← Back to PikaFly

Privacy Policy

Last Updated: October 26, 2026

Pika Holdings LLC ("PikaFly", "we", "our", "us") operates the PikaFly mobile application (the "App"). This Privacy Policy explains how we collect, use, and protect your information.

1. Information We Collect

Account Information: When you create an account with email and password, we collect your username, email address, and password (encrypted by Firebase Authentication). If you sign in with Apple or Google instead, we receive the name and email address you authorize from that provider — we never see your Apple or Google password. Apple lets you hide your real email address by sharing a private relay address, which works fully with the App.

Anonymous Identifier: To secure requests to our servers, the App creates a random anonymous account identifier (via Firebase Authentication) the first time you use it, even if you never sign up. It carries no name or email, is used to apply fair-use limits and to deliver results, and is removed when you delete your account or uninstall the App.

Usage Data: We collect information about how you use the App, including search queries (cities, airports, dates), filter preferences, and interactions with results. Usage data is processed by our analytics provider (see Section 3).

Location Data: If you grant permission and tap "Use my location", the App reads your device location once (while the App is open, never in the background) and sends the coordinates to our server, which asks our geocoding provider (API Ninjas) for the nearest city so your starting point can be filled in. A street address you type is sent the same way to find its coordinates. We do not keep a history of your locations.

Crash and Diagnostic Data: When the App encounters an error or crashes, we automatically collect diagnostic information including device model, operating system version, and a stack trace, sent to our error-monitoring provider (see Section 3). For error events specifically, we may also record a brief session replay capturing the screens you visited leading up to the error. Password fields and other sensitive inputs are automatically masked in replays. Crash reporting is off in development builds.

Push Notification Token: If you allow notifications and create a price alert or budget watch, we store the device push token issued by Apple or Google (via Expo) together with that alert or watch so we can deliver its notifications. The token identifies your device for push delivery only; it is removed when you delete the alert, watch, or account, and tokens that stop working are purged automatically.

Trip Reminders: Reminders you set for a saved trip are scheduled as local notifications on your device. They are never sent to our servers.

Shared Links: When you share a trip plan or a flight deal, the trip or deal details (route, dates, prices, stops) are encoded in the link itself. Nothing is stored on our servers, and anyone who receives the link can view those details. Do not share a link if you do not want its contents seen.

2. How We Use Your Information

• To provide and improve the App's travel search features (flights, day trips, drive routes, hotels)
• To display search results from third-party APIs
• To send you push notifications when fares match your budget watches or price alerts (only when you opt in)
• To calculate fuel costs and driving distances
• To authenticate your account and secure your data
• To monitor crashes and analyze feature usage so we can fix bugs and improve the App

3. Third-Party Services

We use third-party services for authentication, data storage, travel search, geocoding, error monitoring, and analytics. These services may receive information such as search queries, device metadata, and account identifiers.

• Firebase (Google): Authentication, database (Firestore), and push notification delivery
• Sign in with Apple / Google Sign-In: Optional sign-in providers. When used, the provider shares the name and email you authorize; your interaction with the provider is governed by its own privacy policy.
• SearchAPI.io: Flight, hotel, driving-route, stops-along-the-route and things-to-do results. Your search terms (airports, cities, dates, route endpoints) are sent to SearchAPI to run the search.
• API Ninjas: City geocoding for the Drive and Surprise features
• U.S. Census Bureau Geocoder: Turns a typed street address into coordinates for the Drive and Surprise features. The address you type is sent to the Census geocoding service.
• NREL Alternative Fuels Data Center (U.S. Department of Energy): Public EV-charging-station locations along a route, when you plan a drive in EV mode
• Ticketmaster Discovery API: Public event listings at a destination in the trip planner
• Apple Maps (iOS): The map view in the drive planner is drawn by Apple's MapKit on your device; Apple receives the map tile requests and applies its own privacy policy
• National Park Service (NPS) API: Park data for the Drive feature
• Wikimedia Commons / Wikidata: State-park location data and photos for the Drive feature. Photos are displayed under their Creative Commons or public-domain licenses, with author and license shown where the license requires it; loading a photo requests it from Wikimedia's servers.
• EIA (U.S. Energy Information Administration): National average gas prices
• Expo Push Notification Service: Delivery of price alert and budget watch notifications
• Sentry: Crash reporting and on-error session replay. Used to diagnose bugs. Sensitive form fields are masked. Sentry's privacy policy.
• PostHog: Product analytics — pseudonymous event data about which features are used (for example, "user ran a flight search") plus automatically captured taps on screen elements (the element's label, never the text you type), keyed to a random account identifier rather than your name or email. Used to improve the App. PostHog's privacy policy.
• Travelpayouts (website only): pikafly.com loads a Travelpayouts affiliate script that may set cookies to attribute bookings from links on the site. The App itself does not load it.

Each of these services has its own privacy policy. We do not sell your personal information to any third party.

4. Affiliate Booking Partners

PikaFly participates in travel-affiliate networks (currently Travelpayouts, with other programs such as airline partnerships via Impact pending). Most booking links in the App currently open Google Flights or the airline's or provider's own website without affiliate tracking. As partnerships activate, some booking links may include affiliate tracking. Partners may over time include but are not limited to airlines (for example Southwest), Booking.com, Skyscanner, Expedia Group (Hotels.com, Vrbo), Airbnb, and Google Flights.

When you tap a booking link in the App (for example, "Book Flight" or "Find Flights"):

• You are redirected to the partner's website or app.
• Your interaction with the partner site is governed by that partner's own privacy policy and terms — not ours.
• We may append an affiliate tracking identifier to the booking URL so the partner can attribute the booking back to PikaFly. This identifier does not contain any personally identifiable information about you.
• If you complete a purchase, PikaFly may earn a commission at no additional cost to you.
• Partners may set their own cookies or tracking pixels once you leave PikaFly; we do not control those and they are subject to the partner's privacy practices.

We recommend reviewing each partner's privacy policy before completing a booking.

5. Data Storage and Security

• Account data is stored securely via Firebase Authentication with encrypted passwords
• Budget watches and price alerts (including the push token that delivers them) are stored in Firebase Firestore and accessible only to the server and the owning user
• Saved trips, trip plans, drafts and reminders are stored locally on your device only; deleting your account also clears them from the device
• Shared trip and deal links carry their content in the link; we hold no copy
• All data transmitted between the App and our servers is encrypted (HTTPS)
• We implement input sanitization and rate limiting to protect against attacks

6. Data Retention

• Account data is retained until you delete your account
• Budget watches and price alerts are retained until you cancel them or they match a fare; alerts whose push token no longer works are deleted after 30 days
• Search queries are not permanently stored on our servers
• Analytics events are retained according to PostHog's standard retention policy
• Crash reports are retained according to Sentry's standard retention policy

7. Your Rights

You have the right to:

• Access your account information
• Delete your account (available in Settings). When you delete your account, we permanently remove your saved price alerts and budget watches, your product-analytics data (your PostHog person and associated events), and your authentication record. If the same sign-in is also used by another Pika Holdings app, the sign-in record itself is kept for that app and only PikaFly's data and link to it are removed. Crash and diagnostic data is not linked to your account identity and is retained according to our error-monitoring provider's standard retention policy (see Sections 3 and 6).
• Opt out of analytics by uninstalling the App
• Disable push notifications in your device's Settings at any time

8. Children's Privacy

The App is intended for users 18 and older. We do not knowingly collect personal information from anyone under 18.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy within the App and at pikafly.com/privacy.