Your data and Flight Outlier

1. Scope

RFL LLC operates the service under the Flight Outlier brand and is responsible for the data practices described in this notice.

This Privacy Notice applies to the Flight Outlier website, member app, travel-discovery and AI features, emails, and support interactions that link to it (collectively, the “service”). It does not apply to an airline, loyalty program, booking site, or other third party you reach through the service. Those parties control their own data practices.

The service is under development and currently available only to authorized adults in the United States for private pre-release testing. It is not available publicly or as a paid service, and current test access does not guarantee continued access or access to a future release. Section 12 explains our approach to children, and Section 11 explains where information is processed.

2. Information we collect

Information you provide

• Account and identity information: email address, optional first and last name, invite information, email-verification status, and account creation and last-sign-in times.
• Authentication information: a one-way password hash, sign-in or verification records, and session identifiers. We process a password when you submit it but do not intentionally store its plaintext form.
• Policy acceptance information: whether you accepted, the versions of the Terms of Service and Privacy Notice presented, server-calculated fingerprints of the exact policy contents, a version identifier for the acceptance screen, the server-recorded acceptance time, the account-creation or re-consent method, and your representation that you are at least 18. An initial acceptance is stored with the account. If an existing member later re-consents, the current re-consent record and up to eight limited prior records are stored in a separate account-linked evidence record; that separate current record controls re-consent status. Older evidence may remain with the account and may not contain every field used by the current acceptance flow. This is an operational account history, not an immutable or tamper-proof audit log.
• Travel-planning information: origins, destinations, dates, trip length, cabin and routing preferences, searches, watched or saved flights, saved trip files, alert settings, and other planning choices.
• Loyalty information: point or mileage balances and preferences you choose to record. Do not submit loyalty-program passwords or account credentials.
• AI and support content: prompts, conversation context, feedback, support messages, and any attachments or screenshots you choose to send.
• Communication choices: newsletter, digest, alert, and other email preferences, plus unsubscribe status.
• Privacy-request information: the request type, account email, verification and case status, case identifier, timestamps, correspondence, and limited records needed to authenticate, evaluate, fulfill, and document a request.

Information collected through use of the service

• Device and request information: IP address, browser and device characteristics, requested page or endpoint, timestamps, general network information, and similar server-log data.
• Security information: authentication outcomes, rate-limit events, session activity, suspected abuse signals, and records needed to investigate or prevent misuse.
• Product activity: feature interactions, searches, saved items, alert activity, feedback events, and clicks on travel, booking, or affiliate links.
• Browser storage: session, settings, watchlist, preference, balance, recent-conversation, and cache data stored on your device. The Cookies & Local Storage Notice explains this in detail.

We obtain this information from you, your browser or device, and the service providers involved in fulfilling a request. We may also receive travel-result and link-conversion information from travel-data and affiliate partners.

3. How we use information

We use information to:

• create and authenticate accounts, maintain sessions, and provide requested features;
• retrieve and organize travel information; maintain saves, watches, preferences, balances, and trip files; and deliver requested alerts or digests;
• generate AI-assisted responses and preserve enough conversation context for a coherent experience;
• send verification, security, service, support, and optional marketing communications;
• measure feature operation, diagnose errors, answer support and privacy requests, and improve reliability and usefulness;
• protect users and the service, enforce our Terms of Service, prevent fraud and abuse, and investigate security events;
• comply with law, respond to valid legal process, and establish or defend legal claims; and
• complete a business reorganization or transfer subject to appropriate safeguards.

We do not use the personal information described here to set the airfare, award price, or other travel price shown by a third-party provider. Providers may have their own pricing practices, which are outside our control.

4. AI prompts and conversation data

When you use the AI travel assistant, we send your prompt, relevant conversation history, and travel context needed to answer the request to Anthropic, our current AI model provider. This can include destinations, dates, preferences, point balances, and other details you place in the conversation. Anthropic processes that information for us to generate a response and may retain API inputs and outputs in accordance with its service terms, security practices, and legal obligations.

When diagnostic chat logging is enabled, Flight Outlier stores a live-service copy of an AI turn—including the question, response, conversation context, and associated grounding or diagnostic information—with an approximately 30-day expiration. Some prompts, responses, diagnostic artifacts, or encrypted service backups may also be copied into restricted internal quality-review and continuity records. Those internal copies can remain substantially longer, including in private revision history, until the applicable history or backup is purged. Access is restricted to authorized operational use.

We may review and use conversation data to evaluate and improve the service. We do not authorize Anthropic to use Flight Outlier API content for its own advertising. If our use of AI data changes materially, we will update this notice and provide any additional choice required by law.

5. Who receives information

We disclose information only as reasonably needed for the purposes above or as described when it is collected. Current recipients and categories include:

On a narrow screen, scroll this table left or right to read every column.

We may also disclose information (a) when you direct us to; (b) to comply with valid legal process or protect rights, safety, and security; or (c) as part of a merger, financing, acquisition, bankruptcy, or sale of assets, subject to applicable notice and protection requirements.

When you click to a third-party site, that party may independently collect information from your browser and under its own privacy notice. Review the destination site before submitting personal or payment information.

6. Sale, sharing, advertising, and analytics

Flight Outlier does not currently sell personal information for money or share personal information for cross-context behavioral advertising, as those terms are commonly defined by U.S. state privacy laws. We do not currently use third-party targeted-advertising or analytics cookies.

Flight Outlier may receive affiliate compensation after a user follows a disclosed link and takes a qualifying action. We treat the limited referral and conversion data involved as described above. Privacy-law definitions and our service can change; if we begin an activity treated as a sale, targeted-advertising use, or regulated “sharing,” we will update this notice and provide any required notice and opt-out mechanism before or when the practice begins.

