Privacy Policy

1. Introduction

1.1 This Privacy Policy explains how Sam Davis (“we”, “us” or “our”) collects, uses, shares and protects information in connection with the Points application for iPhone and iPad (the “App”), which appears on the App Store as “Points: reward seat finder”.

1.2 We are the controller of the personal data described in this Privacy Policy for the purposes of the UK General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018. We are an individual developer based in the United Kingdom, and can be contacted using the details in section 14.

1.3 The App does not require you to create an account or sign in, and we do not ask for your name, email address, telephone number or payment details.

1.4 This Privacy Policy applies to the App only. Websites and services that you access through the App, including Virgin Atlantic’s website, are governed by their own privacy policies.

2. Information stored on your device

2.1 The following information is stored only within the App’s storage on your device, and is deleted when you delete the App:

• the flights you save;
• your search preferences, such as the last airport and trip type you used; and
• a cached record of your Points Plus subscription status.

2.2 We do not receive a list of your saved flights. However, each time you save a flight, that action is recorded in our analytics together with the flight’s route, cabin and points price, as described in section 3.8.

3. Information we collect

3.1 Installation identifier

When the App is first opened, it creates a random identifier for your installation (the “Installation Identifier”) using the anonymous sign-in feature of Firebase Authentication. The Installation Identifier does not contain your name, email address or other contact details. It is stored in your device’s keychain and therefore persists if the App is deleted and reinstalled. Except where stated otherwise, the information described in this section 3 is associated with your Installation Identifier.

3.2 Apple Transaction Identifier

When the App first connects to our servers, it shares an identifier that Apple assigns to your download of the App, whether or not a purchase has been made (the “Apple Transaction Identifier”). It is associated with the Apple Account used to download the App, but it is not your Apple Account name, email address or credentials, and it does not give us access to your Apple Account. We store it against your Installation Identifier, and use it to match a Points Plus subscription purchased with your Apple Account to your installation, so that we can determine whether you are entitled to receive notifications.

3.3 Searches

When you search, the App retrieves results from our servers. Details of each search are recorded in our analytics, including the airports, months, trip length and cabins searched and the number of results returned. Our hosting provider processes technical connection data, including your IP address, in order to respond to the App’s requests.

3.4 Taxes and fees

Showing estimated taxes and fees requires no additional information about you. The figures displayed to you are recorded in our analytics together with the details of the relevant flight.

3.5 Value per point (Points Plus)

If you subscribe to Points Plus, when you open a flight the App requests the corresponding cash fares from Virgin Atlantic, for comparison. The request is made from your device, contains the route and travel dates, and does not include any identifier from us. Virgin Atlantic will therefore receive your IP address and the technical information ordinarily included in a web request, and may set cookies within the App. Virgin Atlantic processes that information as an independent controller under its own privacy policy. The cash fares and value per point displayed to you are recorded in our analytics together with the details of the relevant flight.

3.6 Price alerts and notifications

If you allow notifications, a push notification token issued by Apple is stored against your Installation Identifier so that notifications can be delivered to your device. The token is replaced whenever Apple issues a new one, and it is not deleted when you delete your alerts.

If you create a price alert, the App sends to our servers the routes, dates and cabins that the alert monitors and the alert’s trigger and frequency settings, which we store together with the information needed to detect changes.

When our servers deliver a notification, they record the delivery in our analytics, together with the alert’s trigger, frequency, route and cabins and the number of your devices to which it was delivered.

An alert’s record is deleted from our servers when you delete the alert in the App, or automatically once the flights it monitors have departed.

3.7 Intelligent search (Points Plus)

If you use intelligent search, the text you enter is sent to Google’s generative AI service to be converted into a search. The text you enter is also recorded verbatim in our PostHog analytics (but not in Google Analytics for Firebase) so that we can improve how the App interprets requests. You should not enter personal or sensitive information into intelligent search.

