Privacy policy

Email: info@nighthopper.de

The controller has no establishment in the European Union. The following has been designated as representative under Article 27 GDPR:

Data subjects and supervisory authorities can contact this representative in addition to the controller.

This site does without fonts from third-party servers. We count visits ourselves, without storing anything on your device (see “Audience measurement”). We only use Google Analytics, Google Ads and Trustpilot’s review button if you consent in the banner (see “Google Analytics and Google Ads” and “Trustpilot review button”); without consent, nothing loads from Google or Trustpilot. Tours and tickets from GetYourGuide only load when you tap “Search experiences” or “Show experiences” yourself; the notice about this is right next to the button (see “Experiences from GetYourGuide”). Otherwise, your browser only holds what a feature you use yourself needs.

The vehicle photos in the car hire search belong to our partners but are delivered via our own server — your browser does not connect to them. Since 21 September 2026, the same applies to the hotel photos. One exception remains, described in more detail below: the flight search on the “Flights” page runs as a search module of our partner network Travelpayouts directly between your browser and its servers.

As with every visit to a website, your browser transmits technical details that arise during operation: IP address, date and time, the address requested, the amount of data transferred, and browser and operating system details. They are used to deliver the site and to detect faults and attacks.

The legal basis is our legitimate interest in secure operation (Art. 6(1)(f) GDPR). These details are not combined with other data. They are created as logs at our host and are deleted there automatically, after 30 days at the latest.

We count how often our pages are viewed. Nothing is stored on your device for this and nothing is read from it — no cookie, no browser storage, no querying of device properties, no counting script. That is why we do not ask for your consent for it: § 25(1) TDDDG concerns precisely the storing of information on, and the reading of it from, end devices, and neither happens here.

Only what your browser sends anyway when you visit is evaluated: the address requested, the page you came from (only its domain, never the full address), the browser identifier, the preferred language and your IP address. From the IP address, our host Vercel determines the country, federal state or region and city before the request reaches us; we adopt these details but do not query a location service of our own. We also use the federal state to suggest the nearest major airport as the departure airport in the flight search and, for package holidays, to preselect the airports in your region if you arrive via a link with a destination. We do not store anything for this, and you can change the airport at any time.

If you come to us via a tagged link, for example from an ad or a newsletter, we store the campaign details from the address (utm parameters such as source, campaign and the ad’s search term) and the name of the ad network whose click identifier was in it (e.g. “Google Ads”). We do not store the click identifier itself. We count location only as a daily total (day, country, city, number), separately from all other details and without an identifier.

We do not store the IP address. Together with the browser identifier and a random value that changes daily, it is converted into an identifier. This makes it possible to recognise that two visits on the same day belong together — nothing more. If you click through to one of our partners on the same day, we use this identifier to attribute the click to the route by which you arrived (for example “search engine” or “ad”); all that is stored with the click is this route and, if you arrived via a link in “My account”, the word “account” — not the identifier and not which account. After two days, we delete the random value and the identifier and cut the time down to the full hour; after that, no one at our end can attribute the rows to anyone either. After 180 days, they are deleted completely. If you open a hotel’s dates in package holidays, we count this in the same way: as a daily total with the route by which you arrived, without the identifier. If you start a car hire search or open the offers for a car, we count this in the same way too: as a daily total with the route by which you arrived, without the identifier. If you open a place to stay in the hotel search, we count in the same way whether one of our partners had an offer for your travel dates: as a daily total with the route by which you arrived, without the identifier.

If you choose a country or a place in the “Where would you like to go?” field on the home page, we count which destination was chosen (day, destination, number), without an identifier and without an IP address; nothing is stored on your device for the counting. Only your browser tab remembers the choice itself (see “Your current search” under “What is stored in the browser”). This shows us which destinations we should write a travel guide for next.

On the home page, we also count in which area a link or form is used (for example “Live deals” or “Hotels by theme”) and which search is submitted (flight, hotel, car hire or package holiday). Only the day, the area or search, the device class (mobile, tablet or computer, from the browser identifier) and the number are stored, without an identifier and without an IP address; nothing is stored on your device or read from it for this. This shows us whether a change to the home page helps. We delete the figures after 400 days.

The legal basis is our legitimate interest in knowing whether and from where visitors come (Art. 6(1)(f) GDPR). We do not use any third-party tool for this, no data is transferred to other companies and nothing leaves the European Union — the figures are kept in the same database as everything else, in Frankfurt.

If you consent in the banner, we use Google Analytics 4 (statistics) and Google Ads conversion tracking (advertising). You choose each one separately. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Before you consent, nothing loads from Google and nothing is stored on your device for it.

