Privacy Policy
Effective date: May 4, 2026. Piqpath ("we", "us") operates a generative-UI travel-search assistant available on the web at https://piqpath.com and as the "Piqpath" Android app. This page explains what we collect, how we use it, and the choices you have. It is the canonical privacy policy referenced by the Android app's Play Store listing and the Cuelinks / Travelpayouts / Awin / Admitad / Agoda channel-verification reviews.
1. Account data we collect If you sign in (optional — chat works anonymously), we store your email address and display name. Authentication runs through standard JWT sessions; passwords are hashed with bcrypt and never stored in plaintext. We do not store passwords for users who sign in with Google.
2. Chat content We store the messages you send and the assistant's replies (including the structured travel cards rendered in the conversation) so the chat survives reload and so collaborative share-links work. Chat content is keyed to your session ID (or your account, when signed in) and is never used to train any model.
3. Location Approximate location: we read your public IP at request time to choose your default currency and surface region-relevant deals. This is per-request only — we do not maintain a location history. Precise location: when (and only when) you tap the Location button in the composer, the app reads your device GPS once to recommend flights / stays / things-to-do near you. Coordinates are sent to our reverse-geocoder to resolve the nearest IATA airport and are not retained beyond that single request. We never enable continuous tracking.
4. Affiliate redirects When you click a "Book Now" button, we redirect you to one of our affiliate partners — Travelpayouts (incl. Aviasales, Hotellook), Awin, Cuelinks (incl. GoIndigo for IndiGo flights), Viator, Klook, Singapore Airlines, or Agoda. Each partner has its own privacy policy that governs your visit to their site. We log the click (item ID, partner, rough geo, timestamp) for analytics and commission reconciliation.
5. Third-party AI services The assistant is powered by third-party large-language-model providers reached via the Emergent Universal AI Key. Your message and short context window are sent to those providers solely to generate a reply. We do not send your account email, address, or precise location to AI providers.
6. Cookies & local storage We use browser localStorage for your session ID, language preference, currency selection, and conversation-mode toggle. We do not use third-party advertising cookies. Affiliate partners may set cookies on their own domains after you click through to them.
7. Data retention Chat sessions are retained until you delete them or close your account. Deleting your account removes your messages, share-tokens, and collaborator memberships. Affiliate-click logs are aggregated to roughly geographic level after 90 days.
8. Sharing & disclosure We do not sell or rent personal data to anyone. We disclose data only to the affiliate partners listed above (when you click their links), to our infrastructure providers under contract, or where compelled by law.
9. Children Piqpath is not directed at children under 13 (or under 16 in the EEA / UK). If we learn we have collected personal data from a child, we delete it.
10. Your rights You can request a copy of, correction of, or deletion of your personal data at any time. The fastest path is the in-app **Delete account** button (avatar menu → Delete account) or the public deletion page at https://piqpath.com/delete-account — both call our DELETE /api/me endpoint and remove your account, chat sessions, share links, and collaborator memberships immediately. You may also email dilipr31@gmail.com for a manual request; we respond within 30 days. EEA / UK / California residents have additional rights under GDPR / CCPA which we honour on request.
11. Security Data in transit uses TLS 1.2+. Service-account credentials and AI keys are kept in environment variables and dedicated secret stores, never in source control.
12. Changes If we materially change this policy we'll update the effective date above and surface a notice in the app and on this page. Continued use after a change indicates acceptance.
13. Contact Questions, requests, or partner-verification: dilipr31@gmail.com. Postal: Piqpath, c/o the address registered with our payment processor (available on request).