Privacy Policy

SkyShopper is currently in beta. We may update this document as the service develops; the date at the top shows the current version. For questions, contact support@goskyshopper.com.

SkyShopper — Privacy Policy

Last updated: 25 October 2026

1. Who we are

SkyShopper ("we", "us", "our") operates the price-comparison app at goskyshopper.com. This Privacy Policy explains what personal data we collect, why, and your rights.

Data controller / fiduciary: THEAARA PRIVATE LIMITED, No. 9/1, 18th Cross, 1st D Main, B.K. Nagar, Yeshwanthpur, Bangalore 560022, Karnataka, India. Contact: support@goskyshopper.com.

2. What data we collect

Information you give us:

  • Account details: email address, name, password (stored securely / hashed by our authentication provider).
  • Trip details you enter: routes (origin, transit, destination), travel dates, carrier, terminal and gate. You can now save a trip without an account. A trip saved that way is stored against the randomly-generated device identifier described below rather than against a name or email, and it is kept on our servers, not only on your phone. If you later create an account or sign in on that device, the trips saved there become part of your account. We also record which part of the app you saved the trip from, and your device's time zone, so that any reminder you ask for arrives at a sensible hour where you are.
  • Your wishlist and "mark as bought" items.
  • Anything you send us via support/contact forms.

Information collected automatically:

  • Usage and analytics events (for example: pages viewed, products and airports viewed, the text you type into search, wishlist and "buy" clicks). Our own analytics ties these to a randomly-generated session and visitor identifier stored in your browser's local storage. If you are signed in, these events are also linked to your account. Separately, the third-party analytics and advertising tools described in section 6 do set cookies in your browser.
  • How you arrived: the referring website's domain, and campaign tags in the link you followed (such as utm_source, and the gclid / fbclid identifiers Google and Meta add to ad clicks).
  • Approximate device/browser type (derived from your request), whether you are using the website, the installed web app or the SkyShopper Android app, and basic performance and error diagnostics (error messages, the page they happened on, load times).
  • Notification details, only if you ask for reminders. If you turn on trip reminders we store a "push token" — an address issued by Google (for the Android app and most browsers) or by your browser's own notification service, which lets us send a message to that one device. We use it for nothing but the trip reminders you asked for: at most four messages per trip. We never sell it, never use it for advertising, and never send marketing with it. You can switch reminders off for one trip or for the whole device inside the app, or withdraw permission in your phone or browser settings; either way we stop, and we delete the token. We do not store the contents of notifications.
  • Our own database does not store your raw IP address; where needed for abuse-prevention, it is processed only in a hashed form. Two exceptions: our sign-in provider (Supabase) records the IP address of sign-ins in its security log, and when our advertising measurement is active for you, your IP address and browser details are sent from our server to Meta (see section 6).

The SkyShopper Android app shows this website. It adds an app identifier to your browser's user agent so we can tell app visits apart. From version 1.0.1 it also includes Google's Firebase Analytics and Meta's app SDK, which measure app installs and the same actions described above (products viewed, wishlist adds, searches and "buy" clicks) so we can tell which of our app ads work. These use your device's advertising ID. They follow exactly the same rule as our other advertising tools (section 6): off until you accept in the EU, UK, EEA and Switzerland; on by default elsewhere, and switched off when you opt out. From version 1.0.2 the app also remembers your choice on your phone, so it applies from the moment the app opens rather than only once a page has loaded. If you have not made a choice, the app checks your region the same way this website does before turning anything on. The app may once ask you to rate it, using Google Play's own rating window. Your rating and any review go to Google Play under Google's terms; we do not receive them. To decide when to ask, the app counts on your phone how many product pages you have opened and whether you have saved an item; those counts stay on your phone. We only record that the app asked. You can also reset or delete your advertising ID in your Android settings. The app does not access your location, contacts or photos.

The SkyShopper iOS app works the same way, with one difference: none of the third-party analytics and advertising tools in section 6 (Google Analytics, Google Ads, the Meta Pixel, the Meta Conversions API) run inside the iOS app, whatever your region or cookie choice. We do not track you across other companies' apps and websites from the iOS app. Our own analytics, error logging and hosting analytics (section 6) run there as they do on the website.

We do not collect payment or card information, because SkyShopper does not process transactions.

3. Why we use your data

We use your data to:

  • create and manage your account and keep you signed in;
  • provide core features (airport/route-based price comparison, wishlist, trip context);
  • improve SkyShopper — understand usage, fix errors, and monitor performance and abuse;
  • respond to your support requests;
  • send you service-related communications.