Why: With “Statistics” we see which pages are visited, for how long, where visitors come from (search engine, ad, link) and from which region. On the home page, “Statistics” has also measured since October 2026 how quickly it loads (loading time, layout shifts while loading, response time to a click). With “Advertising”, Google Ads measures whether a click on one of our ads led to a visit and to a click through to one of our partners. We do not use personalised advertising (remarketing).

Which data: a random identifier in a cookie, pages viewed and the times of viewing, and the page you came from (in each case only the path of the address, without search details such as destination, travel dates, flight number or search terms — we remove these before the measurement leaves your device), campaign details and the click identifier of an ad, clicks through to partners (only the partner’s name and domain, not the address of the offer), device, browser, language and the approximate location that Google derives from the IP address. According to Google, Google Analytics 4 does not store IP addresses.

Cookies: _ga and _ga_… (statistics, up to two years), _gcl_… (advertising, up to 90 days). We store your choice itself for six months in the cookie nh_einwilligung; after that, we ask again.

The legal basis is your consent (§ 25(1) TDDDG, Art. 6(1)(a) GDPR). You can withdraw it at any time with effect for the future: Cookie settings, also at the bottom of every page. When you withdraw it, we delete the Google cookies in your browser.

USA: Google may transfer data to Google LLC in the USA. Google is certified under the EU-US Data Privacy Framework, for which the European Commission determined an adequate level of protection on 10 July 2023 (Art. 45 GDPR). Google processes the data as a processor under the Google Ads Data Processing Terms.

Retention at Google: Google Analytics deletes event data after 14 months at the latest. More from Google: policies.google.com/privacy.

With the result of the compensation check, under every past trip in “My trip” and when you tick the last item on the packing list, we show Trustpilot’s button “Bewerten Sie uns auf Trustpilot” (“Review us on Trustpilot”) if you consent to “External content” in the banner. The provider is Trustpilot A/S, Pilestræde 58, 5th floor, 1112 Copenhagen K, Denmark. Without consent, there is only a link to Trustpilot, and nothing goes to Trustpilot when the page is displayed.

Which data: When the button loads, Trustpilot receives what your browser sends with every request (IP address, browser, device), as well as your browser’s language and platform. So that Trustpilot does not learn which page you are on and what its address contains (such as flight number and date), the button loads in a separate, empty page of ours: Trustpilot only sees nighthopper.de/api/trustpilot-knopf as the address and no origin. Only a click on the button opens Trustpilot in a new window; Trustpilot’s terms apply there.

The legal basis is your consent (§ 25(1) TDDDG, Art. 6(1)(a) GDPR). You can withdraw it at any time with effect for the future: Cookie settings, also at the bottom of every page. The button then disappears immediately. We store your choice for six months in the cookie nh_einwilligung; Trustpilot does not place anything on your device via us.

Who is responsible: We are responsible for embedding it on our site; Trustpilot is responsible for everything else as an independent controller. More from Trustpilot: corporate.trustpilot.com/legal.

In your account, on the website as in the app, there is a “Write a review” button under “Review on Trustpilot”. Directly before it, it says what it triggers. Trustpilot only learns about you when you press it.

How it works: When you press the button, we immediately send you a short email and send a blind copy (BCC) to a Trustpilot address. Trustpilot takes your email address from it and sends you a single invitation, usually within a week. Nothing else goes to Trustpilot: no name, no trip, no link. If you reply to our email, Trustpilot learns nothing about it. There is no second invitation via us.

If you consented by ticking a box before 7 October 2026, the email is only sent seven days after your consent, as described at the time; until then, you can withdraw it in your account on the website.

What we store: when you consented to which wording (the sentence at the button), whether and when you withdrew and when the invitation was sent, as proof (Art. 7(1) GDPR). This is included in “Download my data” and is deleted with your account.

The legal basis is your consent (Art. 6(1)(a) GDPR, § 7(2) no. 2 UWG), which you give with the button. You can withdraw it at any time with effect for the future, for example by emailing us. You can also unsubscribe from further emails from Trustpilot using the unsubscribe link in their email.

Recipient: Trustpilot A/S, Pilestræde 58, 5th floor, 1112 Copenhagen K, Denmark. Trustpilot sends the invitation on our behalf; if you then write a review, Trustpilot itself is responsible for that. Our email provider handles the sending to you (section “Who works for us”).

On the “Experiences” page and in the “Experiences” tab on the home page, you can view and choose tours and tickets from our partner GetYourGuide directly on our site. They only load when you tap “Search experiences” or “Show experiences” yourself; right next to the button, it says beforehand what will then happen. Until then, nothing goes to GetYourGuide when our pages are displayed. The provider is GetYourGuide Deutschland GmbH, Sonnenburger Straße 73, 10437 Berlin, Germany.

