← Back to PikaFly

Privacy Policy

Last Updated: July 7, 2026

Pika Holdings LLC ("PikaFly", "we", "our", "us") operates the PikaFly mobile application (the "App"). This Privacy Policy explains how we collect, use, and protect your information.

1. Information We Collect

Account Information: When you create an account with email and password, we collect your username, email address, and password (encrypted by Firebase Authentication). If you sign in with Apple or Google instead, we receive the name and email address you authorize from that provider — we never see your Apple or Google password. Apple lets you hide your real email address by sharing a private relay address, which works fully with the App.

Usage Data: We collect information about how you use the App, including search queries (cities, airports, dates), filter preferences, and interactions with results. Usage data is processed by our analytics provider (see Section 3).

Location Data: If you grant permission, we may access your device location for the Drive and Surprise features to calculate distances from your current location.

Crash and Diagnostic Data: When the App encounters an error or crashes, we automatically collect diagnostic information including device model, operating system version, and a stack trace, sent to our error-monitoring provider (see Section 3). For error events specifically, we may also record a brief session replay capturing the screens you visited leading up to the error. Password fields and other sensitive inputs are automatically masked in replays.

2. How We Use Your Information

• To provide and improve the App's travel search features (flights, day trips, drive routes, hotels)
• To display search results from third-party APIs
• To send you push notifications when fares match your budget watches or price alerts (only when you opt in)
• To calculate fuel costs and driving distances
• To authenticate your account and secure your data
• To monitor crashes and analyze feature usage so we can fix bugs and improve the App

3. Third-Party Services

We use third-party services for authentication, data storage, travel search, geocoding, error monitoring, and analytics. These services may receive information such as search queries, device metadata, and account identifiers.

• Firebase (Google): Authentication, database (Firestore), and push notification delivery
• Sign in with Apple / Google Sign-In: Optional sign-in providers. When used, the provider shares the name and email you authorize; your interaction with the provider is governed by its own privacy policy.
• SearchAPI.io: Flight and hotel search results
• API Ninjas: City geocoding for the Drive and Surprise features
• National Park Service (NPS) API: Park data for the Drive feature
• EIA (U.S. Energy Information Administration): National average gas prices
• Expo Push Notification Service: Delivery of price alert and budget watch notifications
• Sentry: Crash reporting and on-error session replay. Used to diagnose bugs. Sensitive form fields are masked. Sentry's privacy policy.
• PostHog: Product analytics — pseudonymous event data about which features are used (for example, "user ran a flight search"), keyed to a random account identifier rather than your name or email. Used to improve the App. PostHog's privacy policy.

Each of these services has its own privacy policy. We do not sell your personal information to any third party.

4. Affiliate Booking Partners

PikaFly participates in travel-affiliate networks (currently Travelpayouts, with other programs such as airline partnerships via Impact pending). Most booking links in the App currently open Google Flights or the airline's or provider's own website without affiliate tracking. As partnerships activate, some booking links may include affiliate tracking. Partners may over time include but are not limited to airlines (for example Southwest), Booking.com, Skyscanner, Expedia Group (Hotels.com, Vrbo), Airbnb, and Google Flights.

Website script: Our website at pikafly.com (including this page) loads a script provided by Travelpayouts. It is used to verify our affiliate partnership and attribute clicks on booking links made from the website, and it may set cookies or similar identifiers for that purpose. This script runs only on the website — it is not part of the mobile App. See Travelpayouts' privacy policy.

When you tap a booking link in the App (for example, "Book Flight" or "Find Flights"):

• You are redirected to the partner's website or app.
• Your interaction with the partner site is governed by that partner's own privacy policy and terms — not ours.
• We may append an affiliate tracking identifier to the booking URL so the partner can attribute the booking back to PikaFly. This identifier does not contain any personally identifiable information about you.
• If you complete a purchase, PikaFly may earn a commission at no additional cost to you.
• Partners may set their own cookies or tracking pixels once you leave PikaFly; we do not control those and they are subject to the partner's privacy practices.

We recommend reviewing each partner's privacy policy before completing a booking.

5. Data Storage and Security

• Account data is stored securely via Firebase Authentication with encrypted passwords
• Budget watches and price alerts are stored in Firebase Firestore and accessible only to the server and the owning user
• Saved trips are stored locally on your device only
• All data transmitted between the App and our servers is encrypted (HTTPS)
• We implement input sanitization and rate limiting to protect against attacks

6. Data Retention

• Account data is retained until you delete your account
• Budget watches and price alerts are retained until you cancel them or they match a fare
• Search queries are not permanently stored on our servers
• Analytics events are retained according to PostHog's standard retention policy
• Crash reports are retained according to Sentry's standard retention policy

7. Your Rights

You have the right to:

• Access your account information
• Delete your account (available in Settings). When you delete your account, we permanently remove your authentication record, your saved price alerts and budget watches, and your product-analytics data (your PostHog person and associated events). Crash and diagnostic data is not linked to your account identity and is retained according to our error-monitoring provider's standard retention policy (see Sections 3 and 6).
• Opt out of analytics by uninstalling the App
• Disable push notifications in your device's Settings at any time

8. Children's Privacy

The App is intended for users 18 and older. We do not knowingly collect personal information from anyone under 18.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy within the App and at pikafly.com/privacy.