Security and privacyYour travelers' data stays private.
GroupArrivals holds names and flight details for people who did not sign up for it themselves. We treat that seriously. Here is how their data is kept safe and when it is deleted.
Only your team sees your groups
Each workspace's data is kept apart inside the database itself, by rules checked on every read and write, not only hidden on the screen. Members are invited by an owner or an admin.
Public links show only what they are for
The guest link, the check-in link and the client board are private links with long random tokens. We store only a fingerprint (hash) of each token. Each link can see only its own group and scope, a check-in link can have a PIN, and every link can be turned off at any time.
The client board shows totals and flights. It shows travelers' names only if you turn that on.
Names never go to flight data providers
To follow a flight we send its flight number and date to our flight data provider. We never send a traveler's name, email or phone number.
Deleted 60 days after the group ends
Travelers' personal data is deleted automatically 60 days after a group's last day. You can export the group as a CSV before that, or delete the group or the whole workspace sooner.
Encryption and providers
Data is encrypted in transit (HTTPS) and at rest by our hosting providers. We use a short list of established providers: Supabase (database and sign-in), Vercel (hosting), Resend (email), Stripe (payments) and FlightAware (flight status). They are listed with their purpose in the Privacy Policy.
Report a security issue
If you find a security problem, please write to hello@grouparrivals.com. We acknowledge reports within two business days. Our security.txt file has the details.