Which data: The selection loads in a frame directly from GetYourGuide. In the process, GetYourGuide receives what your browser sends with every request (IP address, browser, device), the destination and the theme for which you are viewing experiences and, as the origin, only nighthopper.de/erlebnisse — not your travel dates or the rest of our address. We do not embed a GetYourGuide counting script. Within the frame, GetYourGuide itself sets two cookies: a random visitor identifier (visitor_id, 13 months) and one from its security service Cloudflare against automated access (__cf_bm, 30 minutes). The frame also reports to GetYourGuide which offers you have seen and clicked, with this identifier, your browser identifier and the width of your screen. A click on an offer opens GetYourGuide in a new tab; from then on, “Referral to partners” applies. We count this click like every switch to a partner (see “Audience measurement”).

The legal basis is your consent (§ 25(1) TDDDG, Art. 6(1)(a) GDPR), which you give with the click. It applies until you reload or close the page; we do not store it, and on your next visit the notice at the button applies again. You can withdraw it at any time with effect for the future: below the selection there is “Hide GetYourGuide”, and the frame then disappears immediately; reloading the page has the same effect. You remove GetYourGuide’s cookies by deleting the site data of getyourguide.com in your browser.

Who is responsible: We are responsible for embedding it on our site; GetYourGuide is responsible for everything else as an independent controller. According to its own statements, GetYourGuide uses servers in the European Union; GetYourGuide’s service providers are also based in the USA, and access from there cannot be ruled out. More from GetYourGuide: getyourguide.com/de-de/c/privacy-policy.

We do not run the site on our own computers. These service providers process data exclusively on our behalf and according to our instructions:

• Vercel — operation of the website. The pages and interfaces run in the Frankfurt am Main region. Your browser loads the short videos in the header image of the home page from Vercel’s file storage (Vercel Blob, Frankfurt am Main), in a smaller version on mobile and not in data saver mode. In the process, Vercel receives your IP address, as when you visit the site.
• Neon — the database that holds accounts, saved trips and packing lists. Location: Frankfurt am Main.
• united-domains — our email inbox, that is, everything you write to us, and the sending of the sign-in codes for your account.

Vercel and Neon are companies based in the USA; access from there cannot be technically ruled out. The basis for this is the European Commission’s adequacy decision on the EU-US Data Privacy Framework or the European Commission’s standard contractual clauses.

Without your consent, we do not set any advertising or statistics cookies. Your browser’s storage only holds what a feature you use needs:

• Appearance — whether you have chosen light or dark.
• Saved trips — only if, without signing in, you choose “Save” or “Add to trip” yourself. If you tap “Add to trip” after opening a flight, a hire car or accommodation with a provider, we also store the provider, the time of the switch and, for flights and car hire, the link to its offer and an identifier of this switch — so that, once you sign in, we can attribute a booking reported to us by a partner network to your trip or ask you whether it was you. For accommodation, we store its name, its identifier at Google, the address of its first photo, the destination of your search, guests (with the ages of children travelling with you), rooms and the price shown. If you have already saved the trip, we also add these details when you then switch to the provider. They wait in your browser until you sign in to “My trip”; they are then held in your account and disappear from the browser. When you sign out, we delete them from the browser. If you only switch to a provider, we store nothing without you signing in.
• Your saved items — only if, without signing in, you tap the bookmark on a flight, a package holiday or a hire car: what you have saved (for flights the route, days, flight times, flight numbers and airline; for package holidays the hotel and date; for car hire the pick-up and drop-off location, period and model), the search for it, the price shown with the provider and when you saved it — no links to providers. They are kept in this browser (localStorage “nighthopper:merkliste:v1”) until you tap the bookmark again, delete the site data or sign in: we then move them to your account and delete them from the browser.
• Your saved hotels — only if you tap the heart on a place to stay: its name, its identifier, the address of its first photo and the destination of your search, no prices. They are kept only in this browser (localStorage “nighthopper:hotel-merkliste:v1”) until you tap the heart again or delete the site data.
• Signing in — three cookies, only if you sign in (at “My trip”, on the packing list, for the price alert or for the deal email): one links the code to this browser (15 minutes at most), one keeps you signed in (30 days or until you sign out). These two only contain a random identifier, no details about you. The third only tells the header “signed in” (value 1), so that it can show you the countdown to your next trip on every page and the home page can show suggestions for this trip; it expires with your sign-in and is removed when you sign out.
• Your current search — departure, destination (also a country, a region or a place if you choose it under “Where would you like to go?”), dates and travellers, so that hotel, eSIM or transfer can take them over and you don’t have to type them in again, and so that the home page can suggest flights, hotels, car hire and package holidays for this destination and show a photo of it. The page determines the photo and its colour afresh each time; only your choice is stored. If you come to us via a link with a destination, for example from an ad, this destination counts as your search. It is only kept in the browser for as long as the tab is open and is gone as soon as you close it.
• The package holiday hotel you last clicked — name, stars, location, rating and cheapest offer, so that the dates page can describe it. Likewise only for as long as the tab is open.

