Until Arrival doesn't collect any personal information about you. Your traveler names, your manifest of flights, and your iCloud-synced records all stay on your device and in your private iCloud account. The only data that leaves your device is the flight number itself, which we send to a small server to look up public schedule data.
ii.What stays on your device
Traveler names. "Mom," "Sarah," whatever you type — only on your iPhone and your private iCloud.
The manifest. Every flight you've added, past and present. Your record, only yours.
Notes and history. Status events, gate changes, landed times. All on your device, synced via Apple's iCloud encryption.
iii.What we send to our server
To look up flight schedules and receive status updates, the iOS app sends two things to a small Cloudflare Worker we operate:
The flight number and date. "UA 1432 on 2026-04-30." That's it. The server uses this to query a public flight-data service (AeroDataBox) and to register a subscription for status updates.
A device push token. An opaque identifier from Apple that lets us send silent push notifications to your phone when a flight's state changes. The token can't be reversed into your identity.
The server never sees the traveler's name, your name, your location, or anything else identifying. Multiple devices can subscribe to the same flight; the server doesn't know they belong to different households or which device is which beyond the opaque token.
iv.Third-party services
AeroDataBox — the flight data provider. Sees the flight number, never the user. aerodatabox.com/privacy.
Cloudflare — runs the small server. Standard request logs, no identifying app data. cloudflare.com/privacypolicy.
Apple Push Notification service — delivers silent pushes. Apple-managed.
No location, microphone, camera, or contacts access.
No account registration. There is no Until Arrival account or login.
No data brokerage or third-party sharing.
vi.Children's privacy
The app is intended for general audiences and does not knowingly collect any data from anyone, including children under 13.
vii.Deleting your data
Remove a flight from inside the app to drop the subscription on our server (your device's push token is unbound from that flight; if no devices remain subscribed, the server drops it entirely). To remove everything, delete the app — the server unbinds the device token automatically. To remove the iCloud copy, after deleting the app go to Settings → [your name] → iCloud → Manage Account Storage → Until Arrival → Delete Data.
viii.Changes to this policy
If this policy changes in any material way, the "Last updated" date above will change and the new policy will be posted on this page.