Skip to main content
DelayPilot
Theme

DelayPilot

Theme

Privacy

DelayPilot has no account and no advertising. It measures aggregate traffic with Google Analytics 4, which sets Google cookies, and with Cloudflare Web Analytics, which sets none. The only value DelayPilot itself stores in your browser is the light-or-dark theme you picked, and it never leaves your device.

Reviewed

Reading this site sends DelayPilot the request your browser has to make to fetch the page, and sends an aggregate page-view measurement to Google Analytics 4 and Cloudflare Web Analytics, described below. Beyond those two, there is no tracking pixel inside the page and no third-party resource the page reaches for afterwards. Everything below was checked against the code this site is built from on the reviewed date, not against a plan — where the product does not yet do something, this page says so rather than describing it in advance.

What is collected today

  • No account. There is no sign-up, no sign-in, no password, and no profile.
  • Cookies: Google Analytics only. DelayPilot's own code sets none — not a session cookie, not a preference cookie. Google Analytics sets its own cookies, _ga and _ga_*, to tell visits apart.
  • Google Analytics 4. Measures aggregate traffic: which pages are viewed, approximate location, and device. Google handles that data under the Google Privacy Policy, and you can turn it off with the Google Analytics opt-out browser add-on.
  • Cloudflare Web Analytics. A cookieless, aggregate page-view count. No session recorder, heatmap, or experiment framework is loaded.
  • No advertising. No ad network, no ad script, no ad identifier. See the advertising policy for the rules that will bind if that ever changes.
  • No other third-party requests. No embedded video, no hosted font, no external image, no social widget, no error-reporting service. The typeface these pages render in is served from this site, so reading DelayPilot does not disclose your visit to a font provider.

What is stored in your browser

One value, and you have to ask for it. When you choose an appearance in the theme control — System, Light, or Dark — that choice is saved in your browser's local storage under the key dp-theme. It is the only key DelayPilot writes anywhere.

  • It is written only when you pick an option, never on page load. If you never touch the control, nothing is stored at all and the pages simply follow the light or dark preference your operating system already publishes to your browser.
  • It holds one of three words and nothing else. It is not an identifier, it is not a cookie, it is never attached to a request, and no DelayPilot server can read it.
  • Clearing this site's data in your browser removes it, and that is the whole of the clean-up.

The scripts this site loads, and what each one does

Five small scripts are served from this site's own address, and one more — Google's analytics loader — comes from Google. Only the analytics pair measures anything. Named honestly, they are:

  • The theme pre-load. Runs before the page paints, reads the saved theme, and applies it, so a reader who chose dark does not get one bright frame first. It reads that value; it never writes one.
  • The theme control. Keeps the appearance control in step with the saved choice and writes your choice when you make one. This is the only DelayPilot code on the site that writes to storage.
  • The analytics start-up and Google's loader. Together they send the aggregate page-view measurement described above to Google Analytics 4. Google's loader sets the _ga cookies.
  • The navigation. Opens and closes the menus in the header and the menu drawer on a phone.
  • The flight lookup, on the homepage only. Checks that what you typed looks like an airline, a flight number, and a date, and then shows the result state.

Looking up a flight

DelayPilot never asks for a booking reference or record locator, and never will. A flight is identified by airline and flight number and date, or by route and date — information that is public on a departure board.

Submitting the lookup form sends nothing anywhere. The page has no address to submit to: the form declares no destination, the script cancels the browser's own submission, and the whole exchange happens inside the tab you are sitting in. No flight-data provider is connected to this deployment, so the truthful answer is the labelled Unavailable state rather than an invented time — and that answer is produced locally, without a request leaving your browser.

What your browser is allowed to load

The site sends security headers with every page that restrict what the page may do. They are worth stating in plain words, because they are a check on us as much as on an attacker:

  • Scripts, styles, fonts, images, and network connections may come only from DelayPilot's own address, plus the named Google Analytics and Cloudflare Web Analytics addresses. A third-party tracker added by accident would be refused by your browser rather than quietly run.
  • Plugin content is blocked outright, and the page may not be embedded in another site's frame.
  • Your browser is told not to guess file types, and to trim the address it passes on when you follow a link away from here.
  • Geolocation, camera, microphone, and payment interfaces are switched off for these pages. DelayPilot never asks for your location.

What DelayPilot is built never to collect

These are invariants the codebase is written and reviewed against, not preferences a later release might quietly relax:

  • No booking reference or record locator, anywhere. Not as an input, not as a database column, not in a web address, not in a log line, not in an analytics event.
  • No identity documents. Never a passport, a government ID, a Known Traveler Number, a redress number, a card number, or an airline account password.
  • No access to your accounts. DelayPilot never reads an email inbox, never scrapes an airline account, and never signs in anywhere as you.
  • Nothing filed on your behalf. No claim, complaint, refund request, rebooking, or purchase is ever submitted for you.
  • No personal content in technical records. Logs, analytics events, error reports, page titles, social preview tags, and web addresses carry no email address, no name, no itinerary detail, no receipt text, no notification content, and no raw IP address.

What the hosting provider sees

These pages are static files served by a hosting provider, and that provider may keep standard request logs under its own policy. DelayPilot does not receive, store, or analyse them. No DelayPilot code sits in the path of a page request to add to them, and the only record of your visit DelayPilot can see is the aggregate analytics described above.

What changes when the product does

DelayPilot will eventually do things that require data: a saved trip, an email alert, a purchase. Each of those brings a new section to this page, and each section is added when the feature exists — never in advance, and never as a description of something that has not shipped. This page is rewritten rather than added to, so that it never becomes a history of intentions.

No retention period appears on this page for DelayPilot's own records, because DelayPilot's own code retains nothing; Google Analytics data is kept by Google under the retention setting of this site's Google Analytics property. Publishing a number now would be inventing one. The rules already binding on that future work are these: an email address is stored encrypted and matched by a keyed one-way fingerprint rather than by the address itself; analytics, if enabled, records privacy-minimized events that never include an email address, a name, a booking reference, an exact itinerary, receipt text, claim content, or a raw IP address; operational alerts about your flight stay separate from marketing messages, with a one-click unsubscribe for the latter; and export and deletion routes ship with the account that makes them meaningful.

Your choices today

You can opt out of Google Analytics with the Google Analytics opt-out browser add-on, and the site works the same without it. There is nothing to export and nothing to delete on DelayPilot's side, because DelayPilot holds nothing about you. If you have set a theme, clearing this site's data in your browser removes it. That is the whole list, and it is short on purpose.

Reaching us about this page

DelayPilot publishes no contact address today. Printing one that nobody monitors would be worse than saying so: there is currently no address to write to about this page, and this page will name one on the day it exists.

Related policies