Privacy Policy

Privacy Policy Last updated: October 7, 2026 Version 2026-10-07-v1 · Effective 2026-10-07 1. Introduction Arrival.info is operated by Retro Day LLC ("we," "our," or "us"). This policy explains how we collect, use, and safeguard personal data when you use our pickup planning and coordination service. 2. Information We Collect Account Information: Email address, name, and authentication data when you create an account via Clerk. Flight Information: Flight numbers, airports, and arrival times you choose to track. Location Data: With your permission, we collect driver location to calculate pickup timing and provide real-time coordination. Device Information: Browser type, device type, and IP address for analytics and security. Payment Information: Processed securely by Stripe. We do not store your credit card details. Mobile Messaging Information: If you choose SMS, we collect the mobile number you provide, verification status, SMS opt-in or opt-out status, consent source and version, limited delivery status and cost metadata, and supported messaging keyword events. We do not retain message text, phone numbers, or webhook bodies in our provider-event audit table. Operator sales inquiries may include name, business email, company or operating name, role, anticipated pickup volume, team and messaging needs, operating airports, and notes. 3. How We Use Your Information We use information to provide pickup planning and coordination, calculate pickup times from available arrival signals and traffic, verify mobile numbers, send the transactional pickup or flight notifications you request, enforce consent, suppression, abuse-prevention and usage limits, process payments, improve services through anonymized analytics, communicate about accounts and services, and evaluate and administer Operator plan inquiries. 4. Data Sharing Service Providers: We use providers acting on our behalf for authentication, payment processing, hosting and security, flight data, mobile messaging and verification, and internal business-inquiry notifications. These providers may process only the information needed to perform those services. Pickup Partners: When you share a pickup link, the recipient can see relevant timing information. Optional Advertising Measurement: Unless you opt out on a recognized US visit, or if you explicitly allow ad measurement elsewhere, Meta receives approved public-page visits, browser and advertising identifiers, and network/device information to measure, attribute, and optimize Facebook and Instagram campaigns and build advertising audiences. We do not send Meta private pickup links, flight selections, participant details, precise locations, account contact information, or SMS information. Automatic advanced matching and automatic event collection are disabled. Limited US Conversion Measurement: For eligible recognized US visits with advertising measurement permitted, our server may also tell Meta that a pickup was created or that an invitation link or code was successfully copied/shared. These events contain a random event identifier, event time, existing Meta browser/ad-click identifiers, browser user agent, our origin-only website address, and, for sharing, only whether a link or code was shared. They contain no flight numbers, airport codes, pickup IDs or codes, trip status, private page paths, passenger information, email, phone or precise location. These are attributable advertising events, not anonymous statistics. The Meta browser pixel remains excluded from private pages. Server conversion measurement remains off for non-US and unknown locations, opt-outs and supported GPC/DNT signals. No commerce or SMS-conversion events are included in this exception. Legal Requirements: We may share information when required by law or to protect our rights. We do not sell personal data for money. The Meta advertising disclosures described above may constitute sale, sharing for cross-context behavioral advertising, or targeted advertising under applicable privacy laws. You can opt out directly through Your privacy choices at /privacy#choices, without an account or a form. Supported Global Privacy Control signals are honored. We will not sell, rent, or share your mobile number, SMS opt-in data, or SMS consent status with third parties or affiliates for their own marketing or promotional purposes. We may share that information only with service providers acting on our behalf to deliver and support the messaging program, including messaging platforms and phone carriers, or when required by law. 5. Data Retention We retain account information while an account is active. Pickup data is retained for 30 days after completion. SMS consent, suppression, and limited delivery evidence is retained while needed to operate the messaging program, document consent and opt-out compliance, prevent abuse, resolve disputes, and meet legal obligations. Operator sales-lead information is retained for up to 24 months after submission unless a longer period is required for an active customer relationship, legal obligation, or legal hold. You may request deletion subject to applicable retention requirements. Our server stores a hashed advertising-preference cookie reference and preference record for up to 180 days after an update. Conversion delivery receipts are retained for seven days; attribution cookies and outbound conversion payloads are not stored in those receipts. Expired records are removed in bounded maintenance batches. Pending delivery attempts recheck the server preference before dispatch. Withdrawal cannot retract a request already sent or events already received by Meta. 6. Your Rights You may request access, correction, deletion, or export of personal data, opt out of marketing communications, withdraw consent for location tracking, or withdraw SMS consent at any time by replying STOP. Reply START to resubscribe or HELP for messaging help. 7. Security We use security measures including encryption in transit (TLS), authentication via Clerk, and PCI-compliant payment processing via Stripe. Data is stored on Cloudflare infrastructure. 8. Cookies We use essential cookies for authentication and session management. For recognized US visits, Meta public-page measurement is enabled unless you opt out. For EU/UK, other non-US, and unknown locations, it remains off unless you explicitly choose Allow ad measurement. Cloudflare supplies coarse request country/state only to determine this delivery policy; the policy response contains no IP address, coordinates, or location history and is not cached. Browser GPS is not requested. Your privacy choices in the footer opens the controls at /privacy#choices. Turn off ad sharing opts out; refusing does not affect pickup functionality. Opt-outs do not expire in this browser; explicit opt-in expires after 180 days. Clearing browser storage removes saved choices. Supported Global Privacy Control and Do Not Track signals keep Meta tracking off regardless of location or a previous opt-in. Withdrawal stops future measurement and removes Arrival-domain Meta cookies; it does not erase events already received by Meta. Our existing service analytics are separate from this advertising choice. 9. Children's Privacy The service is not intended for children under 13. We do not knowingly collect personal information from children under 13. 10. Changes to This Policy We may update this policy from time to time and will notify you of significant changes via email or through the service. 11. Contact Us For questions about this privacy policy or your data, contact support@arrival.info. Operator: Retro Day LLC.