3.8 Analytics

We use PostHog, with data hosted in the European Union, and Google Analytics for Firebase to understand how the App is used. Both receive the same events, associated with your Installation Identifier, so that activity from an installation can be analysed over time. Google Analytics for Firebase also assigns its own identifier to your installation. These events include:

• the App being opened and closed, and the screens viewed;
• searches performed, their results, and how results are sorted and scrolled;
• flights opened and saved, including their routes, cabins and points prices;
• price history viewed;
• taxes and fees, cash fares and value per point displayed;
• alerts created, edited and removed, notification permissions granted, and notifications opened;
• booking links selected;
• the Points Plus subscription screen being shown, and subscriptions being purchased, set to renew or not to renew, lapsing or being restored; and
• errors encountered by the App.

We also record the following properties of your installation: whether you subscribe to Points Plus and whether your subscription is set to renew; the number of flights you have saved and alerts you have set; whether you have allowed notifications; whether the App is displaying results and flights side by side; and whether a pointer or Apple Pencil has been used with the App.

Google Analytics for Firebase also receives the product, price and currency of each verified Points Plus purchase, for revenue reporting. Automatic capture of every tap, and detection of repeated taps, are disabled. Our analytics providers may derive an approximate location, such as country and city, from your IP address.

3.9 Crash and error reports

We use Firebase Crashlytics to collect reports of crashes and handled errors. Reports include technical information such as your device model, operating system version and the point in the App at which the failure occurred. Where an intelligent search fails, the report includes the AI service’s response, which may reproduce part of the text you entered. Crash reports are associated with a separate identifier that Firebase assigns to your installation, rather than with your Installation Identifier.

3.10 Subscriptions

Points Plus subscriptions are sold and processed by Apple, and we do not receive your payment details. The App receives from the App Store whether you have an active subscription and whether it is set to renew. Apple also notifies our servers of changes to the status of subscriptions purchased with your Apple Account, such as renewals, expiries and refunds. We match these notifications to your installation using the Apple Transaction Identifier, so that notifications can be paused when a subscription ends.

3.11 Support correspondence

If you contact us using the Support link in the App, your email application opens a draft message containing the App version and your Installation Identifier, with a subject line indicating whether you subscribe to Points Plus. You can review or remove this information before sending. If you send an email to us, we will hold it, including your email address and any content or attachments, in order to respond to your enquiry and to keep a record of the issues reported.

4. Information we do not collect

4.1 We do not collect:

• your name, email address or telephone number, except where you choose to email us;
• precise location data from your device;
• payment card or bank details;
• your Flying Club or other Virgin Atlantic account details;
• your contacts, photos, camera, microphone, health or motion data; or
• advertising identifiers.

4.2 The App does not display advertising and does not track you across apps or websites owned by other companies.

5. How we use information

5.1 We use the information described in this Privacy Policy for the following purposes, on the lawful bases indicated:

• To provide the App and the features you request, including searches, price alerts and notifications, intelligent search, value per point and the matching of subscriptions to installations. Lawful basis: performance of our contract with you under the Terms of Use.
• To understand how the App is used, and to diagnose and fix problems and improve the App, using analytics and crash reports. Lawful basis: our legitimate interests in operating and improving the App.
• To protect the App and our servers against abuse, including by verifying that requests come from a genuine copy of the App. Lawful basis: our legitimate interests in keeping the service secure.
• To respond to your enquiries. Lawful basis: our legitimate interests in supporting users of the App.
• To comply with our legal obligations, and to establish, exercise or defend legal claims, where necessary. Lawful basis: compliance with a legal obligation, or our legitimate interests.

5.2 Where we rely on legitimate interests, we have balanced those interests against your interests and rights, and have limited the information we collect accordingly. In particular, we do not collect names, contact details or payment information for these purposes. You have the right to object to processing based on legitimate interests, as described in section 10.

6. Sharing information

6.1 The following service providers process information on our behalf:

• Google (Firebase), for hosting, database, anonymous authentication, analytics, push notifications, crash reporting, remote configuration, abuse prevention and the generative AI behind intelligent search (privacy information); and
• PostHog, for product analytics, with data hosted in the European Union (privacy policy).