No consent is needed for this: § 25(2) no. 2 TDDDG permits storage on your device if it is strictly necessary for a service you are explicitly using. You can delete everything at any time by removing the site data in your browser.

The packing list used to be kept only in your browser. Since 24 September 2026, it has only been available with an account (see below); we delete an old version in your browser as soon as you open one of our pages again.

“My trip” and the packing list are only available with an account; you can search, compare and switch to a provider without one. You sign in with your email address: we send you a six-digit code, and the account is created with the first correct code. There is no password.

We need the email address because you sign in with it; without it, there is no account and therefore neither “My trip” nor the packing list. Your first name is optional.

We store your email address, optionally a first name, when the account was created and the address confirmed and when you last signed in. In addition, your trips: route or pick-up location, dates, number of travellers, airline, flight numbers and flight times, for accommodation its name, its identifier at Google, the address of its first photo, its stars, the destination of your search, guests with the ages of children travelling with you and rooms, the services chosen with the prices as they were displayed, the provider and the link to its offer, the time of the switch there, the identifier of the referral (if you switch to providers several times for the same trip, each switch with provider, time, identifier and the offer as it was displayed at the time — services and prices, flights, airline, return flight, number of travellers, link to the provider — so that a reported booking also finds an earlier switch and shows what you booked there), the booking status and — if the partner network or a pasted confirmation tells us — the booking number and amount. For each sign-in, we record when it began, until when it is valid, when it was last used and the browser and operating system in short form (such as “Safari on iOS”).

For the packing list, we store for each list — a general one and one for each trip you pack for — the type of trip (beach, city or cold, also several at once), whether a hire car is included, which items you have ticked, your own items that you add to the list (only the text you type in, at most 50 per list), which trip the list belongs to and when you last changed it. A list is only created when you click or enter something there. We derive the destination country, on which “Especially important for …” is based, from the destination of your trip each time you open it; it is not stored.

For saved items, we store what you save with the bookmark — in the app also places to stay and deals with the heart: for a flight the route, days, flight times, flight numbers and airline; for a package holiday the hotel with place, stars and photo and, if you save a date, its days, board, room and departure airport; for a hire car the pick-up and drop-off location, period, driver’s age, model and rental company; for a place to stay the name, photo, destination and travel dates; for a deal its destination. In each case also the search with which you open it again, the price that was displayed when you saved it, with the provider, and when you saved it. We do not store links to providers. At most 40 entries of each kind; if you save more, the oldest makes way. An entry disappears when you remove it, 30 days after its last travel day, without a travel day one year after saving — and immediately with your account.

For each request for a code, we store the address, a check value of the code (not the code itself), the number of entries and a hash value of your network, not your IP address. This allows us to limit how often codes can be requested and guessed.

The legal basis is the user agreement for your account with “My trip” and the packing list (Art. 6(1)(b) GDPR); limiting code requests and keeping proof of a deletion are based on our legitimate interest in preventing misuse and being able to prove deletions (point (f)). We only use the details for “My trip”, the packing list, saved items and the price alert — not for analyses (apart from a total for us of how many accounts have signed in over the last 30 days; point (f)), and we do not pass them on to anyone. There is only advertising by email if you explicitly order the deal email (see below).

The details are held in our database at Neon in Frankfurt am Main. The email with the code goes out via our inbox at united-domains; we do not keep a copy. We write to you with the sign-in code, the confirmation of a deletion and — at least four weeks in advance — changed terms of use; in addition, notifications of your price alerts and the deal email, but only if you have set them up or ordered it.

In “My trip”, you can download your data as a file at any time, including the packing lists and saved items, and delete your account — with all trips, packing lists, saved items and sign-ins, immediately. As proof of the deletion, we keep only the date and a shortened form of your address for 180 days.

The price alert is only available with an account. If you set one up, we store the route, the departure day or month, the return day if you wish, whether three days before and after count as well, your price limit, the price when it was set up, the most recently seen price with the day and time of the check, the language we write to you in (that of the page on which you set it up) and when we last wrote to you.

Once a day, we query the cheapest most recently found price for each alert from Travelpayouts (Aviasales). Only the route and days go there — neither your address nor anything else about you. If the price falls, we write to you via our inbox at united-domains; we do not keep a copy of the email.

The legal basis is the user agreement for your account (Art. 6(1)(b) GDPR). You delete an alert on the Price alert page or with the link in every email, without signing in. It ends by itself after the departure day; with the account, it is gone immediately.

The deal email is advertising: once a week, we send you flights that are currently well below the usual price for their route and on which we can earn a commission through partners. We only send it if you order it with an account and explicitly consent. Your address has then already been confirmed by the sign-in code.

