Privacy Policy

Who we are

Wingora is a flight comparison service. We show fares from travel partners and send you to them to book. We are not an airline, a travel agency, or a party to your booking.

This policy is written to meet the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) and the EU GDPR. Contact us at privacy@wingora.app about anything on this page.

What we collect

Searches. When you search we record the route, dates, passenger count and cabin class. If you used the free-text box, we also record what you typed, so we can improve how it is understood.

Clicks. When you follow a link to a travel partner we record which fare you clicked, its price, and the partner. This is how we know whether the service works, and it is how we are paid.

Your approximate location, to choose sensible defaults. When the site loads, our host derives from your IP address the country and approximate city-level position your connection comes from. We use the country to preselect a currency and the position to suggest the airport nearest you as your departure airport. Only the country code and the airport code reach your browser; the position is discarded on our server straight away, and none of it is stored or logged. You can change either default at any time, and a currency you choose yourself is kept only in your own browser.

Account data, only if you create an account: your email address, how you sign in (a one-time email code, or Google — which also shares your name and profile picture; we keep them with the account but use only the email), your settings (language, currency, home airport), your price alerts, and when you last signed in. There is no password. You can delete the account, and everything tied to it, from the account page at any time.

We do not collect payment details. We never see them — payment happens on the travel partner’s site, not ours.

Searching without an account

You can search without signing in, and most people do. Those searches are stored without any user identifier attached, so they cannot be traced back to a person.

Who else sees it

Supabase hosts our database, and Vercel hosts and serves the site. Both process data on our instructions in order to run the service.

Google Analytics 4 receives page views, which language you are reading the site in, and basic device information — but only if you switch analytics on. If you do not, no request is ever made to Google and Google receives nothing about your visit.

Sentry (Functional Software, Inc.) receives a report when something on the site breaks: the error, the page address without its query, and your browser and operating system. It is stored in the European Union, is kept for 30 days, and carries no name, email address or IP-based profile. It exists only so we can fix faults; it is not analytics and is not used to follow you.

Travel partners see the search you carry to them when you follow a fare link, exactly as if you had typed it on their own site. What happens after that is covered by their privacy policy, not this one.

We do not sell personal data, and we do not share it for advertising.

Your rights

You may ask for a copy of your data, ask us to correct or delete it, withdraw consent at any time, or object to how we use it. Write to privacy@wingora.app and we will respond within 30 days.

Withdrawing consent for analytics or marketing is one click, at any time, from Cookie settings in the footer. It is exactly as easy as granting it.