Privacy Policy
Last updated 3 November 2026
Who we are
Farepop is provided by Avello Pty Ltd (ABN 37 703 637 601), trading as Avello Studios, Suite 115, Shop 17/2 Wilkinson Road, Para Hills SA 5096, Australia. In this policy, "we" and "us" mean Avello Pty Ltd.
We are responsible for the personal information described here. For people in the United Kingdom, the European Economic Area and Switzerland, we are the controller under the UK GDPR, the EU GDPR and the Swiss data protection act. Everywhere, we handle personal information in line with the Australian Privacy Principles.
For any privacy question or request, email [email protected].
What we collect
Account details: your email address and how you sign in (Apple, Google or an email code). If you sign in with Apple and hide your email, we only see the relay address Apple gives us. If you sign in with Google, Google may also share your name and profile photo with our sign-in provider.
Travel preferences: your departure airports, destination regions, priority countries, how often you travel, who you travel with, date flexibility, interests and how you want alerts.
Activity: the deals you view, save, rate or click through to, the alerts we send you and whether you open them, and how you use the app, such as screens viewed and buttons tapped.
Device and technical details: a push notification token, device type, operating system and app versions, language, timezone, your IP address and the approximate location (country or city) it indicates, and crash and error reports.
Subscription details: whether you subscribe, your plan, trial and renewal dates and the store you bought through, from Apple or Google via our subscription provider. We never receive your card details.
Messages you send us, such as support emails.
How we use it and our legal bases
To run your account and provide Farepop: matching fares to your preferences, showing deals, sending the push and email alerts you turn on, managing your subscription and answering support requests. Legal basis in the UK and EEA: performing our contract with you.
To keep Farepop secure and working: preventing fraud and abuse, fixing crashes and errors, and checking that alerts are delivered. Legal basis: our legitimate interest in running a safe, reliable service.
To understand how Farepop is used and improve it, including testing changes on groups of users. Legal basis: your consent in the UK, the EEA and Switzerland, and our legitimate interest elsewhere. You can turn this off at any time (see Analytics below).
To send push notifications and marketing emails, only if you allow them. Legal basis: your consent, which you can withdraw at any time.
To keep records we must keep by law, such as purchase records for tax. Legal basis: legal obligation.
Matching deals to your preferences is automated, but it does not produce legal or similarly significant effects for you. We do not sell your personal information, and we do not use it for advertising or to track you across other companies' apps and websites.
Alerts and emails
Push alerts are sent only if you allow notifications on your device. You can turn them off in Profile or in your device settings.
If you turn on email alerts, we send deal alerts to your sign-in email address. Every alert email has an unsubscribe link, and you can turn email alerts off in Profile. If you unsubscribe or an email bounces, our email provider keeps your address on a list so that we do not email you again.
Farepop news and offers are separate from deal alerts. We only send them if you switch them on in Profile, and you can switch them off at any time.
Analytics
We use PostHog to understand how Farepop is used: which screens and features people use, where they get stuck, and whether alerts are useful. We do not send your name, email address, push token or payment details to PostHog.
In the UK, the EEA and Switzerland, analytics is off until you agree. Everywhere, you can switch it off with Share usage analytics in Profile.
With analytics on, we may record how the app is used on some sessions to find and fix problems. Recordings hide everything you type and the images on screen.
Who we share it with
We use service providers who process personal information for us, under contracts that require them to protect it and use it only to provide their service:
Supabase, which hosts our database and sign-in. Hetzner, which hosts the servers that find fares and send alerts. RevenueCat, which manages subscriptions. Superwall, which shows our subscription screens and receives your home airports and travel preferences to show the right one. PostHog, for product analytics. Expo, Apple and Google, which deliver push notifications. Postmark, which sends our emails. Cloudflare, which protects and delivers our website and forwards emails sent to us.
Apple and Google also process your sign-in and payments under their own privacy policies.
Destination photos load directly from Wikimedia Commons, whose servers receive your IP address and device details when a photo loads.
When you open a deal with a travel provider, you leave Farepop and their privacy policy applies.
We may also share information if the law requires it, to protect people's safety or our rights, or with a buyer if our business is sold. In that case we would tell you first.
Where your information is processed
We are based in Australia, and our providers process information in Australia, the United States and the European Union.
When personal information about people in the UK, the EEA or Switzerland is transferred to a country without an adequacy decision, we rely on the European Commission's Standard Contractual Clauses (with the UK Addendum and Swiss amendments) or, where a provider is certified, the EU-US Data Privacy Framework and its UK and Swiss extensions. Email us for a copy of the safeguards that apply.
How long we keep it
Your account, preferences, saved deals, feedback and alert history: until you delete your account. Deleting your account in the app removes them straight away. Copies may remain in encrypted backups for up to 30 days.
Analytics linked to your account: deleted when you delete your account. Otherwise, we keep analytics only as long as it helps us understand how Farepop is used.
App recordings, if a session is recorded: 30 days.
Purchase and subscription records: as long as tax, accounting and consumer law require, generally 7 years.
Support emails: as long as we need to resolve your request and keep a record of it.
Your rights
Everyone can see and change their preferences in Profile, turn alerts and analytics off, and delete their account in the app. You can also ask us for a copy of your information or to correct it.
In the UK, the EEA and Switzerland you also have the right to erasure, to restrict or object to how we use your information (including objecting to processing based on our legitimate interests and to marketing at any time), to data portability, and to withdraw consent at any time without affecting earlier processing.
If you live in a US state with a consumer privacy law, such as California, you can ask what personal information we hold about you and ask us to delete or correct it. We do not sell or share personal information for cross-context behavioural advertising, and we will not treat you differently for using your rights.
To make a request, email [email protected] from the address you use with Farepop. We reply within one month, may ask you to confirm your identity first, and do not charge for reasonable requests.
Children
Farepop is not for children under 16. We do not knowingly collect personal information from them. If you think a child has given us their information, email us and we will delete it.
Security
Information travels between the app and our services over encrypted connections. Your sign-in is stored in your device's secure keychain or keystore. Our database limits each account to its own records, and only people who need access to run Farepop have it. No system is perfectly secure, so please tell us straight away if you think your account has been misused.
Changes to this policy
We may update this policy as Farepop changes. If a change materially affects how we use your information, we will tell you in the app before it takes effect. The date at the top shows when it last changed.
Questions and complaints
Email [email protected]. We will acknowledge a complaint within two business days and aim to resolve it within 30 days.
If you are not satisfied, you can complain to a regulator: in Australia, the Office of the Australian Information Commissioner (oaic.gov.au); in the UK, the Information Commissioner's Office (ico.org.uk); in the EEA, the data protection authority where you live or work; in Switzerland, the Federal Data Protection and Information Commissioner (edoeb.admin.ch).