Privacy Policy

PointsGPT is operated by Atllas, Inc. This policy describes what the app and this website collect, why we collect it, who receives it, and your choices.

What we collect

Text messages and calls

Your mobile number is how you sign in. When you enter it we text you a six-digit code to prove the number is yours. If you choose WhatsApp, or your number is outside the US, the code goes by WhatsApp instead. WhatsApp is run by Meta, so Meta receives your number and the code to deliver it.

• Sign-in codes. Requesting a code is your consent to receive that code.
• Account texts. Only if you tick the account texts box, we text you fare alerts and account updates.
• Offers and promotions. Only if you tick the separate offers and promotions box, we text you offers and promotions, including messages Hazel sends for us.
• Calls. Only if you tick the calls box, PointsGPT and the providers working for us may call you, including with automated or AI-assisted technology.
• Earlier wording. If you agreed under an earlier wording, on our website or in an older version of our iPhone app, that wording still applies to your texts and calls.
• Agreeing to texts or calls is never a condition of buying anything.
• Frequency. Varies with what you use and what you agreed to.
• Stopping. Reply STOP to an alert or offer text and those texts stop. Sign-in codes come from their own number, and a STOP to one of them stops sign-in codes. Reply HELP for help. Message and data rates may apply.
• Carriers. Mobile carriers are not liable for delayed or undelivered messages.
• We never sell, rent, or share your mobile number, text messaging opt-in data, or consent with third parties or affiliates for their marketing or promotional purposes. Opt-in data and consent go only to Twilio and Hazel, which send our texts and calls for us.

Email

If you give us an email address, we use it for account messages and, if you agreed, occasional deals. Every marketing email has an unsubscribe link. An address you give for a trial or renewal reminder is used for that reminder only. If you cancel a plan you paid for on the web, we may email you up to two offers to come back, to the address on your payment details, each with an unsubscribe link.

If you give an email when you pay on the web, we keep it with your purchase and give it to Stripe, our payment processor, for your payment records. If you leave before adding your phone, we may write to you there to help you reach what you bought. That email is not used for deals unless you agree to them.

Advertising and measurement

We advertise on Facebook and Instagram. To learn which ads work, and to show them to people likely to find PointsGPT useful, we use Meta’s pixel on our website and Meta’s software kit in our iPhone app, and our servers tell Meta about events such as sign-up, a search, a look at our prices, checkout, and purchase. When your answers before your first search show you are likely to subscribe, we also tell Meta once, with a short summary: your points range, whether you named travel dates, and how many people are traveling.

We also advertise in ChatGPT. To learn which of those ads work, we use OpenAI’s pixel on our website, and our servers tell OpenAI about sign-ups, free trials, and purchases, on the website and in our iPhone app.

• With those events we may send your mobile number, email address, name, and account identifier in hashed (scrambled) form, along with your IP address and browser or device details. With a purchase we also send the city, state, and ZIP code of your billing address, hashed. Meta uses them to match the event to an account on its platforms. With a search we tell Meta only that you searched and whether it was your first. Apart from that summary, we send nothing about the trips you search for, and never whether you agreed to texts or calls.
• OpenAI receives the same kinds of events with your mobile number, email address, and account identifier in hashed form, your IP address and browser or device details, the plan and the amount of a purchase, and the identifiers OpenAI’s pixel and ads give your browser and your ad click. OpenAI uses them to match the event to a ChatGPT ad. It receives no name, billing address, or anything about your trips.
• On iPhone, the app asks your permission to track through Apple’s prompt. If you say no, the app does not use your device’s advertising identifier.
• Some US state laws, including California’s, may treat this as sharing personal information for targeted advertising. To opt out, email hello@pointsgpt.app with “Do not share” and we will stop sending your mobile number, email address, name, billing address, and account identifier to Meta and OpenAI, stop sending Meta the summary of your answers, and turn OpenAI’s pixel off for you on our website. You can also decline tracking on iPhone, and adjust your ad preferences in your Meta account.

What we do not collect

• We never ask for, receive, or store your frequent flyer credentials or the logins or account numbers of any airline or bank.
• We do not store your card number. Stripe and Apple handle payment.
• We do not track your location in the background or store your location coordinates.

What we never do

We do not sell your data for money. We do not give it to data brokers, airlines, or banks. There is no arrangement under which any third party pays us for information about you.

Who receives data

• Cloudflare — hosts this website and serves it.
• Supabase — hosts our database and your saved preferences.
• Apple — distributes the app, takes in-app payments, and reports crashes to us.
• Stripe — takes payments on the web.
• RevenueCat — keeps track of App Store subscriptions for us.
• Twilio — delivers text messages, and WhatsApp sign-in codes through Meta. They receive your mobile number to deliver them.
• Resend — delivers email, if you have given us an address.
• Meta — for advertising and measurement, as described above.
• OpenAI — for advertising and measurement in ChatGPT, as described above.
• Hazel — a customer-contact provider. If you agreed to be contacted about offers and saw a price without buying, Hazel may text you, or call you if you agreed to calls, on our behalf. It receives your name, mobile number, email if you gave one, your cards, home airport, and number of travelers, the trip you asked about, the fares your last search found, and the price you were shown, and whether you agreed to be contacted, with the words you agreed to and when. If you agreed to offers and promotions texts, Hazel’s AI assistant may text you the fares your search found.
• CardRatings — our credit card partner. When the app shows you an offer for a named card, your browser loads the card’s picture from the image server of CardRatings and its parent company, QuinStreet. That server sees your IP address and browser, as any website does, and nothing else about you.
• Calendly — schedules calls with our booking concierge. If you pick a time, it receives your name, your email if you gave one, and the details of the flight or trip you want to book.
• AI model providers (xAI, OpenAI, Anthropic, and Google) — receive the text of your questions and the trip details needed to answer them, including what you type during onboarding before you have an account.

Award availability comes from flight-data providers. We send them routes and dates only, never information about you.

Retention and deletion

We keep your account information while you have an account. Search text is also kept in aggregate to decide which routes to cover. Payment records are kept as long as the law requires.

Email hello@pointsgpt.app and we will delete everything associated with you, except records we must keep by law. We aim to do it within seven days and will confirm when it is done.

Your rights

Depending on where you live, you may have the right to access, correct, export, or delete your data, to opt out of sharing for targeted advertising, and to object to processing. To exercise these rights, email us at the address above. We will not charge you or treat you differently for doing so.

Children

PointsGPT is not directed at children under 13 and we do not knowingly collect their data.

Changes

If this policy changes materially we will update the date above and tell you in the app or by email before the change takes effect.

Contact

Atllas, Inc. — hello@pointsgpt.app