Lalafly — Privacy policy

Who is responsible

Lalafly is an award-flight availability search service for Brazilian loyalty programs. TMK Apps is the controller. Contact tmk@terosmk.com for support, privacy requests or to contact the person responsible for data protection. Source policy revised October 18, 2026.

Searches, alerts and accounts

You can browse routes and mileage history without supplying a name, email or phone number. Technical navigation and security information is still processed as described below.

Alerts store your chosen delivery channel (email or your webhook), route, dates, cabin, loyalty program and mileage threshold. A secret code in the management link controls each alert.

Optional accounts store your email. Google sign-in can also provide your name and profile picture. Apple sign-in provides an account identifier, your name when supplied, and an email or private relay address. We keep tokens needed to maintain and revoke provider authorization. Email-link and password sign-in are also available. Passwords are stored as protected scrypt hashes, never readable text; password registration requires email verification.

A signed cookie keeps your session for up to 30 days. Session records may contain IP address and browser information for security. IP-based abuse counters run in server memory. Hosting access logs follow provider retention. Cloudflare’s IP-derived approximate city can suggest a departure airport and order homepage routes; it does not use device GPS or store the suggestion in your account. You can change the origin.

Live searches and follow-up

Collection jobs record routes and dates to manage queues and costs and may be associated with accounts for usage control. Account searches retain the route, dates, selected programs and collection result with a credit balance and ledger, without IP addresses. These records are removed with the account.

If you request a search-completion email, we store the request and sending times and send one message to the account email, including when no availability was found. No message is sent without that request.

After an account search, limited follow-up checks compare equivalent prices or newly available seats and email only improvements. Notices are grouped and limited per person, end automatically no later than two weeks after the search and can all be disabled through one email link, including future searches. You can enable them again in your account. Comparison prices and check counts are stored with the account. Notifications show a preview; full details and booking links require a subscription.

Purchases and mobile notifications

iPhone purchases store Apple order and transaction identifiers, product or pass, amount, currency, dates and purchase, renewal or refund status with the Lalafly account. Legacy passes also store the selected route. We send Apple an order identifier to associate the purchase with the account and verify transactions with Apple to maintain access.

For Google Play subscriptions, we store the purchase token, product and plan, status, access dates, renewal setting, latest order number, amount and currency. Google receives an internal Lalafly account identifier without name or email. Our server verifies and acknowledges purchases and receives renewal, cancellation, suspension and refund notices from Google.

If you enable mobile notifications, we store the device push token, platform and chosen frequency, linked to the signed-in session. Without enabling notifications, no token is stored. It is removed when notifications are disabled, you sign out or delete the account, or the provider marks it invalid. Apple Push Notification service or Google Firebase Cloud Messaging receives the token and message. Sent message text remains in the account until account deletion.

Usage records, preferences and ChatGPT

The website records pages, actions, times, whether access is from the site or app, and a short device/browser description. This helps support and product improvement. It does not record IP addresses, typed text or secret alert, password-reset or payment codes. A random first-party lf_vid cookie recognizes the device for up to 400 days. Recent anonymous activity is associated with the account when you sign in. Account activity is kept for 180 days; activity from a device that never signed in is kept for 30 days. Account deletion removes both account activity and linked anonymous history.

This usage record also applies to the iPhone 1.x WebView app. Native Android and iPhone 2.0+ apps do not send this record; only sign-in steps are counted without account association.

Without sign-in, recent searches, appearance, mileage valuation settings and route-view preferences stay on the device. With sign-in, searches, filters and preferences sync to the account; earlier local searches are added when you sign in and local recent searches are cleared when you sign out. They are removed with account deletion.

If you connect the Lalafly plugin in ChatGPT, you sign in and ChatGPT receives an access token, renewed with use and valid for up to 30 days without use. We retain the token, date and query parameters such as route, origin and mileage ceiling. ChatGPT receives the prices you ask about, plus your name and email so it knows which account is connected. It also receives the miles and card points programs (such as Livelo and Esfera) you selected in your account under “Where are your miles?”, so it can show prices in your own programs and points. OpenAI handles this data under its own privacy rules. Disconnect the plugin in ChatGPT; tokens are removed with the account.

