Boarding Pass · Android
Boarding Pass is a flight log that runs entirely on your phone. There is no account to create, no server that belongs to us, and nothing is collected about you. This page explains exactly what the app reads, what it keeps, and the one optional feature that sends anything anywhere.
We operate no servers and receive none of your data. Your flights, your Gmail access token and everything derived from them stay in the app's private storage on your device. No analytics, no crash reporting, no advertising, no tracking, no third party receives your information.
One exception, and it is off by default. If you turn on Read mail with AI in Settings and supply your own API key, parts of matching emails are sent to a model provider you choose. Nothing else in the app does that. Details are in Optional: reading mail with AI.
Boarding Pass is an independent personal project, not a product of any employer or organisation. Questions about this policy or about your data go to alanrimfoi@gmail.com.
Everything below is written to the app's own private storage on your device. It is not backed up to us, synchronised, or transmitted anywhere.
| What | Why | How it is stored |
|---|---|---|
| Flight records | The log itself, and every statistic drawn from it | Local database. Includes airline, flight number, date, route, times, cabin, seat, aircraft, booking reference, the passenger name printed on the ticket, and the raw barcode text where a pass was scanned. |
| Your own names | To tell your tickets apart from someone else's forwarded itinerary | Local app settings. |
| Gmail access and refresh tokens | To read matching email without asking you to sign in repeatedly | Encrypted with a key held in the Android Keystore — hardware-backed on devices that support it — so the stored value is useless off the device. |
| Model provider API key | Only if you enable the optional AI feature | Encrypted the same way, separately per provider. Never displayed again after you save it, and never written to a log. |
| Which messages have been examined | So repeat syncs are fast and do not re-read the same mail | Local database. Message identifiers only, not message contents. |
If you connect Gmail, the app requests a single scope,
gmail.readonly. It is read-only: the app cannot send, delete,
label or modify anything in your mailbox.
It does not read your mailbox in general. It runs a fixed set of searches for airline and travel-agency mail — booking confirmations, e-tickets, itineraries, boarding passes — and downloads only messages that match one of them, excluding spam, trash, promotions and forum mail. Those are parsed on your device. Where a message has the itinerary in an attached PDF, the PDF is rendered and read on your device too.
What is kept from a message is the flight it describes, plus the message's identifier so it is not examined twice. The body is not retained.
Boarding Pass's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically: data obtained through Gmail is used only to provide and improve the flight-logging features you can see in the app; it is not transferred to anyone except as you direct through the optional feature described below; it is not used for advertising; and no human reads it except where you explicitly choose to share it.
Scanning a boarding pass uses the camera to read the barcode. Frames are analysed in memory by an on-device library and discarded immediately — no photograph is saved, and no image leaves the device. The same is true of a pass you pick from your photo library: it is read and released, not copied into the app.
What is kept is the decoded barcode text, which typically contains your name, the flight and the booking reference. That is the flight record, and it stays on the device with the rest of them.
Pattern matching is good at finding a flight and bad at judging one — a fare alert and a confirmation look alike. The app can instead have a language model read each matching message. This is off unless you both switch it on and supply your own API key.
With it on, for each matching message the app sends:
Nothing else goes with it: no account, no other messages, no history. You hold the relationship with the provider and pay them directly. The app offers three choices, and the list in Settings is ordered by what happens to your mail rather than by price:
| Choice | Where the mail goes |
|---|---|
| A model on your own machine | Your own computer, over your own network. Nothing reaches a company at all. |
| Groq | Groq. Their terms state customer inputs are not used to train models — privacy policy. |
| OpenRouter | OpenRouter, which forwards to other companies. Whether your mail is retained or trained on is the downstream provider's policy, and is affected by your own Zero Data Retention setting — privacy policy. |
Once a message leaves the app, the receiving provider's privacy policy governs it, not this one. Please read theirs before enabling this. Whatever the model returns is checked against the app's own airport and airline data before any flight is saved.
Turning the feature off stops it immediately. Removing the key deletes it from the device.
Because we hold nothing, there is nothing for us to delete on your behalf and no request you need to send us to do it.
The app is not directed at children and collects nothing from anyone, including children.
If the app's handling of data changes, this page changes with it and the effective date above is updated. The version history is public in the project's repository.