Privacy policy

The short version

This is a short summary for convenience. The full text of the policy below is the one that binds.

Without an account you can look through the prices already collected; searching for new prices requires signing in. Until you sign in we do not know who you are: the search trail has no name, e-mail address or IP address, only the steps of the search under a random number and your answer, if you chose to say whether you found a ticket. If you sign in in the same tab, the entries from then on are tied to your account, and those made in it before signing in can be matched to it by the tab's number; we do not do that. We need your e-mail address only if you create an account, ask for the launch letter or write to us. Letters about the service come only if you switch them on.
We do not sell personal data or use it for advertising, and we use no advertising or analytics cookies. The only cookies on the site are strictly necessary ones, such as your session cookie once you sign in. Others handle data for us: the hosting provider, Cloudflare and the mail service; where one is outside the European Economic Area, section 3 names the safeguards.
Statistics run on Umami, without cookies and without keeping IP addresses: it counts page views and where visits come from.
How long things are kept: an account, until you delete it with the button on its page; an address on the launch list, 90 days after the launch letter or 90 days after unsubscribing; messages to us, 365 days after the last message of the conversation; the search trail without an account, 2 years; the security log, 90 days. After you delete an account, price marks stay without any link to you, and encrypted backups keep what was deleted for at most 14 days.
You may get a copy of your data, correct or delete it, object to its use and withdraw consent. Write to from the address in question: we answer within one month. You may also complain to a data protection authority. The link in a letter about the service ends only those letters.

1. Who is responsible

The controller of personal data of the site tryonceover.com (the OnceOver service) is Lutskov Dmiitrii. Write to about anything in this policy, and to exercise your rights.

Version com-privacy-2026-11-09.

2. What we process, why, on what basis, and for how long

The launch notice (the "Tell me when it opens" form on the home page). Data: the e-mail address, the page language, when confirmation letters were sent and how many, when the address was confirmed or unsubscribed, when the launch letter was sent. Purpose: a letter to confirm the address and one letter when the service opens to everyone. Legal basis: your consent (Art. 6(1)(a) GDPR), given by confirming the address. Retention: an address not confirmed is deleted 7 days after the last letter; after unsubscribing, 90 days later; after the launch letter, 90 days later.

Messages sent through the "Contact us" form. Data: the e-mail address to reply to, your name if you give it, the subject and text of the message, the page language, when it was sent. Our replies are kept beside your message. Purpose: to answer you. Legal basis: our legitimate interest in answering the messages people send us (Art. 6(1)(f)). Retention: the message and the replies stay in our database, where we read and answer them, and are deleted 365 days after the last message of the conversation, yours or ours.

Claims of rights holders, sent through the "Contact us" form with the subject "Rights holder's claim". Data: as for any message, and what the claim itself states (the work, your rights, the page's address). Purpose: to consider the claim and act on it. Legal basis: our legitimate interest in dealing with claims about what the site publishes (Art. 6(1)(f)). Retention: the claim and the correspondence on it are deleted 3 years after its last message.

An account. Data: the e-mail address, a name, a hash of the password (never the password), whether the address is confirmed, sign-in sessions (IP address, browser details, time); and what you keep in it yourself: search settings, shortlists, short links, the trail of your searches, price marks, consents to letters. You can hand a shortlist over by a link: the link works for 30 days, you can take it back with a button, and we keep only its hash; whoever has it sees that shortlist's tickets, prices and search conditions without signing in, but not your name or notes. Purpose: to provide the service you signed up for. Legal basis: the contract with you (Art. 6(1)(b) GDPR). Retention: until you delete the account. A sign-in link works for 30 minutes, a session for 7 days. Price marks stay after deletion, without any link to you: they are an observation of a price, not information about a person. The record of price checks used and of payments stays after deletion: it is an account of spending and holds only a number that then names nobody.

Letters about the service, only if you switched them on in your account. Legal basis: your consent (Art. 6(1)(a)), withdrawn with the link in any such letter, without signing in, or by switching them off in your account. That ends only these letters: the account and its data stay.

