Privacy Policy

Hiateus (“Hiateus,” “we,” “us,” or “our”) operates the Hiateus website and, in the future, the Hiateus mobile application described in this Privacy Policy.

Hiateus is operated by Hiateus Technologies LLC.

This Privacy Policy covers the Hiateus website at this domain, and will also cover the Hiateus mobile application once one is published, provided that application links to or references this policy. Where a practice described below applies only to the website or only to a future mobile app, this policy says so.

Hiateus is a travel decision-support tool: you tell it where you’re leaving from and a few circumstances about your trip, and it returns one recommended destination (a “Hiateus Pick”), along with estimated pricing, weather, and local activity information. This policy explains what information that involves.

We separate this into three categories: information you give us directly, information collected automatically as you use the site, and information we receive from third-party providers on your behalf.

Information you provide directly

• Trip-search inputs: your departure airport or approximate departure location (currently, Hiateus only fully models Houston, TX (IAH) as a departure market), destination or vibe preference, travel dates or date flexibility, trip duration, number of travelers, and maximum budget. These are submitted to Hiateus’s own servers to generate your recommendation. If you are signed in, the destination and vibe from a generated recommendation are associated with your account (see “Feedback and survey responses” below); if you are not signed in, they are not tied to a name, email address, or account.
• Account information: creating a Hiateus account (through our authentication provider, Clerk) collects your email address and, if you choose to provide them, a first name, last name, and display name. Your password is stored and managed entirely by Clerk — Hiateus never sees or stores it directly. Once signed in, you can optionally add a home airport, a preferred budget, and favorite vibe categories to your profile; none of this is required to use Hiateus without an account.
• Email addresses: collected only when you create an account, via Clerk, to identify you and let you sign back in (including password-reset emails). Hiateus does not otherwise collect email addresses — there is no separate newsletter, waitlist, or marketing signup today.
• Feedback and survey responses: the “Save this trip,” “I’d take this trip,” and “Not quite” controls on the Hiateus Pick result page are stored on Hiateus’s servers — which destination, which reason (if any), and, only if you were signed in when you clicked, which account. Saving a trip while signed in adds it to your account’s Saved Trips list; if you are not signed in, “Save this trip” instead prompts you to sign in.

Information collected automatically

• Connection and device information: like virtually all websites, Hiateus’s hosting provider automatically logs standard technical information for every request it receives — this typically includes your IP address, browser type, device and operating system information, the page or API endpoint requested, and timestamps. Hiateus uses a portion of this information (your IP address) directly for rate limiting and abuse prevention, described in How We Use Information.
• Cookies and local storage: if you create an account, our authentication provider (Clerk) sets an essential session cookie so you stay signed in — it exists only to keep you logged in and isn’t used for advertising or cross-site tracking. Hiateus also sets one first-party analytics cookie (hia_sid) — a randomly generated, anonymous identifier containing no name, email, or other directly-identifying information — so we can measure how visits move through the product (for example, whether a visit led to a Hiateus Pick being generated, accepted, or booked), including before you sign in. This cookie is used only for Hiateus’s own first-party product analytics and data-quality protection; it is never used for advertising, is never sold or shared with a third party, and is never used to track you across other websites. It expires automatically after 30 days. Hiateus does not otherwise set marketing or advertising cookies, and does not otherwise store information in your browser’s local storage. If that changes, this section will be updated to describe what is stored and why.
• Analytics: Hiateus does not use a third-party analytics service (for example, Google Analytics or a similar product). Hiateus does record first-party product-usage events in its own database — for example, that a recommendation was generated, accepted, saved, or led to a provider click — to understand and improve how the product works and to measure whether it is working commercially. These events may be associated with the anonymous analytics cookie described above and, if you’re signed in, your account id — never with your name, email, or other directly-identifying information. They are never sold or shared with a third party. If a third-party analytics service is ever added, this policy will be updated first to name the provider and describe what it collects.
• Location information: Hiateus does not request or collect your device’s precise or approximate location. The “departure location” used in a trip search is whatever you type into the origin field yourself, not information read from your device or browser.

Information from third-party providers

• Affiliate-link clicks and booking referrals: when you select “Book This Trip,” Hiateus routes you through its own redirect endpoint on the way to an external booking provider (currently a general flight-search link; see Affiliate Compensation). That redirect records a click count associated with the destination and the date, but not with your identity, IP address, or any account.
• Once you leave Hiateus through a booking link, information you provide to that third-party provider (for example, an airline or hotel booking site) is governed by that provider’s own privacy policy, not this one.

Hiateus does not currently process payments or store payment information — booking and payment happen entirely on the third-party provider’s site after you leave Hiateus. If Hiateus introduces paid features of its own, this policy will be updated first to describe how payment information is collected, processed, and by which payment processor, before any payment feature launches.