7. Your choices and privacy requests

• Account information: update available profile, preference, alert, and saved-trip settings through the app, or email us for help.
• Email: use the unsubscribe link in an optional marketing, newsletter, weekly-digest, or saved-fare-alert email, or turn off weekly email in Preferences. Account and security messages cannot be turned off while the account remains open.
• Browser storage: clear or block storage in your browser. This can sign you out or remove device-only settings and saved data. See the storage controls.
• AI: avoid placing personal or sensitive information in prompts. You may ask us to delete eligible stored conversation data associated with your account. Historical internal revisions, backups, and processor copies require separate review and may not be removed immediately.

Depending on where you live and whether a particular privacy law applies to Flight Outlier, you may have rights to know or access, correct, delete, or obtain a portable copy of personal information; opt out of certain sales, sharing, targeted advertising, or profiling; limit certain sensitive-data uses; appeal a decision; and receive equal service after exercising a right.

The signed-in Privacy & Data section lets you download a scoped, portable JSON copy of your account data, view the policy-acceptance receipt linked to the account, revoke active sessions, reach communication preferences, and submit a verified account-deletion request. The download is designed to exclude passwords, authentication secrets, internal security controls, unrelated users' information, and records that cannot safely be disclosed automatically. You may ask us for a broader access review if the automatic copy does not answer your request.

An account-deletion submission is a request, not an instant promise that every copy has been erased. The in-app flow uses a short-lived, single-use email challenge and typed account-email confirmation. A confirmed submission creates a case and revokes existing sessions so RFL LLC can verify scope, review active systems and applicable providers, apply any legal or security exception, and document completion. Information in restricted revision history, encrypted backups, security records, suppression lists, or processor systems may require a separate process or remain where retention is permitted or required. The account-deletion page explains the process and provides a route for people who cannot sign in.

To request access beyond the automatic export, correction, AI-history review, deletion, or an appeal, contact RFL LLC at ryan@flightoutlier.com with the subject “Privacy request” and describe the request and the account email involved. We aim to make these controls available voluntarily when reasonably feasible even if a state privacy law does not apply. We may need to verify that you control the account, and we may retain or decline to delete information where an exception applies, including for security, fraud prevention, legal compliance, or establishing legal claims. We will explain a denial and available appeal route when required.

An authorized agent may submit a request where applicable law permits, but we may ask for proof of authority and direct identity confirmation. We will not discriminate against you for exercising a privacy right.

8. Global Privacy Control and Do Not Track

Browsers may send Global Privacy Control (“GPC”) or Do Not Track (“DNT”) signals. Because Flight Outlier does not currently sell personal information or use it for cross-context behavioral advertising, those signals do not currently change the service’s operation. Where applicable law requires it, we will treat a recognized GPC signal as a valid opt-out for the browser or device sending it. There is no common legal or technical standard requiring a response to DNT signals, and we do not respond separately to DNT at this time.

9. Retention

We keep personal information only as long as reasonably necessary for the purposes described in this notice, including providing the service, maintaining security and continuity, complying with legal obligations, and resolving disputes. The period depends on the data and why it is needed:

• account records and linked policy-acceptance evidence—including the current record and up to eight limited prior records—saved travel content, preferences, and password hashes are generally retained while the account is active; after a verified deletion request, we remove eligible active records and may retain limited records where needed for security, opt-out suppression, legal compliance, or disputes;
• session, verification, rate-limit, and security records are retained for their operational life and a limited diagnostic or security period;
• live diagnostic AI chat logs, when enabled, are scheduled to expire after approximately 30 days, but selected quality-review records and encrypted backups can remain in restricted private revision history for substantially longer;
• newsletter information is retained until you unsubscribe or ask for deletion, subject to suppression records needed to honor the opt-out;
• privacy verification challenges are short-lived, while a limited request and case record may be retained as reasonably needed to fulfill the request, prevent fraud, document the response, honor future restore suppression, and comply with law;
• support, feedback, and legal records are kept for as long as reasonably needed to handle the matter and protect legal rights; and
• device-only local storage remains until it expires, the app removes it, or you clear it.

Deletion from active systems does not necessarily remove a record immediately from service providers, encrypted backups, or private revision history. We will evaluate those locations for a verified request and explain any operational or legal limitation that applies. We may de-identify information so it can no longer reasonably be linked to you; we may retain and use de-identified information without the same time limit and will not attempt to re-identify it except to test our de-identification safeguards.

10. Security

We use administrative, technical, and physical safeguards designed for the nature of the private pre-release service, including encrypted network connections, hashed passwords, restricted administrative access, session controls, rate limiting, and security logging. No website, transmission, storage system, or security measure is guaranteed to be completely secure. Protect your device and email account, use a unique password, and tell us promptly if you suspect unauthorized access.

11. U.S. processing

Flight Outlier is a U.S.-focused service. Information may be stored and processed in the United States and other locations where our service providers operate. Those locations may have privacy laws different from the laws where you live. If we expand to jurisdictions that require specific transfer safeguards, we will implement the required mechanism before offering the relevant service there.

12. Children

Flight Outlier is not directed to children and is available only to people age 18 or older. The acceptance control asks a person to represent that they meet that age requirement, and the service stores that representation with the policy-acceptance record. The current private test does not ask for a date of birth or independently verify age through an identity document or third-party age check. We do not knowingly collect personal information from a child under 13. If you believe a child has submitted personal information, email us so we can investigate and delete it as appropriate.

13. Changes to this notice

We may update this notice as the service, providers, or law changes. We will post the new version here and change the version date. If a change materially expands how we use previously collected personal information, we will provide additional notice and obtain consent when required before applying the new use.