A demonstration that collects real data
FareSky sells nothing. No ticket is issued, no money moves, and the flights are generated rather than real. What is real is the data you type into it: if you fill in the checkout form, a name, a date of birth and a phone number go into a database, and they are as much about you as they would be on any other site.
So this page is written the way it would be for a site that did sell tickets. There are no accounts. Everything the site knows you did is tied to a session cookie in your browser, and to nothing else.
What is recorded when you book
Completing the checkout form writes one row, holding:
- the passenger’s first and last name, date of birth and gender;
- a contact email address and phone number;
- the flights chosen, the fare, and the price;
- the card’s brand and its last four digits;
- the identifier of the browser session that made it.
That last one is what My bookings looks you up by. Clear your cookies and the booking stays in the database, but this site can no longer connect it to you — and neither can you.
Your card number does reach this server
It has to be said plainly, because the opposite is what most sites say. When you submit the checkout form, the card number, the expiry date and the security code are sent to the server. They are checked there.
What is kept is the brand and the last four digits. The number itself, the expiry and the security code are never written to the database and never written to a log. If the form comes back with an error, the page is drawn again with what you typed still in the fields, including the number — that is the browser showing you your own form, not the site storing it.
Nothing is charged, because there is no payment processor here at all. Please do not type a real card number into it.
What is emailed
One thing only: a price alert for a route you asked to watch, with “Watch this route” on that route’s page. It goes to the address you gave there when the fare drops under the price you set, and it is sent through Mailtrap, a service that delivers email for us. Every alert has a link to stop it, and most mail apps also show their own “Unsubscribe” button for it.
Nothing else is emailed. No confirmation, no ticket and no receipt will arrive after a booking, however long you wait. The contact address you give at checkout is stored and never used. See ticket did not arrive.
A route you watch
Watching a route stores your address, the two cities, the cabin, the price you want to beat, the price of the last alert you were sent, and when you started watching. Stopping the alert deletes all of it for that route; the stop page can also stop every alert for your address at once.
The fare-alert list
The subscribe box in the footer stores the address you type and the time you typed it. Nothing else, and nothing is sent to it. It is not the price alerts above: those are for one route and are emailed, this list is not.
What is recorded when you search
Every search adds to a count: the two airports, the dates, the trip type and the cabin, with a running total of how often that combination has been looked for. It is what the footer’s popular routes and most-searched cities are built from.
No identifier is stored beside it. A search cannot be traced back to the browser that ran it.
Google and Yandex, if you let them
Two analytics scripts can load on every page: Google Analytics and Yandex Metrika. Both set their own cookies and both send data to their own companies, under their own policies rather than this one. Neither loads until you have said yes to the notice, and declining is final — there is no second ask and nothing loads in the meantime.
Yandex Metrika is configured here with Webvisor switched on, which records what you do on the page — mouse movement, scrolling, clicks and keystrokes — and replays it. That is more than page counting and it is worth knowing about. The cookies page lists what each one is.
What is deleted, and when
A cleanup job runs once a day and deletes what this site no longer keeps:
- a booking, 90 days after its flight departs, with its passengers, their tickets, its history and any notes on it;
- the counters that limit how often one IP address can book, subscribe or vote, once they are a day old;
- the working copies of search results, after 30 minutes;
- the record of each call to a flight supplier, after 30 days;
- a flight you saved from a supplier’s results, once its departure date has passed.
Cancelling a booking does not delete it sooner: it is marked as cancelled and kept until the same date. A price alert is deleted, with your address in it, when you stop it. The address on the fare-alert list and the search counts above have no end date.
What this page does not have
A real privacy policy names a company that answers for the data, and gives you a way to ask what is held about you and to have it removed. This project has none of those, and inventing them here would be worse than saying so:
- there is no named data controller, and no address to write to;
- there is no route in this app to request, correct or erase your data, apart from stopping a price alert;
- there is no way to have a booking removed early: it stays for the full 90 days after departure.
The practical consequence is simple, and it is the one thing worth taking from this page: treat anything you type into FareSky as staying for as long as the rules above say, and use made-up details.