Privacy Policy

Last updated: 28 October 2026

This policy explains what information TripCheap ("we", "us") collects when you use this site, and how it's used. Chapelgate is the controller responsible for this personal data.

What we collect

When you run a search, we store the search parameters you enter:

• Departure airport and, if you choose one, destination airport
• Earliest and latest departure dates and the number of nights
• The results returned for that search
• A generated search reference, creation and update times, search status and any error message

You can use the search feature without an account, email address or payment details. A search record also has a user-reference field, which may be empty.

Optional accounts

Account registration and sign-in API routes are reachable. If you use registration, the account code accepts your name, email address and password, stores a password hash, account references and timestamps, and creates verification, password-reset or magic-link tokens and related times when those flows are used. The mailer attempts to send account emails. We have not verified successful registration or email delivery on the live service. These account routes are separate from using flight search without an account.

Technical data

Our application writes operational logs, including timestamps, severity, messages, request references, HTTP method, request URI and browser user agent. A request URI may include search parameters or an account verification or sign-in link token. Account registration failures and verification-email resend paths can log an email address at information level; some other account paths log email addresses at debug level. Search and link event fields are described below. The inspected application logs have no client-IP field. Our edge server does not currently have request access logging enabled; it writes runtime and TLS logs instead.

Container logs currently have no configured time or size rotation. They remain until the container is removed or recreated, rather than for a fixed period. Host root administrators and people with hosting-console access can access them. We have not identified every individual with that access.

Search and link events

Separately from the page view counts below, our pages send first-party event messages when you view certain pages, start or complete a search, get no results or an error, or click certain search and travel links. These help us understand the search flow. The application writes these events to its operational log. Depending on the event, the fields include the event name, page path, airport, month, source page type, search/result reference, link position, provider, destination and error category. The event payload does not include an IP address, browser identifier or cookie identifier. The surrounding request log can still include the URI and browser user agent described above. These event messages are not gated by the optional-script consent choice and do not currently check Global Privacy Control or Do Not Track signals. The opt-out described under Page view counts applies only to that separate daily counter.

Page view counts

We count how many times each type of page is viewed, per day, to see whether the site is being used and to improve it. We store only a date, a page type (for example "home" or "destination guide") and a number. We do not store your IP address, user agent, cookies, search terms or the exact page address for this count, and nothing is stored on your device for it. These counts include repeat views and automated visits, so they are page views, not a count of people. If your browser sends a Global Privacy Control (Sec-GPC: 1) or Do Not Track (DNT: 1) signal, your page views are not counted. We keep the daily counts for about 400 days; days older than that are removed the next time the counts file is updated.

Cookies and local storage

This site uses an optional third-party script from Travelpayouts to provide live flight search results. This script is only loaded if you consent to it via the cookie banner. Your consent is stored in your browser's localStorage under the key ct_consent.

The search page itself does not set tracking or advertising cookies. Optional account routes already exist, as described above; they are not required for flight search.

The site also registers a service worker, which stores site pages and assets in your browser's Cache Storage so they can be reused. API responses are excluded from this cache. The cache has no time-based expiry in the site code; old cache versions are removed when the service worker activates. You can remove this stored site data through your browser settings. This is separate from the consent choice in localStorage.

Third parties

Flight and calendar searches send route and date information, and currency and market settings, from our server to Travelpayouts to obtain fares. This server-side search is separate from the optional Travelpayouts browser script.

When the results map is opened, its Leaflet map code and styles are loaded from unpkg.com. That service receives your browser's request, including its IP address.

The results map loads map tiles directly from OpenStreetMap, which will see the IP address of your browser when tiles load, under its own privacy terms. The site may also load travel-partner scripts and provide outbound links to third-party travel providers. Those third parties process data under their own privacy terms.

How long we keep data

There is no automatic deletion schedule for search records; they remain stored unless removed manually. We have not established a fixed retention period for optional account records. There is no installed application-level database backup job. Hosting-provider backups or snapshots have not been verified, so we cannot state their retention period.

Your rights (UK GDPR / EU GDPR)

If you're in the UK or EU, you have the right to:

• Ask what data we hold that relates to you
• Ask us to correct or delete it
• Object to or restrict certain processing
• Complain to your local data protection authority (in the UK, the ICO)

To exercise any of these, contact us at privacy@chapelgatehome.uk.

Changes

We'll update the date at the top of this page whenever this policy changes materially.