4. Legal basis / consent

Where the DPDP Act or other law applies, we process your personal data on the basis of your consent (given at sign-up and where otherwise requested) and to provide the service you have asked for. You can withdraw consent at any time (see "Your rights").

5. How we share data

We do not sell your personal data. We share it only with:

  • Service providers who host and run SkyShopper on our behalf — our hosting provider Vercel, our database and sign-in provider Supabase, and our email providers Titan (with Resend as a backup), which deliver support messages and account-deletion emails — who process data under agreements limiting their use of it;
  • Analytics and advertising providers — Google (Google Analytics and Google Ads) and Meta (Meta Pixel and the Meta Conversions API), as described in section 6. In the EU, UK, EEA and Switzerland this happens only if you accept; everywhere else it is on by default and you can opt out (see "Your choice" in section 6);
  • Authorities, where required by law or to protect rights, safety, or security.

Some providers may process or store data outside India.

6. Analytics, cookies and advertising

SkyShopper uses three kinds of measurement. Two of them set cookies in your browser.

Our own analytics — no cookies, always on. We store a randomly-generated session and visitor identifier in your browser's local storage to measure usage. These are not cookies, and on their own they do not identify you — but if you sign in, your events are linked to your account (see section 2). This analytics, and our error logging, run for every visitor whatever you choose in the cookie banner, because we need them to run and fix the service.

Hosting analytics — always on, except in the iOS app. On the website, installed web app and Android app we use Vercel Analytics and Vercel Speed Insights for traffic and performance metrics. They set no cookies; Vercel derives your approximate country from your IP address. They do not run in the SkyShopper iOS app.

Third-party analytics and advertising (website, installed web app and Android app — never in the iOS app; see section 2).

  • Google Analytics 4 (Google) — to understand how the site is used. It sets _ga and _ga_* cookies in your browser, lasting up to two years.
  • Google Ads (Google) — to measure which of our Google ads lead to visits and "buy" clicks. It uses _gcl_* cookies on this site.
  • Meta Pixel (Meta Platforms) — to measure the performance of our advertising and to show you SkyShopper ads on Meta products such as Facebook and Instagram after you have visited the site, commonly called retargeting. It sets a _fbp cookie on this site (about 90 days), and Meta also sets an fr advertising cookie on the facebook.com domain — that one is a genuine third-party cookie, set by Meta rather than by us.
  • Meta Conversions API (Meta Platforms) — the same events as the Meta Pixel, sent from our server rather than your browser, so ad measurement still works where browsers block the pixel. Each event includes your IP address, your browser's user agent, the page address, and a scrambled (hashed) form of our visitor identifier. It follows exactly the same rule as the pixel: sent only after you accept in the EU, UK, EEA and Switzerland; on by default elsewhere, and stopped when you opt out.
  • Firebase Analytics (Google) — Android app only, from version 1.0.1. Records app installs, app opens and the same actions as above, with your device's advertising ID, so Google can measure our app-install ads. From version 1.0.2 it also records the pages you view in the app (the page's address and type, such as a product page). Same rule as the tools above.
  • Meta app SDK (Meta Platforms) — Android app only, from version 1.0.1. Sends app installs, app opens and the same actions as above, with your device's advertising ID, so Meta can measure our app-install ads. Same rule as the tools above.

When you click through to buy, the click is sent to Google and Meta as a conversion — with the product's name, identifier and brand, the airport and the shop, but no price or other monetary value — under the same rule.

Google and Meta act as independent controllers for the data they collect through these tools, and may combine it with data they already hold about you. Their own privacy policies govern that use: Google and Meta.

Your choice, and how to change it. What happens on your first visit depends on where you are, which we work out from your IP address:

  • EU, UK, EEA and Switzerland — opt-in. Analytics and advertising tools (Google Analytics, Google Ads, the Meta Pixel and the Meta Conversions API) do not run until you press Accept. If we cannot tell which country you are in, we treat you this way too.
  • Everywhere else, including India, the UAE and Qatar — on by default, with an opt-out. These tools run from your first visit, and a notice at the bottom of the screen lets you press Opt out.

Whichever applies, you can change your choice at any time using Cookie settings at the bottom of this page: it clears your saved choice and brings the notice back. Opting out (or rejecting) stops these tools from running again, deletes the analytics and advertising cookies set on goskyshopper.com, and stops our server sending events to Meta. An opt-out is always honoured, in every region. Our own first-party analytics and error logging are separate and run in every region (see above).

