Privacy Policy
Last updated: 2026-04-23. Operator: Space Available Travel LLC (“we”, “us”, “Space-A+”).
1. What this policy covers
Space-A+ (spaceaplus.com) is an independent flight-tracking and terminal sign-up service for U.S. military Space Available travel. This policy explains what personal information we collect, how we use it, who we share it with, and your rights regarding that information. It applies to the website, mobile apps, and any emails we send on your behalf.
2. Information we collect
Account data. When you register an account we collect your email address, a hashed password, and any display name you provide.
Sign-up profile data. If you use the terminal sign-up feature, you may add: full legal name (prefix, first, middle initial, last, suffix), rank or grade, branch of service, Space-A travel status category, DoD ID number (optional), phone number, notification email, notification cell number, and a list of dependent names and passport types. These fields are stored encrypted at rest using Fernet (AES-128-CBC + HMAC-SHA-256) so that a database dump alone cannot read them.
Travel preferences. Saved routes, favorite terminals, favorite destinations, alert configurations, Active Duty flag, border-clearance status, and default destination choices. Non-PII but associated with your account.
Sign-up history. Every email we send to a passenger terminal on your behalf is logged, including the recipient terminal, timestamp, travel window, destinations, and the rendered email subject + body (so you have a receipt).
Mobile push tokens. If you install the mobile app and allow notifications, we store your APNS (iOS) or FCM (Android) device token so we can deliver push alerts.
Usage analytics. Vercel Analytics records pageviews and Web Vitals (performance) with no cookies and no personally-identifiable tracking.
Error telemetry. If a server error or client-side exception occurs, we send the stack trace, surrounding request metadata, and a randomised session ID to Sentry for debugging. We configure Sentry to exclude request bodies and PII headers by default.
Cookies. We set one essential cookie: spacea_token, an HTTP-only JWT used to keep you signed in. We do not use advertising or tracking cookies.
3. How we use your information
- To provide the service — show flights, fire alerts, run boarding-odds calculations.
- To send sign-up requests on your behalf.When you click “Register at N terminals” we compose an email using your saved profile and deliver it to each terminal's public sign-up email address (via Twilio SendGrid). You are CC'd on every outbound so you have a personal copy. You authorize this action each time you click the send button.
- To maintain security and integrity — rate limiting, abuse prevention, 60-day sign-up cooldown.
- To contact you — alert emails, expiration reminders (~55 days after a sign-up), account-related notifications. We do not send marketing email without explicit opt-in.
4. Third parties we share data with
We share the minimum necessary data with the following sub-processors, each bound by their own privacy policies:
- Railway — hosts our API and database.
- Vercel — hosts the web frontend and serves Analytics.
- Cloudflare — DNS + CDN + TLS for spaceaplus.com.
- Twilio SendGrid — delivers transactional and sign-up emails.
- Stripe — processes payments for paid tiers if you subscribe. We never see or store card numbers.
- Google Firebase — delivers push notifications to Android devices.
- Apple Push Notification Service — delivers push notifications to iOS devices.
- Cloudflare R2 — stores archived source PDFs of terminal flight schedules. No user PII is stored here.
- Sentry — captures server / client error traces with PII sending disabled.
- Military Passenger Terminals — when you use the sign-up feature, the email we send contains the profile fields you have chosen to include. You trigger this delivery; we do not send sign-ups without your action.
We do not sell your information, and we do not share it with third parties for advertising.
5. Retention
We keep account and profile data for as long as your account is active. Sign-up history rows are retained until you delete them or your account is closed. Push tokens are removed automatically when the vendor reports them invalid. Flight data scraped from public terminal PDFs is not personal to you; it is retained indefinitely.
When you delete your account, we remove your profile PII, dependents, favorites, saved routes, alert configurations, push tokens, and sign-up history within 30 days. Anonymised aggregate statistics used for boarding-odds modeling may be retained.
6. Your rights
You can view your profile at any time on the Dashboard. You can delete your profile, dependents, favorites, and individual history rows from within the app. To request a full export of your data or to close your account, email support@spaceaplus.com. We respond within 30 days.
If you are a resident of California, the EU/EEA, the UK, or another jurisdiction with specific data-protection rights, you may also have the right to correct, restrict processing, object to processing, or lodge a complaint with your local data protection authority. Contact us at the same address and we will honor these requests.
7. Security
All traffic between your browser/app and our servers is encrypted in transit via TLS 1.2+. Profile PII is additionally encrypted at rest. Passwords are stored as bcrypt hashes and never transmitted back. We do not have access to your plaintext password; we cannot retrieve it if lost — we can only reset it.
No system is perfectly secure. If we become aware of a breach affecting your data, we will notify affected users as required by applicable law and as soon as practicable.
8. Children
Space-A+ is not directed at children under 13 and we do not knowingly collect personal information from them. Dependent names entered in your profile are provided by you on behalf of minors you are legally responsible for.
9. International transfers
Our infrastructure is primarily in the United States. If you access the service from outside the U.S., your information will be transferred to and processed in the U.S.
10. Changes to this policy
We may update this policy from time to time. Material changes will be posted here with a new “Last updated” date and, where appropriate, announced via email. Continued use of the service after changes take effect constitutes acceptance of the revised policy.
11. Contact
Space Available Travel LLC
Email: support@spaceaplus.com