Privacy policy
Effective 25 September 2026
We collect what we need to plan trips with your group: your name and email, what you tell us about when and how you like to travel, what you and your group post, and records of bookings and shared costs you add. We use AI services to read receipts and confirmations and to power the assistant. We don’t sell your personal information, we don’t show ads, and we don’t use tracking cookies. You can delete your account at any time.
1. Who we are
Same Skies (“we”, “us”) is operated by Julien Horrocks, based in Australia. We are responsible for your personal information under this policy. Contact us about privacy at support@sameskies.app.
This policy covers the Same Skies iPhone app, the web app and this website. It is written to meet the Australian Privacy Principles under the Privacy Act 1988 (Cth), and, for people in the European Economic Area and the United Kingdom, the GDPR and UK GDPR.
2. What we collect
You give us
- Account details — your name, and if you create a full account, your email address and a password (stored only as a secure hash). You can use Same Skies as a guest with just a name.
- Travel preferences — home airports, flight budgets, trip lengths, the dates you’re free, and similar preferences you set for yourself or a group.
- Group content — messages you post in group and trip chats, polls and votes, trip plans, and anything you ask the assistant.
- Bookings you add — confirmation emails you forward to your private forwarding address and files or screenshots you upload. These can include booking references, flight and hotel details, and the names of travellers on the booking.
- Shared costs — expenses and bills, receipt photos, what each person had, and how costs are split and settled.
- Payment handles — if you choose to add them, details such as a PayID so friends can pay you back. We never process payments and never ask for card or bank log-in details.
We collect automatically
- Technical information — IP address, device and app version, and server logs, used to run and secure the service.
- Notification tokens — if you turn on notifications, a token from Apple or your browser so we can send them.
- Affiliate link activity — links to travel partners carry a random identifier for your membership in a group. When a booking is made through one of our links, our affiliate network tells us about it (for example the route, date, price and status) — never your name, email or payment details — so we can show the booking in your trip and receive our commission.
Others give us
- Members of your groups can add information that relates to you — for example naming you on a shared bill or a forwarded booking.
Please don’t upload information about other people unless you have a reasonable basis to share it with your group for planning the trip.
3. How we use it
- To provide the service: groups, chats, finding fares that suit everyone, trip plans, bookings, shared costs and notifications.
- To power AI features: the assistant, reading receipts and booking confirmations, and understanding requests like “I had the burger”.
- To match bookings made through our links to your trip, and to receive commission from partners.
- To keep the service secure, prevent abuse, fix problems and improve features.
- To communicate with you about your account and the service, and to comply with the law.
We do not use your personal information for advertising, and we do not make decisions about you that have legal or similarly significant effects using automated processing.
4. Artificial intelligence
When you use the assistant, send a receipt or forward a confirmation, the relevant content (for example your message and recent group context, or the image, PDF or email text) is sent to our AI provider to produce a response. We currently use OpenAI’s business API, and may use Anthropic’s. Under their business terms these providers don’t use the content we send to train their models. AI output can be wrong: changes to plans and costs are shown to you to confirm before they’re saved.
5. Who we share it with
- Your groups. What you post in a group, and the plans, bookings and costs you add to its trips, are visible to that group’s members. Deal cards show each member’s fare and whether the trip fits their budget and dates.
- Service providers who process information for us under contract:
Provider What for Where Google Cloud Hosting the service; storing receipts and uploads Sydney, Australia Supabase Database Sydney, Australia OpenAI (and possibly Anthropic) AI features (section 4) United States Resend Sending email and receiving forwarded confirmations United States Apple and browser push services Delivering notifications you turn on Various Travelpayouts (affiliate network) Tracking bookings made through our links (pseudonymous identifier only) Outside Australia - Travel partners, when you choose to visit them. When you tap a link to an airline, hotel site or other partner, you go to their website, and their own privacy policy applies to what you do there.
- Legal and safety. Where required by law, or to protect people’s safety, rights or property.
- Business transfers. If the service is sold or merged, personal information may transfer to the new operator under this policy.
We do not sell or rent your personal information, and we do not share it for cross-context behavioural advertising.
6. Overseas transfers
Our main systems are in Australia. Some providers above process information in the United States and other countries. We choose providers with strong security and privacy commitments and, where the GDPR or UK GDPR applies, rely on appropriate safeguards such as the European Commission’s standard contractual clauses.
7. How long we keep it
- Your account information is kept while your account exists. When you delete your account we delete your profile, email, password, preferences, notification tokens and payment handles within 30 days; copies in backups are overwritten within a further 30 days.
- Messages, plans and costs you contributed to a group remain part of that group’s shared history, shown as from a “Former member”, so the other members’ plans and balances stay correct. Ask us if you want specific content removed.
- Server logs are kept for up to 30 days. We keep records longer only where the law requires it.
8. Your choices and rights
You can view and change most of your information in the app, and delete your account in Settings. You can also ask us to:
- give you access to, or a copy of, your personal information;
- correct information that’s wrong;
- delete your information, or restrict or object to how we use it;
- withdraw consent where we rely on it (for example notifications — turn them off at any time in your device settings).
Email support@sameskies.app. We’ll respond within 30 days and may need to confirm your identity. There’s no charge.
If you’re not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au), or, in the EEA or UK, to your local data protection authority or the Information Commissioner’s Office (ico.org.uk).
Legal bases (EEA/UK). We process your information to perform our contract with you (providing the service), for our legitimate interests (security, improving the service, affiliate attribution, keeping group records accurate — balanced against your rights), with your consent (notifications), and to meet legal obligations.
California and other US states. You have rights to know, access, correct and delete personal information, and not to be discriminated against for using them. We do not sell or share personal information as those laws define it.
9. Cookies and similar technologies
This website sets no cookies and loads nothing from other companies — no analytics, advertising or social media trackers. The web app stores only what it needs to work in your browser (keeping you signed in, your theme and which messages you’ve seen). Travel partners’ websites set their own cookies after you choose to visit them.
10. Security
We use encryption in transit, hashed passwords, access controls and hosting with recognised security certifications. No system is perfectly secure; if a breach is likely to cause you serious harm we will notify you and the regulator as the law requires.
11. Children
Same Skies is not for anyone under 16. We don’t knowingly collect information from children under 16; if you believe a child has given us information, contact us and we’ll delete it.
12. Changes
We’ll update this policy as the service changes and show the effective date at the top. If a change is significant we’ll tell you in the app or by email before it takes effect.
13. Contact
Julien Horrocks · support@sameskies.app