
To meet legal obligations. Where the law requires us to keep or disclose information.

Where we rely on legitimate interest, we have considered your rights and kept the data to what is needed. You can object, as described in section 8.

4. Who processes your data

We use a small number of service providers:

Cloudflare: hosting, database, email sending, Web Analytics and Turnstile anti-bot checks. Our data is hosted on Cloudflare's global network.
Google: only if you choose to sign in with Google, to authenticate you.
Travelpayouts, Aviasales and Hotellook: our data partners for flight and hotel prices. They receive search parameters only, such as route, dates, passengers and filters, never your personal data.
SerpApi: used to confirm some prices live from Google travel results. It receives search parameters only, never your personal data.

When you click a link to a partner booking site, you leave Trigger. Some links carry an affiliate marker that identifies Trigger as the referrer. What you do on that site is covered by its own privacy policy.

We do not sell your personal data, and we do not share it with advertisers.

5. International transfers

Because our data is hosted on Cloudflare's global network, your data may be processed in countries other than your own. Where the law requires it, we rely on the transfer safeguards that our providers offer to protect transferred data.

6. How long we keep data

Account, alerts and searches: while your account exists. Alerts end automatically on the travel date.
Raw price observations: 90 days. Daily minimum prices are kept for 2 years.
Email log: 2 years.
Outbound click log: IP hashes are anonymised after 13 months.
Expired sessions and sign-in tokens: deleted.

When you delete your account, we delete your account, alerts and history.

7. Cookies

We use only cookies needed for the Service to work or to remember your preferences. We do not use advertising or tracking cookies. See our Cookies policy for a full list.

8. Your rights

Depending on where you live, you may have the following rights:

Access: ask for a copy of the personal data we hold about you.
Rectification: ask us to correct inaccurate or incomplete data.
Erasure: ask us to delete your data. You can delete your account yourself from the account page.
Portability: receive your data in a machine-readable format. You can export your data as JSON from the account page.
Objection: object to processing based on legitimate interest.
Restriction: ask us to limit how we use your data in certain cases.
Withdraw consent: where we rely on consent, withdraw it at any time.
Complaint: lodge a complaint with your local data protection supervisory authority.

To exercise a right that is not available from your account page, email support@triggerprice.app. We may need to confirm your identity before acting on a request.

9. Emails

We send alert emails and essential account emails, such as sign-in links. Every alert email has a one-click unsubscribe link. We do not send advertising emails.

10. Security

We protect your data with measures such as password hashing, secure session cookies, hashed IP addresses, rate limiting and anti-bot checks. No system is perfectly secure. If you discover a security issue, please report it to security@triggerprice.app.

11. Children

Trigger is not for children. You must be at least 16 years old to use the Service. If we learn that we hold data about someone under 16, we will delete it.

12. Changes to this policy

We may update this Privacy Policy. We will change the "updated" date at the top of this page, and for significant changes we will take reasonable steps to let you know, for example by email.

13. Contact

Trigger (triggerprice.app), support@triggerprice.app