Privacy Policy

Last updated: 2026-10-21

Overview

Mile Buy Club ("MBC," "we," "us") is a travel-discovery product at https://milebuyclub.com. We help you find trip ideas matched to your preferences — destinations, dates, budget, travelers, and interests — and show estimated flight and hotel costs so you can decide what to book elsewhere. This Privacy Policy explains what information we collect, how we use it, how we store and share it, and the choices you have. It applies to milebuyclub.com and the related product surfaces we operate. Mile Buy Club is operated from the United States.

This Privacy Policy describes how Mile Buy Club accesses, uses, stores, and shares personal data, including Google user data obtained when you use Sign in with Google. You can create an account with email and password instead of Google.

Information we collect

Depending on how you use Mile Buy Club, we may collect:

Account and contact data — your email address and, if you provide it, a name. This comes from email-and-password signup or from Sign in with Google (see Google Sign-In and Google user data below).
Travel preferences — details you provide so we can personalize recommendations, such as party size, budget, interests, travel dates, passport or home country, and home airport.
Product activity — how you use the Service (for example saved trips, onboarding progress, groups you join, messages and votes in a trip group, price alerts you set, feedback, and similar in-product events).
Guest-session data — a short-lived cookie that lets you use parts of the Service before you create an account.

Technical data — standard log and device information such as IP address, browser type, approximate location derived from IP, and cookies or similar identifiers needed for sign-in, security, and basic analytics.

We do not require Sign in with Google. You can create an account with email and password instead.

How we access Google user data

We offer Sign in with Google as an optional way to create or access a Mile Buy Club account. When you choose that button, we access Google user data through Google's `openid`, `email`, and `profile` scopes. With your consent, Google shares:

your Google account email address
your Google account name
your Google account profile photo, if one is set
a Google account identifier used to recognize the same Google account on later sign-ins

We do not request access to your Gmail, Google Drive, Calendar, Contacts, or any other Google product data.

How we use Google user data

We use Google user data only to provide the sign-in feature that is visible in the product:

create your Mile Buy Club account, or sign you into an existing account with the same email
display your name and photo in the product
send transactional email to the address Google provided (for example a welcome message)
keep the account secure (for example recording that the email was verified via Google)

We do not use Google user data to show ads, to sell data, to train public AI models, or to contact you for unrelated marketing.

How we store Google user data

Google user data is stored with the rest of your account in our hosted database (see Service providers). We keep it for as long as the account is active, then delete or de-identify it when you close the account, subject to the Retention section.

We do not sell Google user data. We do not share your Google name, email, photo, or account identifier with advertising networks, data brokers, or the flight/hotel data providers that power trip-price lookups. Those providers receive only the search parameters needed to fetch prices (for example airports and dates), not your Google identity. Infrastructure processors listed below (hosting, email delivery, error monitoring) may process account fields as needed to run the Service.

Mile Buy Club's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

You can use email-and-password signup instead of Google. You can disconnect Mile Buy Club from your Google Account (Google Account → Security → Third-party access) and still ask us to delete your Mile Buy Club data as described in Your rights and choices.

How we use information

We use the information above to:

Create and maintain your account, guest session, or waitlist signup
Generate AI-written trip recommendations ("decks") and related itinerary content matched to your preferences
Power the Miles chat assistant and group trip-planning features
Look up flight and hotel price information from third-party sources so we can show approximate trip costs
Send transactional email (such as account or waitlist confirmation) and, if you opt in, FareWatch price alerts and other product updates you request

Secure the product, prevent abuse, debug issues, and understand product usage
Respond to support requests and communicate with you about the Service

AI processing of your preferences

To generate recommendations and chat responses, we send your travel preferences and prompts to third-party large-language-model (AI) providers. Recommendation and chat outputs are generated fresh for you and are not shared across other users. We do not send your Google account photo to those providers as a matter of course. We do not use your data to make automated decisions that produce legal or similarly significant effects about you.

Memory

When Miles memory is turned on, Miles can keep short notes about how you like to travel, so it does not have to ask again. A note is one plain sentence, such as "Avoids red-eye flights" or "Travels with a toddler". Miles writes a note only from something you said to it in chat, or from a change you made to one of your trips, and each note stores the exact words it came from and the date. Notes never contain prices, budgets, dates or other numbers. Once a night we tidy your notes: duplicates are merged and an older note is dropped when a newer one says the opposite. Miles and your trip suggestions use the notes as hints, so the note text is sent, along with your other preferences, to the AI providers listed below. Notes are never shared with other members.

You can see every note, with the words it came from, under Settings → Memory. You can forget one note or all of them there at any time; a forgotten note is no longer used by Miles or by your trip suggestions from that moment on. Deleting your account deletes your notes.

Using Mile Buy Club in ChatGPT or Claude

You can connect your Mile Buy Club account to ChatGPT (made by OpenAI) or Claude (made by Anthropic). You start this from inside ChatGPT or Claude, then sign in to Mile Buy Club and approve the connection on our consent screen.

