2026-09-12
This Privacy Policy explains how LeaveTime ("LeaveTime", "we", "us") collects, uses, discloses, and protects personal data through the LeaveTime website and app (the "Service"). It is written to meet Singapore's Personal Data Protection Act (PDPA) and, for users in the European Economic Area and the UK, the General Data Protection Regulation (GDPR).
LeaveTime is operated by [LeaveTime operating entity], based in Singapore, which acts as the organisation responsible for personal data under the PDPA and as data controller under the GDPR.
Account data: your email address (used for sign-in via a one-time link) and your language preference.
Trip data you give us: flight number and date, departure and destination airports, terminal, your starting address or coordinates, transport mode, party size, checked bags, and your gate-buffer/fast-track/reduced-mobility preferences.
Actuals you report: after a trip, the actual door-to-gate time (and, if you choose to give it, a per-segment breakdown) you tell us about - the ground-truth data that improves future estimates.
Payment data: if you pay for flight monitoring or a subscription, Stripe collects and processes your card details directly - we never see or store your full card number.
Location data: if you use "Use my location" or type a starting address, we send that location to Google's Places/Routes APIs to resolve it to an address and compute a drive time; we store the resolved coordinates with your trip.
Device/usage data: if product analytics is enabled (PostHog), we collect standard event and device data - which actions you took in the Service, browser type, and similar - tied to a device identifier, and to your account if you're signed in.
To compute and show you a leave-time estimate, including sending your trip details to our model service and, for the plain-language summary of your result, to Anthropic's API (no data is used by Anthropic to train its models under our agreement's terms).
To look up a flight's schedule and derive whether your trip is international or domestic, via AeroDataBox and OpenSky.
To save trips to your account, activate and run flight monitoring, and send you related notifications and emails (including the post-trip request for actuals).
To process payments for paid features, via Stripe.
To improve LeaveTime's estimates over time, using the actuals you report - aggregated and, wherever possible, de-identified for model training.
To keep the Service secure and working as intended, and, where enabled, to understand product usage via analytics.
Performance of a contract: computing your estimate, saving your trip, and running monitoring you've paid for.
Consent: your language preference, product analytics where used, and marketing you've opted into (we don't send marketing email you haven't asked for).
Legitimate interests: keeping the Service secure, improving the underlying model using aggregated actuals, and responding to support requests.
Under the PDPA, we collect, use, and disclose personal data only for purposes you have been notified of (this Policy) and have consented to, or as otherwise permitted by law (for example, deemed consent when you provide data for a purpose reasonably necessary to complete a transaction).
Supabase - our database and authentication provider, hosting your account and trip data.
Stripe - payment processing for paid features.
Resend - sending transactional emails (sign-in links, ground-truth and monitoring emails).
Google - the Places and Routes APIs, to resolve addresses and compute drive times.
AeroDataBox and OpenSky - flight schedule and status lookups.
Anthropic - generating the plain-language explanation of your estimate.
PostHog - product analytics, only if and once enabled.
Vercel and Fly.io - hosting the website and the model service.
We do not sell personal data, and we do not share it with anyone for their own marketing purposes.
Because our processors above are based in different countries (including the United States and the European Union), your data may be transferred outside Singapore and, for EEA/UK users, outside the EEA/UK. Where required, we rely on the processor's own compliance mechanisms (such as standard contractual clauses) for these transfers.
Account and trip data: kept while your account is active, and for up to 12 months after you close it, in case you reopen it or we need it to resolve a dispute or comply with a legal obligation, then deleted or anonymised.
Payment records: kept for as long as required by Singapore accounting and tax law (typically several years) - handled primarily by Stripe as our payment processor.
Actuals you report: retained in de-identified/aggregated form indefinitely for model improvement, since once aggregated they're no longer linked back to you.
Analytics events (when enabled): kept per PostHog's standard retention, which we configure to the shortest period that's still useful for understanding product usage.
You can ask us to delete your account and associated personal data at any time; see Section 9.
Under the PDPA, you may ask us what personal data of yours we hold and how it's been used or disclosed, and ask us to correct an error or omission.
Under the GDPR (if it applies to you), you additionally have the right to request erasure, restriction of processing, data portability, and to object to processing based on legitimate interests; you also have the right to lodge a complaint with your local supervisory authority.
To exercise any of these rights, email privacy@leavetime.app. We'll respond within the time required by applicable law.
We use your browser's local storage (not third-party tracking cookies) to remember your language, theme, and trip-detail preferences on your device. If analytics is enabled, PostHog may set its own cookies/identifiers to distinguish devices - see Section 6.
LeaveTime is not directed at children, and we don't knowingly collect personal data from anyone under 16. If you believe a child has given us personal data, contact us and we'll delete it.
We rely on our processors' security controls (encryption in transit, access controls) and apply reasonable technical and organisational measures of our own. No system is 100% secure, and we can't guarantee absolute security of data you send us.
We may update this Policy from time to time. If we make a material change, we'll take reasonable steps to let you know before it takes effect.
Questions, requests, or complaints about this Policy or your personal data: privacy@leavetime.app. You may also complain to Singapore's Personal Data Protection Commission (PDPC) or, if the GDPR applies to you, your local supervisory authority.