One limit worth being straight about. Declining removes the cookies on our domain and stops the Meta Pixel loading, so its fr cookie is never renewed. But fr is set on the facebook.com domain, and no script served from this site can delete a cookie belonging to another domain. If you want that one gone, clear it in your browser. Declining is not, and cannot be, a complete erasure of everything these providers have already stored.

7. Data retention

These periods are enforced by jobs that run in our database every night; they are not just targets.

Data How long we keep it
Account and profile, wishlist, trips, purchase history While your account exists. Deleted immediately when you delete your account (see section 10). We do not delete inactive accounts automatically.
Trips saved without an account Deleted 90 days after the travel date. An undated trip saved without an account is deleted 90 days after you saved it. If the trip becomes part of an account (by signing in on that device), the row above applies to it instead.
Push notification tokens Until you turn reminders off, withdraw notification permission, or the notification service tells us the address is dead — then deleted. Otherwise 90 days after the last trip on that device has passed.
Record of reminders sent Follows its trip: deleted with it.
Usage records (pages and products viewed, searches, clicks) 90 days, then deleted automatically — sooner if you delete your account or your device's data.
Error and performance logs 90 days
Our record of events sent to Meta (see section 6) 30 days
Abuse-prevention counters (a scrambled form of your IP address, counted per day) 7 days
Messages you send through our support form 12 months from when you sent them, or sooner on request
Daily totals Kept indefinitely (see below)

Backups. Deleted data may persist in encrypted database backups for up to 7 days after deletion, after which the backup containing it is removed.

Files. We do not store any files from you — no photos, documents or uploads. The only files we hold are product images from the airport shops, which contain no personal data, so there are no files of yours to delete.

Daily totals. Each night, before any usage records or error logs are old enough to be deleted, we add up the previous day into totals — for example, how many visits, product views and searches there were per day and per airport, how many errors occurred, and how fast pages loaded. These totals contain no visitor identifier, account, IP address or search text, and they cannot be traced back to you. We keep them indefinitely so we can see how SkyShopper is used over time, and they are not changed when an account is deleted.

8. Security

We use reasonable technical and organisational measures to protect your data, including access controls and row-level security on our database, encrypted connections (HTTPS), and restricted administrative access. No system is perfectly secure, so we cannot guarantee absolute security.

9. Children

SkyShopper is not directed at children. You must be at least 18 to create an account, and we do not knowingly collect data from children.

10. Your rights

Subject to applicable law (including the DPDP Act), you may:

  • access the personal data we hold about you;
  • correct or update inaccurate data;
  • delete your account and associated personal data (see below);
  • withdraw consent for processing;
  • raise a grievance about how we handle your data.

To exercise any of these, contact support@goskyshopper.com. We will respond within a reasonable time and as required by law.

Deleting your account or your data

You can delete your account yourself, at any time, at goskyshopper.com/delete-account. In the app, go to Me → Delete Account.

  • If you are signed in, press Delete my account and confirm. Deletion happens straight away.
  • If you are not signed in (for example, you no longer have the app), enter your account's email address on that page. We email you a link that works for one hour; open it and press Yes, delete my account. The link goes only to the account's own address, so nobody else can delete your account.
  • If you never created an account, press Delete this device's data on the same page, on each device you used. Without an account we have no way to connect your devices.

Deleting your account permanently removes your account (email, password and name), your profile, your wishlist, your saved trips, your purchase history, messages you sent through our support form, and your usage and error records — including the anonymous ones recorded on the devices you used SkyShopper on. It cannot be undone. Deleted data may persist in encrypted database backups for up to 7 days after deletion, after which the backup containing it is removed. We do not store any files from you — no photos, documents or uploads. The only files we hold are product images from the airport shops, which contain no personal data, so there are no files of yours to delete.

What deletion cannot reach: if Google's and Meta's tools were active for you (see section 6), they hold the data they received under their own policies (Google, Meta). Emails already in our support inbox are deleted by hand — ask us at support@goskyshopper.com.

Grievances: questions or complaints about how we handle your personal data can be sent to support@goskyshopper.com; we will respond as required by applicable law.

11. Changes to this Policy

We may update this Policy. If changes are material, we will take reasonable steps to notify you (in-app or by email). The "Last updated" date shows the latest revision.

12. Contact

Questions or requests about your privacy: support@goskyshopper.com or via goskyshopper.com.

By creating an account or using SkyShopper, you acknowledge that you have read this Privacy Policy.

Cookie settings

This clears your saved choice and brings the cookie banner back, and removes the analytics and advertising cookies set on goskyshopper.com. One cookie (fr) is set by Meta on the facebook.com domain — no script on this site can delete it, so clear that one through your browser if you want it gone. Declining does stop it being renewed.