Privacy Policy
Effective March 8, 2026
Overview
RowHint is designed to be straightforward about data. We are not an advertising platform. We do not sell your data. We do not use tracking cookies or behavioral advertising. This policy explains what we collect, why, and how you can control it.
What We Collect
Review Submissions
When you submit a seat review, we collect: seat number, rating (1–5 stars), optional comment (up to 500 characters), optional flight date, and optional display name. Reviews are stored in Supabase and held for moderation before appearing publicly. We do not require an account to submit a review.
Contact Form Submissions
When you use the contact form, we collect: your message (up to 2000 characters), an optional email address (so we can respond), and the category you select. Submissions are stored in Supabase and may be forwarded to our email via Resend. Anon users (no email provided) receive no follow-up.
Email Waitlist
If you sign up to be notified when we add your airline, we store your email address and optional airline preference in Supabase. You can request deletion at any time by emailing us. We will use your email only to notify you when the requested airline is added. We do not send marketing emails.
Analytics
We use Plausible Analytics — a privacy-first analytics tool. Plausible does not use cookies, does not track individuals across sessions or sites, and does not store any personally identifiable information. It collects aggregate page views and referrers only. No cookie banner is required. You can learn more at plausible.io/privacy.
What We Do Not Collect
- No account registration — no passwords, no profiles
- No tracking cookies or advertising pixels
- No payment information (we have no paid features)
- No precise location data
- No behavioral targeting or cross-site tracking
Data Storage and Security
User-submitted data (reviews, contact messages, email addresses) is stored in Supabase, a PostgreSQL-based cloud database with Row Level Security (RLS) enabled. The site is hosted on Vercel. All data is transmitted over HTTPS. We use the Supabase service role key only server-side and never expose it to the browser.
Third-Party Services
| Service | Purpose | What they see |
|---|---|---|
| Supabase | Database | Submitted user data |
| Vercel | Hosting | Server logs (IP, request path) |
| Plausible | Analytics | Aggregate page views only, no PII |
| Resend | Contact email delivery | Contact form content + reply-to email |
Your Rights
You can request deletion of any data you have submitted (reviews, contact messages, email signups) by contacting us. We will fulfill deletion requests within 30 days.
Children's Privacy
RowHint is not directed at children under 13. We do not knowingly collect data from children.
Changes to This Policy
If we make material changes to this policy, we will update the effective date above. Continued use of RowHint after changes are posted constitutes acceptance.
Contact
Questions about privacy? Contact us — we read every message.