Privacy, plainly.

UpLeg LLC (“UpLeg”, “we”, “us”, or “our”) operates the website flyupleg.com (upleg.org redirects to it). This Privacy Policy explains how we collect, use, and protect your personal information.

Information We Collect

When you use our services, we may collect:

• Name, email address, phone number, and company name if you give one
• Flight booking requests: route, passenger count, dietary restrictions, and any trip notes you add
• Charter requests and specialized inquiries: the route and how far you would travel to a nearby airport, your dates, how many are flying, the cabin you want, the most you would pay or your budget if you give one, and any notes
• When you agree to a booking: the time you agreed, the exact terms you agreed to, your IP address, and your browser identifier. That is our record that the agreement was made, and it is the only thing our own records keep your IP address for. PostHog, our analytics service (below), receives it to estimate your approximate location.
• Account information, if you create an account: the email address you sign in with, your first and last name, a mobile phone number, and a home city or airport if you choose to give one
• Device and browser information when visiting our website
• Usage analytics: pages viewed, searches, and clicks on our site, along with your approximate location (city and region, estimated from your internet connection; we do not store your IP address with these analytics). We collect this ourselves, and it is stored separately from your name and email.
• Through PostHog, our analytics service: the same usage events, recordings of how our pages are used (scrolling, clicks, and what was on the screen) so we can see where the site is hard to use, page load times, and errors the site hits in your browser. A recording shows the page as you saw it, including what you type into our forms and the details on your booking and account pages, such as your name, email address and phone number. Sign-in codes and passwords are always hidden. If you have an account, PostHog links your visits to it by an internal number, not by your name or email. PostHog does not run at all in a browser that sends Do Not Track or Global Privacy Control.

Cookies and Local Storage

We set a small number of our own cookies, and PostHog and OpenAI’s ad measurement set a few more. Sign-in cookies keep you logged in. ul_aid (about 13 months) and ul_sid (30 minutes of inactivity) are our own analytics identifiers. ul_home (one year) remembers the home airport you chose so the board opens on it, and ul_recent (one day) your recent searches. Two short-lived cookies (ten minutes) carry the state of a Sign in with Google attempt. ul_oppref (30 days) is set only if you arrive by clicking one of our ads in ChatGPT, and holds that ad click’s reference; ul_oai_conv (ten minutes) passes a request, account or alert you just made to OpenAI’s measurement pixel. A flag on our own staff browsers keeps our visits out of the analytics. Flights you save on the listing, and your scroll position on the board, are stored in your browser, not on our servers. Two third-party scripts run on our pages. PostHog’s, for the analytics above, keeps one cookie (ph_…_posthog, one year) and a copy in your browser’s local storage, holding a random identifier for your browser and the current visit; we serve it from our own address. OpenAI’s measurement pixel tells us whether our ads in ChatGPT lead to requests. It sets __oppref (30 days, the ad click’s reference, only if you came from one of our ads) and __obref (one year, a random reference for your browser). You can clear or block cookies, or block the pixel with a content blocker; the site still works, but you cannot stay signed in without cookies.

How We Use Your Information

We use your information to:

• Process and manage flight booking requests
• Find and quote flights you asked for, including through the charter marketplace we use
• Communicate with you about your bookings and inquiries, by email or phone
• Send booking confirmations, status updates, and flight alerts you subscribe to, by email
• Improve our services and website experience

Text Messages

If you give us a phone number with a flight request, we may text you about that request, for example when an operator confirms a price. We do not text for marketing. Reply STOP to any text to stop receiving them. Message and data rates may apply.

Data Sharing

We do not sell your personal information. We may share data with:

• Charter operators to fulfill your booking requests
• Service providers that run our infrastructure and our bookings: Supabase (database and sign-in), Resend (email delivery), Cloudflare (hosting), Mapbox (the maps on our flight pages, which your browser loads directly from them), Google (only if you choose Sign in with Google), Twilio (text messages, if you gave us a mobile number), and Avinode, the charter marketplace we source and quote flights through, together with its Paynode payment service when you pay UpLeg for a flight, and PostHog (analytics, stored in the United States: the usage events and recordings described above, and your IP address to estimate an approximate location). Each receives only what its part of the job needs: an operator sees your trip and, once you book, the passenger details the flight requires
• OpenAI, to measure our ads in ChatGPT. Its measurement pixel runs on our pages, and when you request a flight or a quote, create an account, or set an alert, it reports which of those happened. To match that to an ad, it may send OpenAI a scrambled (SHA-256 hashed) copy of an email address or phone number shown on the page, never the readable version. If you arrived from one of our ads, our server also sends OpenAI that ad click’s reference with the same report, and nothing about you. We mark every report as opted out of ad personalisation, and OpenAI says it does not use this data to personalise ads
• Aggregated, anonymized usage statistics (for example, how many people in Los Angeles searched a given route) may be shared with charter operators. These never include your identity or contact details.

Data Security

We implement appropriate security measures to protect your personal information. However, no method of transmission over the internet is 100% secure.

How Long We Keep It

We keep booking records, alerts, and account details until you ask us to delete them. When you agree to book, we keep the version of the terms you agreed to and the amounts they stated, for the life of the booking record. Invoice emails are logged like every other email we send you. A booking or alert that expires is marked as expired rather than erased, so we can answer questions about it later. Our own analytics events are stored separately from your name and email; PostHog’s recordings can show them, as described above. PostHog deletes recordings after the retention period of our plan with them. Email admin@upleg.org and we will delete what we hold about you.

Your Rights

You may request to access, correct, or delete your personal data by contacting us at admin@upleg.org. Every alert email includes an unsubscribe link.

California Residents

If you live in California you may ask what personal information we hold about you, ask us to delete it, and ask us to correct it, by emailing admin@upleg.org. We do not sell personal information. We use OpenAI’s pixel only to measure our own ads, with every report marked as opted out of personalisation; a content blocker stops it entirely. We will not treat you differently for exercising these rights.

Children

UpLeg is not directed at children, and we do not knowingly collect personal information from anyone under 13. If you believe a child has given us their details, email admin@upleg.org and we will delete them.

Contact Us

If you have questions about this Privacy Policy, please contact us at admin@upleg.org.