We store that and when you consented and which wording you saw, which departure airports you chose, the language we write to you in and when the last deal email went to you. If you unsubscribe, we note the time and send nothing more; the note remains as proof that the earlier emails had a basis, until you delete the account.

The legal basis is your consent (Art. 6(1)(a) GDPR, § 7(2) UWG). You can withdraw it at any time — with the link in every deal email, without signing in, or on the Flight deals page. The withdrawal applies to the future. The email goes out via our inbox at united-domains; we do not evaluate whether you open it or click on it.

If you send us the form at /kontakt, your name, your email address, the subject and your text go as an email to our inbox at united-domains. We use them only to reply to you and do not pass them on to anyone. The basis is our legitimate interest in being reachable (Art. 6(1)(f) GDPR) — and, if it concerns a contract with us, taking steps towards it (Art. 6(1)(b) GDPR).

So that the form is not flooded by machines, our server briefly checks, when you send it, how often messages have been sent from the same origin. For this, your IP address is immediately converted into a hash value; the plain text is not stored, and the hash value is kept only in working memory and is gone after one hour at the latest. It is not included in the email.

We keep the message itself for as long as any other email to us: until the matter has been dealt with, for three years at most.

You can paste the text of a booking confirmation so that the trip is completed. From the text, we read the booking number, provider, route, flight numbers, date and amount. We do not store the text itself — only the details recognised, with the trip in your account. We do not keep names, including those of fellow travellers.

If you book with a partner after a referral, its network reports to us that a booking has been made for one of our identifiers. Such a report contains the identifier, the status (reported, confirmed, cancelled), the booking value and sometimes a booking number — no name. So we do not receive these details from you but from the network (Art. 14 GDPR).

With the Travelpayouts network (for example for Aviasales, Kiwi.com, QEEQ, Klook, Welcome Pickups, Airalo), we retrieve these reports ourselves from its statistics. For each booking, these are identifiers, status, booking value and booking time and, depending on the partner, route or place, travel day, number of travellers, airline and the point at which the booking was made. We do not query names, contact details or IP addresses there. If we refer you to Aviasales, we store the identifier that Aviasales gives this click alongside ours.

We enter the report on the trip with this identifier in your account, so that you can see the status on every device. If you were not signed in when you switched to the provider, the report waits until the trip comes into your account after you sign in; if no matching trip turns up within 180 days, we delete it. The legal basis for the display in your account is the user agreement (Art. 6(1)(b) GDPR), and for invoicing our referral our legitimate interest (point (f)).

If a booking does not carry any of our identifiers, but the partner, time (up to three days after your switch), route or place and travel day match your trip, we show it to you as a suggestion: “Was this you?”. We do not show the booking value. Only when you confirm does the booking belong to your trip; if you say “No”, we remember this so that the suggestion does not come back. We only show a suggestion that could fit several customers if the route or day confirms it.

Your search (route or place, date, number of travellers, class) is transmitted to our price sources so that they can supply offers — depending on the area, these are Aviasales (Travelpayouts), Kiwi.com, Duffel, QEEQ, DiscoverCars, CHECK24, Sunny Cars, Kiwitaxi, Airalo and, for hotels, Google’s hotel search (Google Ireland Limited, Ireland), which our server queries directly, and only as a fallback, if Google does not respond, SerpApi (SerpApi, LLC, USA); the destination, travel dates, number of adults and the ages of children travelling with you go there. These queries run via our server: the providers see neither your IP address nor anything else about you. The basis is our legitimate interest in offering a working search (Art. 6(1)(f) GDPR).

One exception: Aviasales. For the flight search via Aviasales (Travelpayouts network), we send your IP address along with your search. Travelpayouts requires it for every search and uses it to limit how often searches can be made from one address; without it, all our visitors would share a single quota, and the search would fail when traffic is heavy. We do not store the address for this. The basis is our legitimate interest in a flight search that works even with many visitors (Art. 6(1)(f) GDPR).

Hotel photos. The images in the accommodation search (from Google’s hotel search) and the providers’ logos are delivered via our own server. Your browser does not connect to Google for this, and Google learns neither your IP address nor which image you have seen.

The map in the hotel search. On a large screen, it is shown next to the list; on mobile, it appears when you tap “Map”. For this, your browser loads the MapLibre map library from unpkg.com and the map images from OpenFreeMap (tiles.openfreemap.org). Both services learn your IP address and which map section you are viewing, as with any retrieval of a file from the internet. No cookies are set for this, and we do not pass anything on to them. The basis is our legitimate interest in being able to show the location of the places to stay (Art. 6(1)(f) GDPR). The map loads the points for places to stay without a price from our own server; nothing goes to third parties in the process.

