Security & privacy

Plain-language answers about how Farelin protects your account and data. No legal maze — if something here is unclear, that's a bug too.

Your account

Passwords are hashed with Argon2id. Accounts created before that use PBKDF2 and are upgraded automatically the next time you log in — no reset, nothing to do.
Sessions use httpOnly cookies, so scripts in the browser cannot read your login token.
Refresh tokens are stored only as hashes, rotate on every use, and are revoked server-side when you log out.
State-changing requests carry a CSRF token, so another site cannot act as you using your cookies.
Password resets and email confirmations use single-use links that expire. Both are stored only as hashes, so a database copy does not yield working links.
Confirming your email address is what lets Farelin send fare alerts to it. Until then, a watch on that address asks the address itself to confirm.

Your travel profile — airports, budget, preferences — personalizes Farelin's search, ranking and watch behavior.
Farelin stores observed flight prices, not your browsing history.
Alert emails include one-click manage and unsubscribe links; those tokens are stored only as hashes.
Resend delivery webhooks are signature-verified before processing. Permanent bounces and complaints create pseudonymous suppression records so Farelin does not keep sending unwanted or undeliverable mail.
Farelin does not sell your data, and loads no advertising or affiliate-tracking scripts. Affiliate attribution is carried in the outbound booking link itself.
Logs are redacted before they are written: credentials, tokens and anything credential-shaped are stripped, including inside stack traces.

The AI never sees your password or payment details. It receives your request and a compact summary of the preferences needed to search.
The AI cannot invent prices or book anything. It can only call a small, fixed set of internal search tools.
Every fare comes from a deterministic backend search, never from the model, and is labeled with how it was obtained and when it was observed.
AI usage is capped per account and in total per day, so a runaway loop cannot spend without limit.

When paid plans are enabled, subscriptions are processed by Stripe. Card numbers never touch Farelin's servers.
Farelin never charges you for flights — it does not sell or book them.

Public inputs are schema-validated, and cost-sensitive routes such as searches, AI calls, authentication and contact delivery have dedicated rate-limit categories.
When Redis is configured, rate limits are shared across API instances. If it becomes unreachable, Farelin falls back to per-process limits rather than failing open; production can be configured to require the shared store.
Provider API keys live only in backend environment variables, never in the browser.
Production refuses to start with genuinely unsafe configuration — a development secret, insecure cookies, or a non-HTTPS URL.
Errors return structured responses without stack traces in production.
Pull requests and pushes to the main branch run automated tests and dependency checks. CI also scans repository history for committed secrets; GitHub repository protections still require separate administrator configuration.

Found a security issue? Choose “Security report” on the contact form. Responsible disclosure is always welcome.