Ascent ("Ascent", the "App") is provided by Brightwood Apps LLC ("Brightwood Apps", "we", "us", "our"). Ascent watches airline award (points) availability for the trips you choose and alerts you when a business- or first-class saver seat opens that your points can cover. This policy explains what we collect, how we use it, and the choices you have. It applies to the Ascent website and supporting service.
Personal Information means information that identifies or can reasonably be linked to you. Service Providers are companies that process information on our behalf under contract.
If Apple sign-in is offered and you choose Sign in with Apple, we receive an Apple-provided user identifier and, if you choose to share them, your name and email address (which may be an Apple private-relay address). We never receive your Apple password.
For web email-and-password accounts, we store your display name, email address and a salted password hash, never the password itself. Sign-in, verification and password-reset codes are sent through Resend; their hashes and request timestamps are retained briefly for expiry, replay prevention and rate limits. When Google sign-in is enabled, we receive a verified Google identifier, email address and available profile name, never your Google password. Unverified email accounts are not automatically attached to another existing account.
For email seat alerts, we store your account email address, delivery preferences and delivery records to prevent duplicate messages and retry temporary failures. These emails contain the matching route, date, points price and a link to your booking plan. Each watched trip sends one alert and then stops. Creating a new active watch or choosing Continue watching re-enables seat emails; we do not override provider suppression for bounced or complained-about addresses. You can unsubscribe from any seat alert. Security and sign-in emails are separate from seat alerts.
The trips and routes you ask us to watch, your preferences (cabin, dates, stops, maximum points), and the loyalty programs and point balances you enter so we can tell you which award seats your points can cover. This is limited to program names and point totals you type in. We do not collect your credit-card numbers, and we do not ask for or store your airline or bank account passwords or credentials.
We process the technical information needed to serve requests and keep your account secure, including request timestamps and IP addresses used for routing and abuse prevention.
On the web, we use an essential HttpOnly session cookie to keep you signed in and browser storage to remember onboarding progress. If you enable browser notifications, we store the browser push subscription endpoint and encryption keys and send alerts through your browser's push provider. Sign-in rate limits use hashed request identifiers. You can disable notifications in browser settings or sign out to revoke the associated web subscription.
We use Mixpanel product analytics to understand which features are used and improve Ascent. We do not use this data for advertising or track you across other companies' apps or websites.
On the web, Mixpanel starts by default when a project is configured. Web events include screens, static control identifiers, quiz completion, and subscription status, associated with an anonymous identifier or your account ID after sign-in. Web analytics excludes email addresses, passwords, trip details, points balances, URL queries, and session recordings. IP-based location tracking is disabled. Previously saved analytics opt-outs, Do Not Track and Global Privacy Control are respected. Essential sign-in cookies and locally saved quiz/trip drafts work independently of analytics.
We do not sell your personal information.
Where the GDPR or UK GDPR applies, we process your information to perform our contract with you (providing the app), on the basis of our legitimate interests (securing and improving the service), and with your consent where required.
| Purpose | Provider | Region |
|---|---|---|
| Optional Apple sign-in, when enabled | Apple | USA |
| Application hosting & serverless backend | Vercel | USA |
| Optional Google sign-in and browser push delivery | Google; Apple or Mozilla depending on your browser | Provider-dependent |
| Email delivery when enabled | Resend | USA |
| Database (accounts, trips, balances) | Neon (PostgreSQL) | USA |
| Web checkout and subscription management (test mode) | Stripe | USA |
| Product analytics | Mixpanel | USA |
| Flight schedule & award-availability data | FlightAPI / seats.aero | USA |
We may disclose information if required by law or to protect the rights, safety, and security of our users or the public.
If Brightwood Apps is involved in a merger, acquisition, or asset sale, your information may be transferred; we will note any change of ownership here.
We keep your account information and trips for as long as your account is active. You can delete your account at any time from within the app (Settings), which removes your account, trips, and balances from our systems. Some records may be retained where necessary for security, legal obligations, or resolving disputes. Contact us with questions about deletion or retention.
Data is encrypted in transit (HTTPS/TLS). Access to production systems is restricted, and secrets are stored in managed, encrypted configuration. No method of transmission or storage is 100% secure, but we work to protect your information.
Depending on where you live, you may have rights to access, correct, delete, or export your personal information, and to object to or restrict certain processing. You can exercise the core of these rights directly in the app (edit or delete your data, delete your account) or by contacting us. Residents of California and certain other U.S. states have additional rights to know, delete, and opt out of "sale"/"sharing" (we do not sell or share for cross-context behavioral advertising).
We operate in the United States, and your information is processed there. Where required, we rely on appropriate safeguards for international transfers.
Ascent is not directed to children under 13 (or the equivalent minimum age in your country), and we do not knowingly collect their personal information.
Ascent does not track you across third-party apps or websites for advertising. The web app uses essential session cookies and local storage for its own functionality; it does not vary that functionality based on browser Do Not Track signals.
Web checkout uses Stripe. Web billing is currently restricted to test mode: no real payments are accepted. Stripe hosts the checkout and billing portal; Ascent stores Stripe customer/subscription identifiers and subscription status, not card details. Do not enter real payment details while test mode is displayed.
We may update this policy from time to time. Material changes will be reflected by updating the "Last updated" date above and, where appropriate, through an in-app notice.
Questions about this policy or your data? Contact us at admin@brightwoodapps.com or visit brightwoodapps.com.