Privacy Policy

Information We Collect

PreBoard collects anonymous usage data through Google Analytics 4, including pages visited, device type, and approximate location (country/region). We do not collect personally identifiable information unless you voluntarily submit a wait time report.

Optional Accounts (Sign in with Google or Apple)

You can use PreBoard without an account. Where accounts are offered, signing in with Google or Apple stores only: the provider's account identifier, the email address the provider shares (Apple may give a private relay address), your name if the provider shares it, and the preferences you choose to sync: home airport, PreCheck/CLEAR, checked bags, typical drive time, alert preferences and saved trips. We do not receive your Google or Apple password, and we never store Known Traveler Numbers or booking confirmation codes.

Sessions use a secure, HttpOnly cookie (or a token kept in the iOS Keychain); we store only a hash of the session token. Marketing email is off by default and is only sent if you turn it on. You can download all of your account data as JSON, or permanently delete your account, from the account page at any time. Deletion removes your profile, saved trips, sign-in links, sessions, agent tokens and trip-import records immediately.

Trip import by email and AI agents (signed-in accounts)

These features are optional and only work when you are signed in. Forwarding address. From the account page you can create a private forwarding address (trips+<random code>@preboard.ai). Mail sent to it is received by Cloudflare Email Routing, which checks the sender (SPF/DKIM) before passing it to us. We read the message once to find flight details, then discard it: we do not store the email body, subject, attachments, sender address or the names of passengers, and we never reply to, forward or send email from this address. We keep only the flights we find (described below) and a short processing record (a one-way hash of the message ID so the same email isn't imported twice, the number of flights found and the result), kept for 30 days. We store only a hash of your forwarding code; you can replace it with a new one or turn it off at any time, and mail to an old or unknown address is discarded without a reply. Anything you forward goes through your own email provider, under its terms.

AI agent access. You can create access tokens that let an AI assistant or app you choose read or add trips in your account (scopes: read trips, write trips). We show the token once and store only a hash of it, plus the name you gave it, its scopes, and when it was created, last used and expires (90 days by default, at most 365). You can revoke a token at any time; expired or revoked tokens are deleted 30 days later. An assistant using a token can see and change only your trips, not your email or profile. What the assistant does with trip details it reads is governed by that assistant's own privacy policy.

What a saved trip contains. The departure airport, departure time, and where available the flight number, destination airport and the plan settings (PreCheck/CLEAR, bags, number of children, drive time), plus whether it came from email, an agent or a calendar file. No passenger names, confirmation codes, ticket numbers, seat or payment details. Trips added by email, by an agent or from a calendar file are deleted automatically 7 days after departure, and an airline cancellation email you forward removes the matching trip. Check-in times we show are general airline rules; we do not check you in or log in to your airline account. Downloading your account data includes your trips, agent tokens (without the token itself) and the import records; deleting your account deletes all of them, your forwarding address and every agent token immediately.

Cookies & Tracking

We use cookies for analytics and advertising. Our ad partners may use cookies to serve relevant ads. You can manage your cookie preferences using the consent banner that appears when you first visit the site.

Consent, Saved Airport & Alert Emails

Google Analytics and Google AdSense scripts load only after you click Accept in the cookie banner; if you decline, they are not loaded. You can change your choice any time with “Cookie settings” in the footer. If you accept, we record events such as airport searches, plans created, alert sign-ups and affiliate-link clicks. Event data never includes your email address. Your “My airport” choice is stored only in your browser (localStorage) and is not sent to us. Your travel preferences (program, Known Traveler Number reminder, bags, children, extra time) are stored only in your browser too. When you paste a confirmation or choose a calendar file to find a flight, the text is read once to extract flight details and is not stored or logged. If you use the iOS app and save a trip, we store only the airport, departure time and the plan settings you chose (no name, no confirmation code, no airline login) until shortly after departure or until you delete it. If you sign up for airport alert emails we store your email, optional airport, the consent text version, a hashed IP (for rate limiting), timestamps, and a log of each email we send you (type, airport, time, delivery result). We first send one confirmation email (double opt-in); until you click the link we send nothing else, and if you never confirm we stop. After you confirm, we email you only when the security wait at your chosen airport is unusually long (at most 2 a day and one every 12 hours, never overnight local time). No marketing, no newsletters, and we never sell, rent or share your email. Emails are delivered through Cloudflare Email Service, which processes them for us. Every email has an unsubscribe link (and one-click unsubscribe); if an address hard-bounces or someone marks a message as spam we stop emailing it. Unsubscribe any time at /unsubscribe or write privacy@preboard.ai; your sign-up record is kept (marked unsubscribed) only so we can honor that choice, and we delete it on request.

Advertising

PreBoard displays advertisements through third-party ad networks. These partners may use cookies and similar technologies to serve ads based on your interests. We do not sell your personal information.

Your Rights

Under CCPA and GDPR, you have the right to access, delete, and opt out of the sale of your personal information. To exercise these rights, contact us at privacy@preboard.ai.

Data Retention

Analytics data is retained according to Google Analytics default settings (14 months). Wait time reports submitted through the site are stored indefinitely to improve data quality.

API, widget and AI-assistant requests

When you (or an app or AI assistant acting for you) call our leave-by API, embed widget or MCP server, we store an anonymous record of the airport, lane, planned security time and the estimate we returned, to measure how accurate our estimates are. It contains no name, email, account or IP address and is kept up to 24 months. If an app, assistant or you report how long security actually took (the outcomes endpoint), we store that number, the prediction it refers to, and a salted hash of your IP for rate limiting; no free text or identity. We count calls per day by client name (the product token of the User-Agent header, e.g. an AI assistant's name) and endpoint, with no IP address or content, to see which tools are used. We also use a short-lived hash of your IP address (about 2 minutes) only for rate limiting. API-key holders and pilot-request submitters give us an organization name and work email, used only to operate the key and reply to the request.

iOS app

The Preboard iOS app has no ads, no tracking and no third-party analytics or advertising SDKs, and it does not use your location. It calls the same API as this site and works fully without an account. Your chosen airport and any leave-by countdown are stored only on your phone. An account is optional: if you choose Sign in with Apple (Settings → Account), we receive from Apple a stable account identifier, the email address Apple shares (which may be a private relay address) and your name if you allow it, and we store them as described under Optional Accounts above, together with the preferences you choose to sync. Your session token is kept in the iOS Keychain on that device and we store only its hash. You can sign out, or permanently delete your account, from Settings → Account in the app (or from the account page on this site). If you submit a wait report in the app, we receive the airport, checkpoint, lane, the wait you entered and an optional note (up to 280 characters), plus a hash of your IP address that we use only for rate limiting and abuse control; none of this is linked to a name, account or device identifier. Reports are shown only as aggregate numbers labeled “Traveler reports” (notes are not shown to other users), and reports that enough people flag as wrong, spam or abusive are hidden. Reports are retained as described under Data Retention. Because reports are anonymous we cannot look up or delete a specific report for you; to ask about one, email privacy@preboard.ai with its report ID (shown after you submit). Deleting the app removes the data stored on your phone.

Contact

For privacy questions, contact privacy@preboard.ai.