What we do not collect

We do not collect readable passwords, full payment-card details or loyalty-program login credentials. Stripe processes website card payments; Apple and Google Play process their app purchases. Lalafly never asks for your Smiles, LATAM Pass, Azul or other loyalty-program username and password.

Purposes and legal bases

Under Brazil’s LGPD, requested alerts, account sessions and mobile notifications rely on performance of requested procedures (Article 7(V)); purchase verification and contracted access rely on contract performance (Article 7(V)). Abuse prevention, aggregate service measurement, support usage records and limited price-improvement follow-up rely on legitimate interests (Article 7(IX)), with the choices described here, including a one-click follow-up opt-out. Required records and lawful authority requests rely on legal obligations (Article 7(II)).

We do not use your data for behavioral advertising, sell it or make automated decisions affecting your interests.

Cookies and measurement

Necessary cookies support signed-in sessions, route calendar/list view and the separate administrator session. Without them, the corresponding functions do not work. Browser local storage keeps unsigned-in appearance, mileage valuations and recent searches locally; clearing website data removes them. With sign-in these preferences also belong to your account.

The website loads Google Tag Manager, which may run Google Analytics. These tools write their own cookies and receive technical visit information including IP address, pages and browser details. The website currently does not display a consent banner. You can block third-party cookies or Google domains, or use a blocking extension; the rest of the service continues to work. Blocking the first-party lf_vid cookie stops linking successive visits without preventing use.

Native Android and iPhone 2.0+ apps load no Google Analytics, Meta pixel or advertising/measurement tools and do not use the device advertising identifier. Earlier iPhone WebView versions use website Analytics with advertising storage denied, no Meta pixel or other advertising tool, and the first-party usage record. App sign-in screens are excluded from all measurement. Website pages opened in an external browser follow website rules. Operational account, search, purchase and interaction records continue as described here.

Providers and international transfers

Railway hosts the service and database. Resend receives message addresses and content for email delivery. Google provides chosen sign-in, website measurement, Google Play billing and enabled Android push delivery. Apple provides chosen sign-in and relay email, iPhone purchase processing and enabled push delivery. Stripe processes website payments and supplies customer identifiers and payment, subscription and legacy-pass status. OpenAI receives data only if you connect the plugin: your name, email, the miles and card points programs saved in your account, and the answers to your questions. Authorities receive information on lawful request.

Collection and proxy providers querying loyalty programs receive route and date without identifying who searched. Some providers operate outside Brazil. International transfers under LGPD Article 33 support the requested service and are limited to these purposes.

Retention

Alerts remain until deleted through their management links, which removes the alert and its contact from the database. Accounts remain until deletion is requested. Apple purchase records are removed from Lalafly with account deletion; Apple’s order history remains, and deleting the account does not cancel Apple subscriptions. Google Play account deletion cancels renewal and removes subscription records from Lalafly; Google’s order history remains.

Sessions expire after up to 30 days without use or on sign-out. Email sign-in links expire after 15 minutes and are single use. IP abuse counters last minutes in memory and disappear on server restart. Notification tokens and activity records follow the periods above. Hosting access logs follow the provider’s retention or longer legal requirements.

Your rights and security

LGPD Article 18 provides rights to confirmation, access, correction, anonymization or deletion, portability, information about sharing and withdrawal of consent. Pause or delete alerts through their email links. Disable all search follow-ups through their email footer. View account data at My account and delete your account and associated data on the site or app after signing in and confirming. Contact us for other requests; identity confirmation may be needed to protect your data. You may also complain to Brazil’s ANPD.

HTTPS, signed session cookies, separate administrator access, individually salted scrypt password hashes and single-use 15-minute recovery links protect access. Password recovery ends previous sessions. No system is immune to incidents. If an incident poses relevant risk, affected people and the ANPD will be notified as required by LGPD Article 48.

Age and policy changes

Lalafly is not directed at people under 18 and does not intentionally collect their personal data. Contact us if this occurs so the data can be deleted. We will update this policy when practices change; material changes affecting accounts or alerts will be emailed before taking effect.