Privacy Policy

Hiateus (“Hiateus,” “we,” “us,” or “our”) operates the Hiateus website and, in the future, the Hiateus mobile application described in this Privacy Policy.

Hiateus has not yet confirmed formation of a registered legal entity for this service. Until that is confirmed, Hiateus is referred to throughout this policy only by its public brand name, “Hiateus,” and not by any company or LLC name. This section will be updated with the confirmed legal entity name once formation is complete.

This Privacy Policy covers the Hiateus website at this domain, and will also cover the Hiateus mobile application once one is published, provided that application links to or references this policy. Where a practice described below applies only to the website or only to a future mobile app, this policy says so.

Hiateus is a travel decision-support tool: you tell it where you’re leaving from and a few circumstances about your trip, and it returns one recommended destination (a “Hiateus Pick”), along with estimated pricing, weather, and local activity information. This policy explains what information that involves.

We separate this into three categories: information you give us directly, information collected automatically as you use the site, and information we receive from third-party providers on your behalf.

Information you provide directly

• Trip-search inputs: your departure airport or approximate departure location (currently, Hiateus only fully models Houston, TX (IAH) as a departure market), destination or vibe preference, travel dates or date flexibility, trip duration, number of travelers, and maximum budget. These are submitted to Hiateus’s own servers to generate your recommendation and are not tied to a name, email address, or account, because Hiateus does not currently have accounts.
• Account information: Hiateus does not currently offer user accounts or require logging in to use the website. If accounts are introduced in the future, this policy will be updated before that feature launches to describe what account information is collected and how it’s used.
• Email addresses: Hiateus does not currently collect email addresses through the website — there is no newsletter, waitlist, account, or price-alert signup today. If support requests, surveys, waitlists, alerts, or marketing signups are introduced, this policy will be updated first to describe how those email addresses are used and how you can opt out.
• Feedback and survey responses: the “Save this trip,” “I’d take this trip,” and “Not quite” controls on the Hiateus Pick result page currently store your response only in your browser’s temporary page state — it is not transmitted to or stored on Hiateus’s servers today. If Hiateus begins collecting feedback server-side (for example, to improve recommendations), this policy will be updated first.

Information collected automatically

• Connection and device information: like virtually all websites, Hiateus’s hosting provider automatically logs standard technical information for every request it receives — this typically includes your IP address, browser type, device and operating system information, the page or API endpoint requested, and timestamps. Hiateus uses a portion of this information (your IP address) directly for rate limiting and abuse prevention, described in How We Use Information.
• Cookies and local storage: Hiateus does not currently set analytics or marketing cookies, and does not currently store information in your browser’s local storage. If that changes, this section will be updated to describe what is stored and why.
• Analytics: Hiateus does not currently use a dedicated analytics service (for example, Google Analytics or a similar product). If one is added, this policy will be updated first to name the provider and describe what it collects.
• Location information: Hiateus does not request or collect your device’s precise or approximate location. The “departure location” used in a trip search is whatever you type into the origin field yourself, not information read from your device or browser.

Information from third-party providers

• Affiliate-link clicks and booking referrals: when you select “Book This Trip,” Hiateus routes you through its own redirect endpoint on the way to an external booking provider (currently a general flight-search link; see Affiliate Compensation). That redirect records a click count associated with the destination and the date, but not with your identity, IP address, or any account.
• Once you leave Hiateus through a booking link, information you provide to that third-party provider (for example, an airline or hotel booking site) is governed by that provider’s own privacy policy, not this one.

Hiateus does not currently process payments or store payment information — booking and payment happen entirely on the third-party provider’s site after you leave Hiateus. If Hiateus introduces paid features of its own, this policy will be updated first to describe how payment information is collected, processed, and by which payment processor, before any payment feature launches.

• Generating and personalizing your recommendation: your trip-search inputs are scored against Hiateus’s modeled destination data to select and explain a single recommended trip.
• Fraud prevention, rate limiting, and security: IP addresses and request patterns are used to detect and limit abusive or excessive automated traffic against Hiateus’s search and redirect endpoints.
• Debugging and reliability: technical logs (see Information Collected Automatically) are used to diagnose errors and keep the service running.
• Customer support: if and when you contact Hiateus directly, information you provide in that message is used to respond to you.
• Communications and marketing preferences: Hiateus does not currently send marketing communications, because it does not currently collect the email addresses that would be needed to do so.