The security log. Data: the IP address (for IPv6, its /64 network), the e-mail address of a failed sign-in, the time and path of the request. Purpose: protecting accounts from password guessing and the service from abuse. Legal basis: our legitimate interest in keeping the service secure (Art. 6(1)(f)). Retention: 90 days. Also, to protect sign-up: the IP address and time of a new sign-up, not tied to the account, and which pairs an account opened (2 days); the e-mail address a letter sent through an invitation link went to (90 days).

Statistics: Umami, without cookies and without storing anything on your device. It counts page views and where visits come from, and keeps no IP addresses. Legal basis: our legitimate interest in knowing how the site is used (Art. 6(1)(f)).

The search trail. Data: a random number that exists only in one browser tab; the time and the screen; the steps of the search: the route, dates, number of passengers, cabin and currency, the filters you chose, the date pairs you opened, the sellers you went to with their prices, how far the search got, that we asked for a review, and your answer to whether you found a ticket, with your comment if you wrote one. It holds no name, e-mail address or IP address: until you sign in, it does not tell us who you are. Purpose: counting searches and seeing where the search helps, where people stop and which routes to collect prices for ahead of time. Legal basis: our legitimate interest in knowing how the search is used (Art. 6(1)(f)). If you sign in in the same tab, the number stays the same: the entries from then on are tied to your account and deleted with it, and the entries of that tab made before signing in can be matched to it by the number. We do not do that. After the account is deleted, those earlier entries stay without any link to you and go after the general period. Entries not tied to an account are deleted after 2 years, together with your comment if you wrote one.

You are not obliged to give us any data. Without an e-mail address we cannot create an account, send the launch letter or answer a message. Without an account you can look through the prices already collected; a search for new prices needs signing in.

3. Who processes data for us

Hosting: the hosting provider of the server. Keeps the database and runs the server.

Cloudflare, Inc. runs the network in front of the site. Every request, with its IP address, passes through it.

Mail: Resend (resend.com), United States. Receives the e-mail address and the letter to deliver it.

Where a processor is outside the European Economic Area, the transfer relies on the safeguards of its data processing terms (the European Commission's standard contractual clauses, or its adequacy decision for the EU-US Data Privacy Framework where the processor is certified). You can ask us for a copy of these safeguards.

We do not sell personal data, do not use it for advertising, and take no decision about you by automated means alone.

4. Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and objection, and you may withdraw consent at any time without affecting what was done before. You may also complain to a data protection supervisory authority, in particular in the EU country where you live.

Right to object: where we rely on our legitimate interest (the security log, the search trail, the statistics, answering messages and claims), you may object at any time on grounds relating to your situation, and we then stop unless we have compelling legitimate grounds.

How: delete your account with the button on the account page; unsubscribe with the link in a letter; for anything else write to from the address in question. We answer within one month.

Erasure is deletion from the database. Encrypted backups keep what was deleted until the copy is replaced by a newer one, for at most 14 days. A copy is used only to restore the server after a failure.

5. Cookies and browser storage

We use no advertising or analytics cookies and no third-party trackers. All cookies on the site are strictly necessary:

the session cookie: set only once you sign in, it lasts 7 days. Without it you cannot sign in, and without signing in there is no search for new prices, only the data already collected;

Cloudflare, the network in front of the site, may set its own security cookies (such as __cf_bm, for about 30 minutes) to tell people from automated traffic.

Browser storage stays on your device. Until you clear it: the theme, the view of the results and the brief or detailed look you chose, whether the filters are folded, which hints you closed and how many searches you have made (hints appear after a few), the airlines and sellers you marked as your own, that you closed the language offer, when the ask for a review was last shown. Until you close the tab: the draft of a shortlist, the collection under way, the page to return to after signing in, what the next-step hint has already said, the tab number of the search trail.

6. Changes

A new edition is published on this page with a new version number. The service is not directed at children under 16.

You can also send a request about your data through the form: write to us

Version com-privacy-2026-11-09