6.2 The following third parties receive information in connection with the App and process it as independent controllers, under their own privacy policies:

• Apple, for App Store purchases, subscription status notifications, app transaction verification and push notification delivery (privacy policy);
• CJ Affiliate, when you follow a booking link, as described in section 7 (privacy policy); and
• Virgin Atlantic, when the App requests cash fares as described in section 3.5, or when you follow a booking link.

6.3 We may also disclose information where we are required to do so by law, to protect our rights or the rights of others, or in connection with a transfer of the App to another person or organisation, in which case this Privacy Policy will continue to apply to the information transferred.

6.4 We do not sell personal data, and we do not share it with third parties for their own marketing purposes.

7. Booking links

7.1 When you select a booking link, the App opens Virgin Atlantic’s website, which may be through an affiliate link operated by CJ Affiliate. The App informs you of this the first time you select a booking link.

7.2 Affiliate links identify the App as the source of a referral, so that we may earn a commission, but they do not contain any identifier for you or your installation. CJ Affiliate and Virgin Atlantic may set cookies or collect information in your browser under their own privacy policies.

8. International transfers

PostHog stores data in the European Union, which the UK recognises as providing adequate protection for personal data. Google may process data in the United States and other countries outside the UK. Where personal data is transferred outside the UK, we rely on appropriate safeguards recognised under UK data protection law, such as the UK Extension to the EU–US Data Privacy Framework, or the UK International Data Transfer Addendum to the European Commission’s Standard Contractual Clauses.

9. Retention

9.1 We keep information for the following periods:

• Alert records: until you delete the alert, or until the flights it monitors have departed, whichever is sooner.
• Installation Identifier, push notification token and Apple Transaction Identifier: until they are replaced, or until you ask us to delete them. Because the Installation Identifier is stored in your device’s keychain, deleting the App does not remove it.
• Analytics and crash reports: for the standard retention period of the relevant provider, after which they are deleted.
• Support correspondence: for as long as necessary to resolve your enquiry and to maintain a record of the issues reported.
• Information stored on your device: until you delete the App.

10. Your rights

10.1 Subject to the conditions and exceptions set out in applicable law, you have the right to request access to the personal data we hold about you, to have it corrected or erased, to restrict or object to its processing (including processing for analytics, which is based on our legitimate interests), and to receive a copy of it in a portable format.

10.2 Because the App does not use accounts, we can only identify information associated with your installation if you provide your Installation Identifier. The simplest way to do so is to contact us using the Support link in the App, which includes it automatically. We will respond within one month of receiving your request, or within any longer period permitted by law.

10.3 Deleting the App stops any further collection of information from your device.

10.4 You have the right to lodge a complaint with the UK Information Commissioner’s Office, or with the data protection authority where you live. We would, however, appreciate the opportunity to address your concerns first.

11. Security

We use appropriate technical and organisational measures to protect information, including encrypted connections and verification that requests come from genuine copies of the App. However, no method of transmission or storage is completely secure, and we cannot guarantee the absolute security of information.

12. Children

The App is not directed at children under 13, and we do not knowingly collect personal data from children under 13. If you believe that a child under 13 has provided us with personal data, please contact us and we will delete it.

13. Changes to this Privacy Policy

13.1 We may update this Privacy Policy from time to time. The date at the top of this page indicates when it was last revised. We will draw attention to material changes in the App Store release notes for the update that introduces them.

13.2 This version reflects version 1.2 of the App. It:

• describes the taxes and fees feature (section 3.4) and the value per point feature, under which the App requests cash fares from Virgin Atlantic (section 3.5);
• describes the recording of delivered notifications in our analytics (section 3.6); and
• corrects a statement in a previous version of this Privacy Policy that booking links contain your Installation Identifier. They do not (section 7).

14. Contact

Questions about this Privacy Policy, and requests to exercise your rights, should be sent to:

Sam Davis
sam@samapps.co.uk