• Generating and personalizing your recommendation: your trip-search inputs are scored against Hiateus’s modeled destination data to select and explain a single recommended trip.
• Fraud prevention, rate limiting, and security: IP addresses and request patterns are used to detect and limit abusive or excessive automated traffic against Hiateus’s search and redirect endpoints.
• Debugging and reliability: technical logs (see Information Collected Automatically) are used to diagnose errors and keep the service running.
• Customer support: if and when you contact Hiateus directly, information you provide in that message is used to respond to you.
• Communications and marketing preferences: Hiateus does not currently send marketing communications, because it does not currently collect the email addresses that would be needed to do so.

Hiateus shares information with the categories of service providers below as necessary to operate the service. We do not sell your information.

• Hosting and infrastructure: Vercel hosts the Hiateus website and its server-side functions, and by necessity processes every request made to the site.
• Caching infrastructure: Hiateus uses Upstash Redis to temporarily cache search results and rate-limit counters (keyed by IP address, not identity) so repeated identical searches load faster and abusive traffic can be throttled.
• Weather: Hiateus requests live weather for a recommended destination’s coordinates and your trip dates from a third-party weather data provider.
• Flights, hotels, and events (not yet active): Hiateus’s systems are built to request live flight pricing, live lodging pricing, and live local events from third-party providers. These integrations are not active in the current build — no credentials are configured for them, and no live request is made to these providers today. If and when they become active, this policy will be updated to name the providers actually in use.
• Mapping and AI providers: Hiateus does not currently use a mapping provider or an AI/machine-learning provider. If either is introduced, this policy will be updated first.
• Affiliate and booking partners: see Affiliate Compensation below.
• Payment processors: not applicable — see Payment Information.
• Legal and compliance: Hiateus may disclose information if required to do so by law, regulation, legal process, or governmental request, or where we believe disclosure is necessary to protect the rights, property, or safety of Hiateus, our users, or others.
• Business transfers: if Hiateus is involved in a merger, acquisition, financing, or sale of assets, information may be transferred as part of that transaction. We will describe any materially different handling of your information in an update to this policy.

Hiateus may receive compensation when you follow a booking or affiliate link from a Hiateus Pick and complete a purchase with the linked provider. This does not change the price you pay. Hiateus’s recommendation logic is based on the modeled trip criteria described elsewhere in this policy and in Hiateus’s Terms of Service, not on which provider pays the highest referral fee.

• Cached search results are generally retained for a few minutes to a few hours, depending on the type of data, and then automatically expire.
• Non-identifying affiliate click counters are retained for approximately 30 days.
• Standard hosting-provider connection logs are retained according to Vercel’s own retention practices, not a Hiateus-specific schedule.
• If you create an account, your profile (name, email, home airport, preferred budget, favorite vibes) and saved trips are retained until you ask Hiateus to delete them. Hiateus does not otherwise build or retain a long-term profile of a visitor who isn’t signed in.

Hiateus uses reasonable technical measures appropriate to the limited information it currently handles — for example, server-side credential storage, rate limiting, and input validation on every request. No method of transmission or storage is completely secure, and Hiateus cannot guarantee absolute security of any information.

If you have a Hiateus account, you can access and correct your name, home airport, preferred budget, favorite vibes, email, and password directly from your profile page. To delete your account and associated data, or for any other information that identifies or could reasonably identify you (for example, a message you send to a contact address), contact us using the details in Contact Us.

Texas and other state privacy rights

If and to the extent the Texas Data Privacy and Security Act or another state’s consumer privacy law applies to Hiateus’s processing of your information, you may have the right to confirm whether Hiateus processes information about you, access that information, correct inaccuracies, request deletion, obtain a portable copy, and opt out of the processing of personal data for targeted advertising, the sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects. Hiateus does not currently sell personal data or use it for targeted advertising. You can submit a rights request using the contact details below; Hiateus will not discriminate against you for exercising these rights.

Hiateus’s hosting and third-party service providers may process information on servers located outside the country you are visiting from, including in the United States. Where this policy describes a provider as active, using Hiateus means you understand your information may be processed in those locations.

Hiateus is not directed to, and is not intended for use by, anyone under 18 years old. Hiateus does not knowingly collect information from anyone under that age. If you believe a child has provided us information, please contact us using the details below so we can address it.

Hiateus may update this Privacy Policy as the service changes. If a change is significant, we will update the “Last updated” date at the top of this page, and, where practical, provide additional notice on the website before the change takes effect. As stated throughout this policy, several categories of features described here as inactive will trigger a policy update before they launch, not after.

Questions about this Privacy Policy or your information can be directed to Hiateus as follows:

Email: support@hiateus.com

See also Hiateus’s Terms of Service.