The flight search on the “Flights” page is a search module of our partner network Travelpayouts that runs in your browser. Your search, your IP address and your choice of language and currency go directly to servers of Travelpayouts and the services it uses (including apistp.com, tpembd.com, avsplow.com); the module also estimates your approximate location from the IP address in order to prefill the departure airport. We do not store any of this. Travelpayouts itself is responsible for this processing; its privacy policy applies. The basis on our side is our legitimate interest in a flight search with up-to-date prices (Art. 6(1)(f) GDPR). If you do not want this, use the flight search on the home page, which runs via our server.

Package holidays. We query destinations, hotels, dates and prices on the “Package holidays” page from CHECK24 (TARIFCHECK24 GmbH, CHECK24 partner programme). This also runs via our server: CHECK24 receives your search (departure airport, period, length of trip, number of travellers, the ages of children travelling with you, destination, hotel and the filters you set — never names), but neither your IP address nor anything else about you. If you type in the “Destination” field, what you type goes to CHECK24 by the same route as a search term from the second letter onwards, so that we can suggest suitable countries, regions, places and hotels; we answer identical search terms from a cache for up to one day. The “All countries” selection is held by us and does not query anyone. If you click on a hotel, the storage of this browser tab remembers its details (name, stars, location, rating, cheapest offer) so that the dates page can describe it; this is gone when you close the tab. CHECK24 provides the hotel images; our server fetches them from CHECK24’s image server. Where there are none, photos come from Wikimedia Commons and aerial images of the hotel’s location from official surveying agencies (which ones is stated in the image credits). All images come via our server — your browser does not connect to CHECK24, Wikimedia or an authority for them, and they learn nothing about you (authors and licences: Image credits). We answer identical searches for up to ten minutes from a cache in our server’s working memory, so that CHECK24 is not asked the same thing several times; no person can be identified from it. Only with “Go to booking” do you switch to CHECK24 — from then on, the next section applies. The basis is our legitimate interest in a working search (Art. 6(1)(f) GDPR).

You answer the questions of the compensation check on your device; we do not send the answers anywhere. If you look up the status of a flight there, on the home page or in “My trip”, the flight number, departure day and — from your account — the departure, connecting and destination airports go to our server. It looks up the flight data at FlightAware, or alternatively at FlightStats. These queries run via our server: neither of them learns your IP address or anything else about you.

For flights in your account, we query automatically once a day in the days after departure, so that the status is still available after the live data has ended. Only the status of the flight is kept — flight number, day, route, scheduled and actual times, cancellation or diversion — without reference to an account or a person, until the end of the third year after the flight. We answer identical queries from a cache for a few minutes. The basis for “My trip” is the user agreement (Art. 6(1)(b) GDPR), otherwise our legitimate interest in a working check (point (f)).

The app is a separate program on your iPhone, but it uses the same services and the same database as the website (section “Who works for us”). Everything stated here about the website applies to it, with these differences:

• Installation identifier. Every request from the app carries a random identifier of this installation as well as the version of the app and of iOS. We use this to slow down too many requests and to recognise outdated versions; we do not link the identifier to your name or address. If you delete the app, it is gone.
• Stored on the iPhone. Saved deals and places to stay (when signed in, also in your account, see “Saved items”), tracked flights (number and day), your recent searches and the search entries are only kept on the device; when you are signed in, also the most recently loaded version of your trips and packing lists, so that you can see them and tick items off without a connection. The sign-in is kept as a random key in the iOS keychain instead of in a cookie, together with the email address you signed in with: the app shows it in your account and fills it in for your next sign-in. If the sign-in expires, the version of your trips and packing lists and the address remain on the device until you sign in again; if a different address signs in, the app deletes them first. Signing out clears the version of your trips and packing lists and the address on the device; deleting your account also clears saved items, tracked flights, your searches and the set-up details, i.e. everything the app has stored on the iPhone, apart from the installation identifier. You can delete individual details or everything at any time under Account → Privacy, even without an account.
• Saved items. What you save in the app with the bookmark or the heart — flights, package holidays, car hire, places to stay and deals — is kept on the iPhone with the details listed above. If you are signed in, the app syncs it with your account: what is saved on the device, also before signing in, goes into the account, and what you save or remove on another device or on the website also appears or disappears here. For this, the app remembers the identifiers of the entries that were in the account at the last sync. Signing out leaves the saved items on the device; deleting your account and “Delete everything on this iPhone” clear them. If you delete them under Account → Privacy only on the iPhone, they remain in the account.
• “Did you book?” If you switch to a provider in the app, it remembers on the device for at most three hours where you went, so that it can ask you once when you return whether you booked. For a place to stay, this includes its name, its identifier, the address of its first photo, its location and the dates of your search; the app only keeps the price shown while it is running. If you answer “Yes”, we store the place to stay in your account — without an account, only once you then sign in. Once the question has been asked, the entry on the device is gone.
• Set-up on first launch. What you enter there, your home airports and who usually travels with you (number of adults, ages of children), is only kept on the device. The app uses it to prefill searches and to put deals from your airports first; this happens on the iPhone. The details only reach our server as part of a search you start, like any other search entry. The app does not request a location for this: it works out airports near you from the airport you have chosen. You can change or clear everything under Account → Settings.
• iPhone search (Spotlight). So that you can find the app via the iPhone’s search, it registers its areas there (such as “Search hotels”) and, if you are signed in, your upcoming trips with destination, travel days and flight number. iOS only keeps these entries on the device; we receive nothing as a result. Signing out and an expired sign-in remove the trips from there again. If you tap “Search in Nighthopper” in Spotlight, iOS passes your search term to the app, which uses it to open the destination search.
• Your travel year. The annual review in the app summarises what is already in your account (your trips and price alerts) and what is on your iPhone (how often and where you searched, saved items, tracked flights). Our server calculates the figures from your trips when you open it; nothing is stored for this, nothing is compared with others, and nothing goes to third parties. The app only counts how often you search and where on the device, per year and without dates or travellers; deleting your account also clears this. Something is only shared if you tap “Share travel year” — then exactly the sentence you see, without name, address or prices.
• Hotel preferences. What you state in the app as preferences for places to stay (such as who is travelling, your budget per night or what is a must, for example a pool or a wheelchair- accessible room) is only kept on the device. If the app offers “Best match”, it sends these details to our server with every hotel search; the server uses them to order the places to stay and explains what fits and what does not. They do not go to Google or to providers, and we do not store them anywhere — they only appear in our host’s logs as part of the address requested (see above, 30 days at most). You can change or delete them in the app at any time; deleting your account clears them as well.
• The app’s own counting. The app reports individual steps to our server: when you start a search for flights, places to stay, car hire or package holidays and whether it had results, stayed empty, failed or took too long; when you view, filter, sort or compare an offer or a deal, save something or store preferences; when you switch to a provider, set a price alert, sign in, allow or decline notifications and when you answer “Did you book?”. Only the name of the step is reported, and when you switch to a provider also the area of the app you came from (Search, Home, Discover or My trip). From this, we count daily totals (day, step, number) and store neither the installation identifier nor your IP address nor what you searched for, which filters you chose or which prices you saw. No one can be traced from the totals. No third-party service is involved. The basis is our legitimate interest in understanding which parts of the app are used and where the search gets stuck (Art. 6(1)(f) GDPR).
• Sign-ins. In the list of your sign-ins, “Nighthopper app on iOS” with the version appears instead of the browser.
• Compensation check. The app calculates on the device; your answers do not leave it. If you open the check from the flight status, it takes over the airports, day and delay from the flight query. If you tap the button to the partner, our server only learns that you switched.
• Switching to CHECK24. Instead of the redirect page, the app loads the tracking pixel from a.check24.net (section on partners, “A special case: CHECK24”) at the moment it opens Safari with the offer. The same details go there as on the website, and the app does not store anything in the process.
• Pasting a booking confirmation. As on the website (section “Pasting a booking confirmation”).

The app only sends notifications (push) if you switch them on under Account → Notifications and iOS allows it. You can choose price alerts, news about your trips (the provider reports, confirms or cancels a booking), a reminder before departure (the day before, three days or a week before) — these three only with an account — and live deals, at most once a day or once a week, as you set it.

For this, we store the device token that Apple gives the app, whether it comes from a test version or the store version, the installation identifier, your choice and settings, when you switched on live deals and when the last deal arrived, when signed in the link to your account and — so that nothing arrives twice — which reminder and which deal have already been sent.

Notifications are delivered via Apple’s push service (Apple Push Notification service). Apple receives the device token and the text of the notification for this: for price alerts the route and price, for trips the destination and booking status, for deals the route, price and day — never your name, your address or a booking number. Apple is based in the USA; access from there cannot be ruled out.

The legal basis for price alerts, trips and the reminder is the user agreement for your account (Art. 6(1)(b) GDPR), and for live deals your consent (Art. 6(1)(a) GDPR); it applies independently of the deal email. You switch each type off on the Notifications page, or all of them in the iOS settings; the withdrawal applies to the future. If you switch everything off, we delete the token and your choice. All devices linked to the account go with it; if Apple reports a token as invalid, we delete it as well.

If you click on an offer, you leave Nighthopper and arrive at the provider concerned. In the process, a random identifier is passed on with which this provider can attribute a booking, another transaction or a confirmed enquiry (lead) to our recommendation; this is how our commission arises. It contains nothing about you as a person. From the click onwards, the provider’s privacy policy applies. The provider decides for itself which data it collects.