Hiateus shares information with the categories of service providers below as necessary to operate the service. We do not sell your information.

• Hosting and infrastructure: Vercel hosts the Hiateus website and its server-side functions, and by necessity processes every request made to the site.
• Caching infrastructure: Hiateus uses Upstash Redis to temporarily cache search results and rate-limit counters (keyed by IP address, not identity) so repeated identical searches load faster and abusive traffic can be throttled.
• Weather: Hiateus requests live weather for a recommended destination’s coordinates and your trip dates from a third-party weather data provider.
• Flights, hotels, and events (not yet active): Hiateus’s systems are built to request live flight pricing, live lodging pricing, and live local events from third-party providers. These integrations are not active in the current build — no credentials are configured for them, and no live request is made to these providers today. If and when they become active, this policy will be updated to name the providers actually in use.
• Mapping and AI providers: Hiateus does not currently use a mapping provider or an AI/machine-learning provider. If either is introduced, this policy will be updated first.
• Affiliate and booking partners: see Affiliate Compensation below.
• Payment processors: not applicable — see Payment Information.
• Legal and compliance: Hiateus may disclose information if required to do so by law, regulation, legal process, or governmental request, or where we believe disclosure is necessary to protect the rights, property, or safety of Hiateus, our users, or others.
• Business transfers: if Hiateus is involved in a merger, acquisition, financing, or sale of assets, information may be transferred as part of that transaction. We will describe any materially different handling of your information in an update to this policy.

Hiateus may receive compensation when you follow a booking or affiliate link from a Hiateus Pick and complete a purchase with the linked provider. This does not change the price you pay. Hiateus’s recommendation logic is based on the modeled trip criteria described elsewhere in this policy and in Hiateus’s Terms of Service, not on which provider pays the highest referral fee.

• Cached search results are generally retained for a few minutes to a few hours, depending on the type of data, and then automatically expire.
• Non-identifying affiliate click counters are retained for approximately 30 days.
• Standard hosting-provider connection logs are retained according to Vercel’s own retention practices, not a Hiateus-specific schedule.
• Hiateus does not currently build or retain a long-term profile of any individual visitor, because it does not currently have accounts, and does not currently collect identifying information alongside trip-search inputs.

Hiateus uses reasonable technical measures appropriate to the limited information it currently handles — for example, server-side credential storage, rate limiting, and input validation on every request. No method of transmission or storage is completely secure, and Hiateus cannot guarantee absolute security of any information.

Because Hiateus does not currently have accounts or store information tied to your identity, there is typically no individual profile to access, correct, or delete. Where Hiateus does hold information that identifies or could reasonably identify you (for example, a message you send to a contact address), you may ask us to access, correct, or delete it using the contact details in Contact Us.

Texas and other state privacy rights

If and to the extent the Texas Data Privacy and Security Act or another state’s consumer privacy law applies to Hiateus’s processing of your information, you may have the right to confirm whether Hiateus processes information about you, access that information, correct inaccuracies, request deletion, obtain a portable copy, and opt out of the processing of personal data for targeted advertising, the sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects. Hiateus does not currently sell personal data or use it for targeted advertising. You can submit a rights request using the contact details below; Hiateus will not discriminate against you for exercising these rights.

Hiateus’s hosting and third-party service providers may process information on servers located outside the country you are visiting from, including in the United States. Where this policy describes a provider as active, using Hiateus means you understand your information may be processed in those locations.

Hiateus is not directed to, and is not intended for use by, anyone under 18 years old. Hiateus does not knowingly collect information from anyone under that age. If you believe a child has provided us information, please contact us using the details below so we can address it.

Hiateus may update this Privacy Policy as the service changes. If a change is significant, we will update the “Last updated” date at the top of this page, and, where practical, provide additional notice on the website before the change takes effect. As stated throughout this policy, several categories of features described here as inactive will trigger a policy update before they launch, not after.

Questions about this Privacy Policy or your information can be directed to Hiateus as follows:

Hiateus has not yet published a dedicated privacy contact email or a general support channel for this build. This section will be completed with real contact details before Hiateus is made available to the public. In the meantime, this page itself is the authoritative record of Hiateus’s data practices.

See also Hiateus’s Terms of Service.