Your account data
This page describes the current application’s data handling. Read it before connecting an account or integration.
Data needed to run the service
Fareflare stores your username, password hash, account status, and authentication records. Session, invitation, recovery, API, and OAuth credentials are stored as hashes where they are used for authentication. A browser session uses an HttpOnly cookie.
Your monitors contain flight links, the selections derived from them, alert preferences, and notification history. Equivalent collection targets and price observations can be shared across subscribers; each account’s subscriptions and settings remain private.
Connections you choose
Connecting Telegram associates your private Telegram chat with your Fareflare account so you can manage flights and receive alerts. Button actions and pending confirmations expire after 15 minutes. Command replies may be retained for up to two days to retry failed delivery; storage cleanup can occur later. Registering a webhook stores its endpoint and delivery configuration, including a signing secret needed to sign events.
Fareflare uses AWS for hosting and storage. Google Flights is contacted to collect public prices; Telegram is contacted if you connect the bot. A configured webhook receives the events you route to it. Fareflare does not require your Google account credentials.
Sessions, diagnostics, and deletion
The application uses its session cookie to keep you signed in and a CSRF token for state-changing browser requests. It does not include an advertising tracker or third-party analytics script. Service logs can contain request metadata, errors, and operational identifiers.
Deleting your account requires your password, revokes account access, stops future monitoring and delivery for that account, and removes its Telegram association. Shared observations, operational records, and backups are managed separately; deletion does not promise immediate erasure of every historical record.
Keep private details out of public issues
Use account settings to revoke keys, disconnect applications, or delete your account. The GitHub repository accepts product questions and bug reports, but it is public. Never post passwords, invitations, recovery codes, API keys, or private Telegram details there.