Legal
Privacy Policy
Last updated: September 2026
Layover is a free, solo-built tool. This page states plainly what it collects, what it doesn't, and why — no legal boilerplate that doesn't match what the code actually does.
What we collect
- Email and first name — collected once at the sign-in gate, used to greet you across visits and to save any plan you choose to share. Verified with Cloudflare Turnstile to keep bots out (see below).
- A basic visit counter — your email and a timestamp are logged once per session, purely to see the tool gets used. No pages, clicks, or searches are logged.
- Your trip details, only if you create a share link — nationality, dates, terminal, chosen spots, route and weather data get saved so the link can reopen your plan offline. This snapshot is stored against your email internally, but your email is never returned to anyone who opens the link — only the trip data is.
What we never collect
- No cookies of any kind.
- No third-party analytics or ad-tracking scripts — nothing like Google Analytics or ad pixels runs on this site.
- No passport numbers, phone numbers, physical addresses, or dates of birth.
- No IP address is ever stored. Your IP is passed through once, transiently, to Cloudflare's bot-check API (see below) and never logged or saved.
- Your passport nationality is looked up against visa rules entirely in your browser — it never touches our server unless you actively create a share link.
Third parties we use
A handful of services help the tool work. Each only receives what it needs to do its job:
- Cloudflare Turnstile — verifies you're not a bot at sign-in. Sees your IP address for that one check; we never store it.
- Google Maps Routes API — calculates live travel times between DXB and Dubai spots. Only receives map coordinates, never your identity.
- OpenWeatherMap — fetches current Dubai weather. Sends fixed DXB coordinates, identical for every visitor.
- Supabase — hosts the database that stores gate sign-ins, the visit counter, and shared-plan snapshots described above.
- Google Fonts — loads the site's typefaces, a standard web-font request.
Data retention & deletion
Sign-in records and saved plans currently have no automatic expiry — there's no self-serve "delete my data" button yet. If you'd like your email, name, or a saved plan removed, reach out via the About the Creator / Contact page and it'll be deleted manually.
Changes to this policy
If what the tool collects changes, this page will be updated to match — this is a living document tied to the actual code, not a static disclaimer.