Where the click itself counts: Urlaubspiraten. For links to Urlaubspiraten, the partner network Awin (AWIN AG, Berlin) does not pay us for a booking but for your click. The link therefore first leads to awin1.com: Awin counts the click there, sets a cookie according to its own rules and forwards you. This only happens when you click yourself; before that, our site loads nothing from Awin and stores nothing on your device. Awin is responsible for the processing on awin1.com; its privacy policy applies.

Sunny Cars via Awin. If you choose a car hire offer from Sunny Cars, the link also first leads to awin1.com. Awin counts the click there, sets a cookie according to its own rules and forwards you to Sunny Cars. If you book there, Awin attributes the booking to our recommendation, and we receive a commission for it. With the click, our random identifier for this switch goes to Awin, nothing about you as a person. Here too, our site loads nothing from Awin or Sunny Cars before your click. Awin is responsible for the processing on awin1.com and, from the switch to Sunny Cars, Sunny Cars; their privacy policies apply.

Booking.com via CJ. Links to Booking.com first go via an address of the partner network CJ (Commission Junction), such as tkqlhce.com. CJ counts the click there, sets a cookie according to its own rules and forwards you to Booking.com. The address only contains the identifier of our partner account and the search you entered with us (place, travel dates, number of guests, ages of children, rooms), no details about you. This only happens when you click yourself; before that, our site loads nothing from CJ or Booking.com. CJ is responsible for the processing at CJ; its privacy policy applies.

A special case: CHECK24. If you go to a car hire or package holiday offer from CHECK24, the redirect page loads an invisible tracking pixel from a.check24.net. In the process, your IP address and the identifier of our partner account go there — in the same second in which you are forwarded to CHECK24 anyway. Nothing is stored on your device or read from it; the response does not set a cookie. The request serves solely to allow CHECK24 to attribute our referred click to the booking. The basis is our legitimate interest in traceable invoicing (Art. 6(1)(f) GDPR). This does not happen with any other partner.

If you came to us today via one of our Google ads, the address to CHECK24 for package holidays contains the identifier “pauschalreisen-gads” instead of “pauschalreisen”. This lets us see in our partner account whether a booking came about through the ad. We recognise where you came from for this, as when attributing your clicks, using the identifier that changes daily; only this one word goes to CHECK24, nothing about you as a person.

• Logs when you visit the site: 30 days at most.
• Audience measurement: the daily identifier two days; the anonymous row (hour, page, origin, region, device class, campaign) and the daily total per place 180 days.
• Your choice in the consent banner: six months. Google Analytics: event data 14 months at most, cookies as under “Google Analytics and Google Ads”.
• Account: until you delete it.
• Trips: until you delete them or the account, at most until the end of the third year after the trip — that is how long compensation can generally be claimed in Germany. An account holds up to 50 trips; when it is full, past entries and old entries that were not booked make way first.
• Packing list: until you delete the account; a trip’s list as soon as you delete the trip. If a trip disappears from the account in another way (when it is full), its list goes a good day later (the clean-up runs daily, so after two days at the latest).
• Price alerts: until you delete them or unsubscribe, at most until after the departure day (for a month: until after its last day); with the account, immediately.
• Deal email: until you delete the account; after unsubscribing, only the note of consent and withdrawal.
• Review invitation from Trustpilot: until you delete the account; after withdrawal or sending, only the note of consent, withdrawal and sending.
• App notifications: device token and your choice until you switch off all notifications, delete the account or Apple reports the token as invalid; the note of a reminder sent 30 days, of a deal sent 60 days.
• Sign-ins: 30 days from signing in, immediately when you sign out.
• Requests for a code: 24 hours.
• Reports from the partner networks: with your trip, for as long as it exists; without a matching trip 180 days. This also applies to retrieved bookings, suggestions and your answers to them; we delete the identifier that Aviasales gives a click after 90 days.
• Proof of an account deletion (date, shortened address): 180 days.
• Database backups: six hours.
• Emails to us and messages via the contact form: until the matter has been dealt with, three years at most.

The controller is based in Georgia. There is no adequacy decision of the European Commission for Georgia. The operation of the site and the database, on the other hand, are located in the European Union (Frankfurt am Main); on the US companies behind them, see “Who works for us”.

We limit this processing to what is necessary: without an account, nothing about you leaves your browser apart from the technical details when you visit a page, your search and the click to a provider; we store none of this with reference to you. The account data remains in Frankfurt am Main; we access it from Georgia only to operate the service and to answer your enquiries.

You have the right of access, rectification, erasure, restriction of processing and data portability, and the right to object to processing based on a legitimate interest. For your account, you handle access and deletion yourself in “My trip” (download data, delete account). Otherwise, an informal message to the address given above is enough; we reply within one month — for an account, to that account’s address, so that no one can request someone else’s data.

You can also complain to a data protection supervisory authority — as a rule, the authority where you live or the authority at the seat of our EU representative.