Privacy

Last updated: 14 August 2026

Joivia is a flight comparison tool for groups. This page explains, plainly, what data we process, what for and who it's shared with. It's written from what the code actually does, not from a template.

Who's responsible

Joivia is a personal project run by an individual, not a company. Identification details are in the legal notice. For anything about privacy, including exercising your rights, write to hello@joivia.com.

What we don't process

Worth starting here, because it's what surprises people most: the names of the travellers you type into the search box never reach our server. They live only in your browser's address (URL), which we use so you can share or save the search. All we ask the server for is prices for routes, in the form "origin airport, destination airport, date".

We also don't ask for sign-up, an email address, or payment details: we don't sell tickets, so we never touch a card.

What we process, and what for

1. Route searches

We store which routes get searched (e.g. "Alicante to Rome") and a count, along with the date. This is used to know which routes to keep fresh in the price cache overnight. It's aggregated information about routes, not a history tied to you: we don't associate it with your IP, a user identifier, or a session.

2. Your IP address, to prevent abuse

When your browser asks us for prices, we use your IP to limit the number of requests per minute so no one can bring the service down. That IP lives only in the server's memory for a few seconds and is then discarded on its own: it's not stored in the database or in any log file.

3. Detecting your nearest airport

When you open the homepage, your browser queries the external service ipapi.co to work out roughly where you're connecting from and suggest your nearest airport already filled in, plus popular getaways from there. In that request, ipapi.co receives your IP address, because the request leaves directly from your browser. We only get back approximate coordinates, which we use in your own browser and don't store. If you block that request or it fails, the site still works fine: it just won't fill in the airport for you.

4. Usage statistics (only if you accept them)

We use Google Analytics 4 to see which pages get visited and what works, and it only activates if you press "Accept" on the cookie notice. If you reject it or don't touch it, it doesn't load, its cookies aren't installed, and nothing is sent to Google. Once you accept, Google processes your IP in truncated form (it doesn't get the full IP), installs the cookies described in the cookie policy and logs pages viewed, referrer, language, device type and browser. You can change your mind any time: see how in the cookie policy.

5. Advertising (only if you accept it)

Some pages carry Google AdSense ads, which fund the project alongside affiliate commissions. No ad is requested if you don't accept: if you reject it or don't touch it, no advertising is requested, its cookies aren't installed, and you're not shown any ad.

One honest caveat: the cookie notice is run by Google's own consent system, and to show it to you the page loads one of Google's files first. That means Google sees your IP address even if you end up saying no, the same way the other external services listed below do. It's the only way to give you a choice through a certified system, and at that point no advertising cookie is installed.

Once you accept, Google (Google Ireland Limited, the controller for advertising) receives your IP, installs the cookies described in the cookie policy and may use your browsing history to decide which ad to show you and to measure whether it works. We don't send it any of your data and don't get anything individual back: only the total that the site generates. You can review and turn off personalisation in Google's ad settings, and change your mind here whenever you want (see the cookie policy).

6. Server technical logs

The server writes down, in a rotating log file, the technical decisions behind each search (which price provider was asked and with what result), so we can diagnose failures. Those lines contain routes and dates, not IP addresses or personal data.

Other third parties that receive your IP when the site loads

Because of how the internet works, any resource your browser downloads from another domain means that domain sees your IP. On Joivia those are:

Google Fonts (fonts.googleapis.com, fonts.gstatic.com), for the typeface. Wikimedia Commons (upload.wikimedia.org), for the city photos. Unsplash (images.unsplash.com), for the homepage photo. Travelpayouts (pics.avs.io), for the airline logos. ipapi.co, explained above.

Of all of them, only Wikimedia installs a cookie (WMF-Uniq), when serving the image. It's theirs, we neither set it nor read it, and it gives us no information: it's detailed in the cookie policy. Google AdSense's domains are separate, because those don't load until you accept: they're explained in point 5.

When you click "Book"

That button takes you to the provider's site that sells the ticket: Kiwi.com, Aviasales or Ryanair, depending on the flight. From that moment you're on their site and their own privacy policy applies, not ours. The link carries an affiliate identifier that lets the provider know you came from Joivia, so we get credited the commission (see the legal notice). We don't send them any of your data: only the route and dates you'd already searched.

Legal basis

For Google Analytics statistics and Google AdSense advertising, your consent, which you can withdraw whenever you want. For everything else (limiting requests by IP, storing which routes get searched, technical logs and detecting your nearby airport), our legitimate interest in keeping the service running, fast and useful, while processing the minimum data possible in every case.

How long we keep things

The request-limiter IP, seconds. Technical logs, until rotation overwrites them (five one-megabyte files). Searched-route data, for as long as it stays useful for deciding which prices to refresh. Analytics and advertising cookies, as stated in the cookie policy.

Your rights

You have the right to access your data, rectify it, erase it, restrict or object to its processing, and to portability, by writing to hello@joivia.com. Bear in mind that, given how the service is built, we don't store anything that identifies you, so in practice we likely have no data of yours to locate. Because Joivia is established in Spain, its lead supervisory authority is the Spanish Data Protection Agency (aepd.es), where you can complain if you think we haven't handled your request properly. If you're based in another EU country, GDPR lets you complain to your own national authority instead — see the EDPB's list of national data protection authorities.

Changes to this policy

If we change what data we process, we'll update this page and the date at the top. Joivia is in beta and under active development, so that's likely to happen.

This policy is published in Spanish and English. If the two versions ever disagree, the Spanish version is the one that prevails legally.