What the connected app can see. Your travel profile (home airport, passport countries, budget level, interests), your points balances, cards and elite statuses, your trip deck and saved trips, and your fare watches. It can also ask us to look up flights, hotels, award seats we have already seen, weather and visa rules for you.

What it can change. Only when you ask in the chat: save or unsave a trip, start or stop a fare watch, and add or remove a card or update a points balance. For wallet changes you see a preview first and nothing is saved until you say yes. It cannot book or pay for anything, and it never sees your password.

What ChatGPT or Claude receives. When the app uses one of our tools, the result (for example your wallet balances or a list of flight prices) is sent to OpenAI or Anthropic so the assistant can answer you. From that point it is handled under their privacy policy and your settings with them, not ours. We do not control how long they keep chat history.

Tokens. When you approve, we give the app access tokens. Tokens do not contain your password. We store only a scrambled (hashed) copy of each token, never the token itself. An access token lasts one hour; the app can renew it for up to 30 days of inactivity and at most 90 days in total before you have to approve again.

Disconnecting. Go to Settings → Connected apps and click Revoke. The app loses access right away; its next request is refused and you would have to approve it again. Removing the app inside ChatGPT or Claude stops that assistant from using it, but to be sure our side is cut off too, use Revoke on our Settings page.

What we keep. We keep a record that you connected the app (app name, when you connected, when it last used your account, and when you revoked it) for as long as your account exists. Expired tokens are deleted about a week after they expire. Short-lived working data (a fare you searched, so you can compare it with points: 30 minutes; a wallet change waiting for your yes: 10 minutes; a trip plan: 2 hours) is deleted automatically. Our server logs record which tool was used, by which account, and whether it worked; they do not record what you typed in the chat. Deleting your Mile Buy Club account deletes all connection records and tokens.

Service providers (subprocessors)

We use other companies to help run Mile Buy Club. They process data only as needed to provide their services to us. Categories of subprocessors include:

Sign-in (Google) — when you choose Sign in with Google, Google authenticates you and provides the Google user data described above.
AI / large-language-model providers — currently OpenAI, with Anthropic available as a fallback — to generate recommendation copy, destination content, and Miles chat responses from the preferences and prompts we send them.
Web-data providers (such as Decodo, Bright Data, and Spider) — to retrieve third-party flight and hotel price information used in estimates. These providers receive the search parameters needed to fetch prices, not your account identity or Google user data.
Email provider (Resend) — for transactional email, price alerts, and digests.

Hosting and infrastructure (Google Cloud) — for hosting and related infrastructure.
Error monitoring (Sentry) — to capture crash and error diagnostics, which may include limited technical data such as IP address, so we can keep the Service reliable.

Connected AI assistants (OpenAI ChatGPT, Anthropic Claude) — only if you connect one. They are not our subprocessors; they receive tool results because you asked them to, under their own terms.

We do not sell your personal information.

Cookies and analytics

We use cookies and similar technologies that are necessary for authentication, security, guest sessions, and basic site operation. We may also use limited analytics to understand aggregate usage (for example, which pages load and whether core flows complete). You can control cookies through your browser settings; blocking required cookies may prevent sign-in or other features from working.

Retention

We keep account, preference, and activity data for as long as your account is active or as needed to provide the Service. Waitlist emails are kept until you ask us to remove them or we close that cohort. Support correspondence is kept as long as reasonably needed to resolve your request. Logs and technical data are typically retained for a shorter operational window unless we need them longer for security or legal reasons. When you request deletion, we delete or de-identify the personal data we control, except where we must retain limited records (for example, for fraud prevention or legal obligations).

Your rights and choices

Subject to applicable law and reasonable verification, you can ask us to:

Access the personal information we hold about you
Correct inaccurate information
Delete your account and associated personal data, including Google user data we stored from Sign in with Google
Export a copy of your data in a commonly used format where feasible

To make a request, email support@milebuyclub.com from the address associated with your account (or waitlist signup) and tell us what you need. For deletion requests, include "Delete my data" in the subject line. We may ask you to verify ownership of the email before acting.

You can unsubscribe from non-essential email using the link in any such message. We may still send transactional messages required to operate your account.

Children

Mile Buy Club is not directed to children under 16, and we do not knowingly collect personal information from anyone under 16. If you believe a child has provided us information, contact us at support@milebuyclub.com and we will take appropriate steps to delete it.

Security

We use reasonable administrative, technical, and organizational measures designed to protect personal information (for example, encrypted transport, access controls, and hosted infrastructure). No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will change the "Last updated" date at the top of this page. Material changes may also be communicated by email or an in-product notice when appropriate. Continued use of Mile Buy Club after an update means you acknowledge the revised policy.

Contact

Questions about privacy or this policy: support@milebuyclub.com.

Related: our Terms of Service.