Boarding Pass · Android
Boarding Pass is a flight log that runs entirely on your phone. There is no account to create, no server that belongs to us, and nothing is collected about you. This page explains exactly what the app reads, what it keeps, and the one optional feature that sends anything anywhere.
We operate no servers and receive none of your data. Your flights, your Gmail access token and everything derived from them stay in the app's private storage on your device. No analytics, no crash reporting, no advertising, no tracking, no third party receives your information.
One exception, and it is off by default. If you turn on Read mail with AI in Settings and supply your own API key, parts of matching emails are sent to a model provider you choose. Nothing else in the app does that. Details are in Optional: reading mail with AI.
Boarding Pass is an independent personal project, not a product of any employer or organisation. Questions about this policy or about your data go to alanrimfoi@gmail.com.
Everything below is written to the app's own private storage on your device. It is not backed up to us, synchronised, or transmitted anywhere.
| What | Why | How it is stored |
|---|---|---|
| Flight records | The log itself, and every statistic drawn from it | Local database. Includes airline, flight number, date, route, times, cabin, seat, aircraft, booking reference, the passenger name printed on the ticket, and the raw barcode text where a pass was scanned. |
| Your own names | To tell your tickets apart from someone else's forwarded itinerary | Local app settings. |
| Gmail access and refresh tokens | To read matching email without asking you to sign in repeatedly | Encrypted with a key held in the Android Keystore — hardware-backed on devices that support it — so the stored value is useless off the device. |
| Model provider API key | Only if you enable the optional AI feature | Encrypted the same way, separately per provider. Never displayed again after you save it, and never written to a log. |
| Which messages have been examined | So repeat syncs are fast and do not re-read the same mail | Local database. Message identifiers only, not message contents. |
| Places you have been | Only if you scan your photos or import a Timeline export. Builds the record of countries and towns you have been to, including the ones you never flew to | Local database. A dated coordinate per place, with the country and nearest town worked out on the device. This is the most sensitive thing the app holds, and section Places, and why the detail is thrown away explains what is kept and what is discarded. |
| Which years have been scanned | So an interrupted scan resumes instead of starting over | Local database. A year and a resume point, no locations. |
If you connect Gmail, the app requests a single scope,
gmail.readonly. It is read-only: the app cannot send, delete,
label or modify anything in your mailbox.
It does not read your mailbox in general. It runs a fixed set of searches for airline and travel-agency mail — booking confirmations, e-tickets, itineraries, boarding passes — and downloads only messages that match one of them, excluding spam, trash, promotions and forum mail. Those are parsed on your device. Where a message has the itinerary in an attached PDF, the PDF is rendered and read on your device too.
What is kept from a message is the flight it describes, plus the message's identifier so it is not examined twice. The body is not retained.
Boarding Pass's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically: data obtained through Gmail is used only to provide and improve the flight-logging features you can see in the app; it is not transferred to anyone except as you direct through the optional feature described below; it is not used for advertising; and no human reads it except where you explicitly choose to share it.
Scanning a boarding pass uses the camera to read the barcode. Frames are analysed in memory by an on-device library and discarded immediately — no photograph is saved, and no image leaves the device. The same is true of a pass you pick from your photo library: it is read and released, not copied into the app.
What is kept is the decoded barcode text, which typically contains your name, the flight and the booking reference. That is the flight record, and it stays on the device with the rest of them.
Pattern matching is good at finding a flight and bad at judging one — a fare alert and a confirmation look alike. The app can instead have a language model read each matching message. This is off unless you both switch it on and supply your own API key.
With it on, for each matching message the app sends:
Nothing else goes with it: no account, no other messages, no history. You hold the relationship with the provider and pay them directly. The app offers three choices, and the list in Settings is ordered by what happens to your mail rather than by price:
| Choice | Where the mail goes |
|---|---|
| A model on your own machine | Your own computer, over your own network. Nothing reaches a company at all. |
| Groq | Groq. Their terms state customer inputs are not used to train models — privacy policy. |
| OpenRouter | OpenRouter, which forwards to other companies. Whether your mail is retained or trained on is the downstream provider's policy, and is affected by your own Zero Data Retention setting — privacy policy. |
Once a message leaves the app, the receiving provider's privacy policy governs it, not this one. Please read theirs before enabling this. Whatever the model returns is checked against the app's own airport and airline data before any flight is saved.
Turning the feature off stops it immediately. Removing the key deletes it from the device.
Because we hold nothing, there is nothing for us to delete on your behalf and no request you need to send us to do it.
The app can build a second history alongside your flights: the countries and towns you have actually been to. It is off until you start it, and there are two ways to feed it, both optional and both entirely on the device.
With your permission, the app reads the location tag inside photos already on your phone. Each photo is opened, its coordinate and date read, and closed again. No image is copied, moved, or sent anywhere. You choose which years to scan, and on newer Android versions you can share only selected photos rather than the whole library.
If you have Timeline switched on, Google can export everywhere your phone has been as a single file, which you can then pick from your files. The app reads it once, in place. The file is never copied and nothing is uploaded. Choosing the file is the only way this happens; the app has no access to your Google Location History and never asks for any.
A Timeline knows where you were every few minutes. The app does not keep that. As the file is read, it keeps at most one point per day for each area of roughly 11 km and throws the rest away before anything is written. A day spent moving around one city becomes a point or two; a day spent crossing a country keeps enough to show the crossing.
The newer exports also contain a raw stream of every GPS and wifi fix your phone recorded. That part is skipped entirely.
This is deliberate. Answering "which country, which town, on which day" does not need a minute-by-minute account of your life, and the app should not hold one it has no use for.
Coordinates that resolve to no country — mid-ocean, or a bad tag — are not stored at all. Countries and towns are worked out on the phone from data bundled in the app, with no network call at any point; the datasets behind that are listed on the data and licences page.
Everything here is deleted along with the rest of your data by Delete all data in Settings.
The app is not directed at children and collects nothing from anyone, including children.
If the app's handling of data changes, this page changes with it and the effective date above is updated. The version history is public in the project's repository.
The app carries its own airport, airline, boundary and gazetteer data so that it works offline. None of it is about you and none of it leaves the device, but where it came from and the licences it is offered under are set out on the data and licences page.