Privacy Policy
Last updated 28 September 2026
PointsGPT is operated by Atllas, Inc. This policy describes what the app and this website collect, why, who else receives it, and the choices you have. It is written to be read, not to be survived.
What we collect
| Data | When | Why |
|---|---|---|
| Mobile number | When you create an account | It is how you sign in and how we text your code. We also text you if you agreed to it |
| Name | When you create an account | To address you in the app and in our messages |
| Email address | Optional | To email you about your account, when your free search is ready, and deals if you agreed |
| Your questions and trips | When you use the app | To search for award seats and answer you, and to decide which routes to cover |
| Cards, points programs and a rough points balance you tell us | During onboarding | To show only seats you can actually book |
| Home airport | During onboarding | To search from the right place |
| Device and usage information: a device identifier, IP address, browser or device type, and what you do in the app | When you use the website or app | To run the service, stop abuse, see what works, and measure our ads |
| Purchase records | When you buy PointsGPT Pro | To give you Pro and keep records. Stripe or Apple take the payment; we never see your full card number |
Text messages and calls
Your mobile number is how you sign in. When you enter it we text you a six-digit code to prove the number is yours.
- Account messages. Requesting a code is your consent to receive the code and messages about your account, such as your free search being ready.
- Offers. Only if you tick the box agreeing to it, PointsGPT and the providers working for us may call or text you about your account and related offers, including with automated or AI-assisted technology. Agreeing is never a condition of buying anything.
- Frequency. Varies with what you use and whether you agreed to offers.
- Stopping. Reply STOP to any message and we stop. Reply HELP for help. Message and data rates may apply.
- Carriers. Mobile carriers are not liable for delayed or undelivered messages.
- We never sell or rent your mobile number, and we never give it to anyone for their own marketing.
If you give us an email address we use it for your account and, if you agreed, the occasional deal. Every marketing email has an unsubscribe link.
Advertising and measurement
We advertise on Facebook and Instagram. To learn which ads work, and to show them to people likely to find PointsGPT useful, we use Meta’s pixel on our website and Meta’s software kit in our iPhone app, and our servers tell Meta about events such as sign-up, checkout and purchase.
- With those events we may send your mobile number, email address, name and account identifier in hashed (scrambled) form, along with your IP address and browser or device details. With a purchase we also send the city, state and ZIP code of your billing address, hashed. Meta uses them to match the event to an account on its platforms. We send nothing about the trips you search for.
- On iPhone, the app asks your permission to track through Apple’s prompt. If you say no, the app does not use your device’s advertising identifier.
- Some US state laws, including California’s, may treat this as sharing personal information for targeted advertising. To opt out, email hello@pointsgpt.app with “Do not share” and we will stop sending your mobile number, email address, name, billing address and account identifier to Meta. You can also decline tracking on iPhone, and adjust your ad preferences in your Meta account.
What we do not collect
- We never ask for, receive, or store your frequent flyer credentials or the logins or account numbers of any airline or bank.
- We do not store your card number. Stripe and Apple handle payment.
- We do not collect precise location.
What we never do
We do not sell your data for money. We do not give it to data brokers, airlines, or banks. There is no arrangement under which any third party pays us for information about you.
Who receives data
- Cloudflare — hosts this website and serves it.
- Supabase — hosts our database and your saved preferences.
- Apple — distributes the app, takes in-app payments, and reports crashes to us.
- Stripe — takes payments on the web.
- RevenueCat — keeps track of App Store subscriptions for us.
- Twilio — delivers text messages. They receive your mobile number to deliver them.
- Resend — delivers email, if you have given us an address.
- Meta — for advertising and measurement, as described above.
- Hazel — a customer-contact provider. If you agreed to be contacted about offers and saw a price without buying, Hazel may text or call you on our behalf. It receives your name, mobile number, email if you gave one, the trip you asked about and the price you were shown.
- AI model providers (xAI, OpenAI, Anthropic and Google) — receive the text of your questions and the trip details needed to answer them.
Award availability comes from licensed flight-data providers. We send them routes and dates only, never information about you.
Retention and deletion
We keep your account information while you have an account. Search text is also kept in aggregate to decide which routes to cover. Payment records are kept as long as the law requires.
Email hello@pointsgpt.app and we will delete everything associated with you, except records we must keep by law. We aim to do it within seven days and will confirm when it is done.
Your rights
Depending on where you live, you may have the right to access, correct, export, or delete your data, to opt out of sharing for targeted advertising, and to object to processing. Exercise any of them at the address above. We will not charge you or treat you differently for doing so.
Children
PointsGPT is not directed at children under 13 and we do not knowingly collect their data.
Changes
If this policy changes materially we will update the date above and tell you in the app or by email before the change takes effect.
Contact
Atllas, Inc. — hello@pointsgpt.app