Privacy

Saved on your device

• The passport you choose, so the site remembers it next time.
• Whether you picked light or dark mode.
• If you sign in, a copy of your saved passports and trips, so your account page opens quickly. It is removed when you sign out.

These stay in your browser’s local storage. Clearing this site’s data in your browser removes them.

Optional accounts

Accounts are optional. If you create one, we store your email address, the passport countries you save, your saved trips and your alert choices. We only store which country issued each passport, never passport numbers, scans or other document details.

A saved trip contains passport countries, destinations and an optional name. We also keep a sign-in session cookie so your account remains available on this device.

Alert emails are sent only after you confirm by email, and every alert email has a one-click unsubscribe link. You can delete your account from the account page, which deletes saved passports and trips and stops all alert emails.

Sign-in links and alert emails are delivered through an email delivery provider. We do not send marketing email.

Account activity and invites

For signed-in accounts, we keep an activity log for sign-up and sign-in, account visits, passport and trip changes, settings, comparisons, flight searches, outbound links and invite activity. It is deleted with your account.

Invite links can credit a friend’s sign-up to you. Opening one saves its invite code, and where relevant a travel group identifier, in a cookie for up to 30 days. If a friend signs up, we record the connection and related activity.

We keep a points ledger for account actions and referrals.

Rewards

If you use rewards, we keep a ledger of the PAX you earn and exchange, the Percy packs you open with the cards each pack gave you, your daily check-ins and quiz answers, the trips you commit to, and the friends you invite.

To stop duplicate accounts claiming invite rewards, rewards pages keep a random device identifier in a cookie and store one-way hashes of it and of your IP address with your account for up to 180 days. These hashes are also used to stop trades between accounts on the same device.

We keep free pack timers and pick point records so that you can claim packs and redeem cards.

We keep a record of each trade offer, counter-offer, confirmation and the cards that changed hands, including who you traded with. Trades swap cards only. Cards and PAX have no cash value and cannot be sold or exchanged for money.

Answers to the quick questions in Rewards are stored with your account and may be used in aggregate for market research.

Your display name and cards appear on a public page only if you switch on Show my collection publicly. You can switch it off at any time.

Your rewards data is deleted with your account.

Your country

When you open the site, our host Cloudflare tells us which country your connection comes from. We use it on a first visit to suggest a passport and a local flight-search currency. It is not stored as a profile field, and you can change the passport and currency at any time.

Analytics and affiliate links

Edenpax runs its own first-party analytics to understand how the site is used and improve it. Signed-in accounts also have activity tracking for rewards and invites.

Public pages load the Travelpayouts affiliate script. It does not run on account, invite or sign-in pages.

Our servers

Like any website, our host Cloudflare handles your IP address to deliver pages. To block abuse, a few requests count a one-way hash of your IP address for up to an hour, after which it expires and is deleted. Cloudflare keeps standard request logs for a limited time, which we use only to fix errors.