Privacy Policy | My Bag Claim

1. Information We Collect

We collect information you provide when creating an account, using our services, or contacting us:

Account information: Email address and password (managed by Supabase Auth).
Claim details: Flight information, airline, bag descriptions, and claimed items you enter into the claim wizard.
Preparation drafts: Before saving, your entries stay in the current browser tab. When you choose to sign in or create an account from a preparation, a temporary copy is kept in this browser so you can finish email confirmation in another tab. This copy is accepted for up to 24 hours and removed after your draft is successfully saved to your account. Expired copies are removed when accessed. Use the same browser on your own device; do not use a shared device. Your draft is saved after sign-in, without purchasing a package or sending anything to an airline.
Payment information: Processed by Stripe. We do not store credit card numbers. We receive your Stripe customer ID and payment status.
Usage data: Pages visited, features used, and interaction patterns (collected via PostHog analytics).
Preparation entry context: When our browser analytics checks allow it, we may record which of a small set of our own guides you used to start a preparation. This is a fixed guide label, not a full browsing history, search term or claim detail. It can be kept with your browser draft, then linked to your saved preparation and purchase in our database. It is not anonymous at that stage. Our private Growth Dashboard uses aggregate counts to understand which guides lead to purchases; we do not send this label to Stripe or PostHog.

2. How We Use Your Information

To provide deadline information and prepare baggage-claim statements, itemized amounts and evidence checklists from the information you enter.
Bag Claim Preparation does not send your package to an airline. You choose what to submit. Previously purchased filing plans may still require airline submission on your behalf under their existing service terms.
To send transactional emails (claim confirmations, deadline reminders) via Resend.
To process payments and verify purchase status.
To improve our service using usage data and aggregate reporting, including purchases by recorded preparation entry guide.
Optional package feedback: If you submit a usefulness answer, we save your choice and its time with your preparation purchase. You can update your answer. We use aggregate responses to improve the package. We do not send your answer to Stripe or PostHog. Feedback does not submit an airline claim or create a support or refund request; contact support for those requests.

3. Third-Party Services

We use the following third-party services to operate My Bag Claim:

Supabase: Database and authentication. Your account data and claim details are stored in Supabase's secure PostgreSQL database.
Stripe: Payment processing. Stripe handles all payment data under their own privacy policy.
Google Gemini: If you choose photo autofill, your selected boarding-pass, bag-tag or airline baggage-report image is sent to Gemini to extract travel details. Images may include passenger names, booking references and baggage-report numbers. We disclose this before upload. My Bag Claim does not save the scan image or automatically attach it to an airline claim. In Bag Claim Preparation, only the extracted details you accept are added to your draft. You can enter details manually instead. Photo extraction does not verify documents or claim eligibility.
Resend: Transactional email delivery. Used to send transactional notifications and, for legacy filing plans only, claim submissions.
PostHog: Product analytics. Collects usage data, which may be linked to your account identifier, to help us improve the product. Our browser analytics checks respect Do Not Track, Global Privacy Control and the analytics SDK's opt-out state. These controls do not stop essential account, preparation or payment processing.
Vercel: Hosting and deployment.

4. Data Security

All site traffic is transmitted over HTTPS. Claim and document records use account ownership checks and database Row Level Security. Authenticated claim uploads are stored in a private document bucket and returned through an owner-authorized application route rather than a permanent public storage URL. No online service can guarantee that a breach will never occur.

See our plain-language security explanation for current controls and boundaries.

5. Data Retention

Your claim data is retained as long as your account is active. You can delete your account and all associated data by contacting us at support@mybagclaim.com.

Preparation entry labels follow the saved preparation and order records. If we observe a tracking refusal while you use a preparation, we suppress that preparation's entry label and its linked order label. A short-lived, per-preparation browser marker prevents another tab from restoring it. This is not an account-wide or cross-device privacy setting, and cannot take effect on a server record until the browser can contact our service. Previously collected aggregate snapshots and third-party analytics history are not retroactively erased by this control. Contact us for broader privacy requests.

6. Your Rights

You have the right to:

Access the personal data we hold about you.
Request correction of inaccurate data.
Request deletion of your data.
Object to processing of your data.
Export your data in a portable format.

To exercise any of these rights, email us at support@mybagclaim.com.

7. Cookies

We use essential cookies for authentication (Supabase session) and analytics cookies (PostHog). We do not use advertising cookies. Temporary preparation drafts, authentication handoffs and the per-preparation suppression marker also use browser storage.

8. Changes to This Policy

We may update this privacy policy from time to time. We will notify you of significant changes by posting a notice on our website.

9. Contact

For questions about this privacy policy, contact us at support@mybagclaim.com.