Privacy policy

Last updated: October 9, 2026

Leleka helps you find weekend flights. We collect as little as we can: you can use the whole search without an account, and we never sell your data. This page says what we keep, why, for how long, and who else sees it.

Who is responsible

Leleka is run by Wołodymyr Iszczenko, a private person in Poland, who is the controller of your personal data under the GDPR. Write to privacy@flyleleka.com about anything on this page.

What we collect and why

If you just search

You do not need an account. We do not use ad trackers or third-party scripts, and the page loads no fonts, maps or images from other companies.

• Your IP address is looked up in a database on our own server to guess your country and city, so the site opens in your language and currency and suggests a departure city. The address and the result are not stored.
• Your IP address is also kept for up to one hour to limit how often a single address can call the site, so that robots cannot overload it.
• How you use the site — searches, views, clicks through to sellers — is recorded so we can improve it. The data stays with us and is not passed to anyone. We keep it for 13 months.
• Server logs record errors and timings for 7 days. They do not record who you are.

We do this on the basis of our legitimate interest in keeping the site running, safe from abuse and easy to use (GDPR Art. 6(1)(f)).

Saved trips without an account

Trips you save, your recent departure cities, your currency and your theme stay in your browser (local storage). They never reach our server until you sign in, and you can remove them by clearing your browser's site data.

Account

You can sign in with a code we email you, or with Google. An email address is the only thing you must give us, and only if you want an account: everything else on the site works without one. We store:

• your email address;
• your Google account ID, if you sign in with Google. We do not keep your name or photo;
• your language and currency choices;
• whether you want price alerts by email or push;
• your saved trips and the prices we saw for them.

We use this to run your account and to tell you when a saved trip gets cheaper. The legal basis is performing the service you asked for (GDPR Art. 6(1)(b)).

Price alerts

• By email: once a day we check your saved trips and write to you if one got cheaper. Every alert has a one-click unsubscribe link. Emails contain no tracking images.
• By push: if you allow notifications, your browser gives us an address and keys for its push service. We store them to send you alerts, and delete them when you turn notifications off or delete your account. The alert passes through your browser maker's push service (Google, Mozilla, Apple or Microsoft).

AI search

When you describe a trip in words, we send the text, your language and your departure city to an AI service provider in the US, whose model reads it. We do not send your name, email or IP address. Please do not type personal details into this box. Reading your request is part of the service you asked for (GDPR Art. 6(1)(b)).

We keep the text, how the model read it, and a one-way hash of your IP address (to enforce the daily limit) for 90 days, to improve the search. If you are signed in, the record is linked to your account. Deleting your account removes that link. Keeping these records rests on our legitimate interest in a search that works well and is not abused (GDPR Art. 6(1)(f)).

Shared trips

When you share a trip, we create a short public link. Anyone with the link can see the trip: route, dates, nights and price. A share holds no personal data. A cookie in your browser marks you as the person who shared it, so the same trip gets the same link. This is part of the service you asked for (GDPR Art. 6(1)(b)).

Cookies and local storage

We only use cookies the site needs to work, so we do not ask for consent. They do three things:

• keep you signed in and protect forms against forged requests. The ones for a visit end after 2 hours of inactivity; the one that remembers you between visits lasts 400 days, or until you sign out;
• remember the language you picked, for 1 year;
• recognise the trips you shared, for 400 days.

In local storage we keep your guest saved trips, recent departure cities, currency, theme and push settings on this device.

Who else sees your data

We use these kinds of services to run Leleka. Each one only gets what it needs for its job. If you want to know the exact companies, write to us and we will tell you.

When you click through to book, you leave Leleka for the airline or booking site. Their own privacy policy applies there. Our links carry no tracking or affiliate codes.

We disclose data to authorities only when the law requires it.

How long we keep it

• Account data: until you delete your account.
• AI search records: 90 days.
• How you use the site: 13 months.
• Server logs: 7 days.
• Backups: about 15 days after the data is deleted.
• Shared trip links: until we remove them; they hold no personal data.

Your rights

Under the GDPR you can ask us to:

• show you the data we hold about you, and give you a copy;
• correct it;
• delete it. You can delete your account yourself in the account menu, which removes your email, saved trips and push subscriptions at once;
• restrict or object to how we use it.

Write to privacy@flyleleka.com and we will answer within a month. You can also complain to the Polish data protection authority (Prezes Urzędu Ochrony Danych Osobowych, uodo.gov.pl) or to the authority in your own country.

Security

All traffic is encrypted (HTTPS). Sign-in codes are stored encrypted, session cookies are HTTP-only, and IP addresses in the AI search records are stored only as a hash.

Children

Leleka is not meant for children under 16, and we do not knowingly collect their data.

Changes

If we change this policy, we update the date at the top. If a change matters to account holders, we will email them first.

Parts of this policy are adapted from the Basecamp open-source policies, licensed under CC BY 4.0.