Privacy policy
Effective 19 August 2026
Fly Where To? (flywhereto.com) is operated by Intuitive Bricks AB, Åhus, Sweden, which is the data controller for the processing described here. The short version: there are no accounts, we set no cookies, and we collect as little as running a public web service allows.
What we collect
Server logs. Requests to our API (including the MCP endpoint) are logged with IP address, request path and timestamp, used only for rate limiting, abuse prevention and debugging. Logs rotate automatically and are retained for days, not months.
Aggregate analytics. We use Cloudflare Web Analytics, which is cookieless and shows us aggregate page counts, not individual visitors.
Shared map links. If you create a meet-up share link, the map configuration you chose (airports and filters) is stored under a random code together with creation and last-access timestamps. No name or account is attached; anyone with the code can view the configuration.
We do not collect names, e-mail addresses or payment details, and the site works without any registration.
The MCP server
The endpoint at /api/mcp answers queries about airports, routes and airlines. Queries contain no personal data by design and are processed and logged like any other API request, as described above. Responses are built from our own database.
Third parties
Map tiles are loaded by your browser directly from the configured tile provider (OpenFreeMap by default), which therefore sees your IP address, as with any resource your browser fetches. Indicative price estimates are fetched by our server from Travelpayouts; only the route and dates are sent, never your IP address or any identifier. Booking links lead to external travel sites (for example Skyscanner) whose own privacy policies apply once you leave flywhereto.com. Route data itself comes from Wikipedia and Wikidata and contains no user data.
Cookies
We set no cookies and use no local storage. Map state lives in the page URL.
Your rights
Under the GDPR you can request access to, correction of, or deletion of personal data we hold. Given the above, that is normally at most short-lived log entries. Contact us and we will respond promptly; you can also lodge a complaint with the Swedish Authority for Privacy Protection (IMY).
Contact
Intuitive Bricks AB, Åhus, Sweden. johan.emilsson@intuitivebricks.com · intuitivebricks.com
If this policy changes materially, the effective date above changes with it.