Our Somewhere Privacy Notice.

Our Somewhere is an independent beta travel-planning service. The person or organisation that determines how personal data is used is the data controller.

Controller: Kyeongmin Lee, an individual operating Our Somewhere
Location: Riyadh, Saudi Arabia
Privacy contact: use the private form linked at the end of this notice.

The service helps two travellers identify cities they can each reach by nonstop flight. It does not make bookings, take payments or provide immigration advice.

• You can use the search without creating an account.
• Optional PostHog analytics stay off unless you allow them.
• Declining analytics does not reduce search functionality.
• Search information is sent to the providers needed to return routes, fares and destination information.
• Our Somewhere does not sell personal information or use it for cross-context behavioural advertising.
• Bookings and payments happen on third-party websites under their own terms.

Our Somewhere does not ask for account passwords, home addresses, payment information or passport numbers. Passport-country selections used to open visa-planning resources are not stored by Our Somewhere.

These are local-storage items rather than advertising cookies. You can remove them through your browser’s website-data controls. Clearing them resets your shortlist, tutorial and privacy preferences.

Optional PostHog analytics are disabled until you select “Allow optional analytics.” If you continue without analytics, the site does not create the analytics identifier, send browser analytics events or send live-provider analytics events to PostHog.

You can change your decision at any time with the “Privacy choices” control. Declining later stops new collection and removes the browser’s random analytics identifier. It does not automatically erase analytics already received; you can request deletion as explained below.

The privacy-choice record is necessary to remember your decision. Shortlist and tutorial storage support features you request and are not used for advertising.

Our Somewhere does not set advertising cookies. Cloudflare may set strictly necessary cookies such as __cf_bm to distinguish legitimate traffic, manage bots and protect the service. These security technologies are not controlled by the analytics choice because they are needed to deliver and defend the website.

Cloudflare controls their exact duration and operation. Read Cloudflare’s cookie information ↗.

When allowed, Our Somewhere sends a restricted set of events through its own /api/analytics endpoint to PostHog’s United States ingestion region at https://us.i.posthog.com. The private dashboard is used to understand whether the beta works and where searches fail.

Possible events include a visit; search completion or failure; destination opening; live-ticket check; currency or filter change; shortlist, comparison and sharing actions; outbound booking-link clicks; a browser-error category; and live-provider request outcome, cache status, request count and estimated provider cost.

Event details are limited to relevant airport codes, month, trip-length category, currency, counts, general outcomes, selected filter, device category, link provider, affiliate marker and sharing method. String values are allowlisted and limited in length.

PostHog autocapture, session recording, screenshots, person profiles and GeoIP enrichment are disabled. Names, email addresses, payment details, precise location, passport information, page contents, full URLs, browser error text and stack traces are excluded.

Retention: Our Somewhere’s policy is to retain PostHog product-analytics events for no longer than 12 months. The operator reviews and deletes older analytics if automated retention is not available under the account’s current settings. Read PostHog’s privacy information ↗.

Route searches may send departure-airport codes and the travel month to AeroDataBox. Live-ticket checks send airports, dates, one-adult passenger count and currency to SerpApi, which retrieves Google Flights results. Destination requests may send destination coordinates, code, city and month to Ticketmaster, Wikimedia, Wikivoyage or OpenStreetMap services.

Route and flight responses are cached to control provider costs and improve reliability. Live-flight cache entries are used as fresh results for six hours; expired cache records are removed by routine request-time cleanup. Route cache duration is normally 24 hours and is shown separately from the source data’s own date.

To enforce ticket-search limits, Our Somewhere transforms the request IP address with a secret value using SHA-256 and stores only the shortened result with day and month fields. Provider-usage records older than 35 days are removed by routine request-time cleanup. Hosting and network providers may still process the original IP address in their own security logs.

The site records limited first-party beta events for completed or failed searches, problem-report clicks and flagged results. Records can contain the airport pair, travel month, trip-length category, destination, candidate counts, windows checked and a bounded diagnostic message. Records older than 90 days are removed by routine request-time cleanup.

“Report a problem” opens a Google Form. Information you voluntarily submit there—including an email address, description or screenshot—is processed by Google and used to investigate the issue, reply and improve the service. Please do not include passport numbers, payment details or other sensitive information.

• Cloudflare and OpenAI Sites: hosting, delivery, database storage and security.
• AeroDataBox: published nonstop route candidates.
• SerpApi and Google Flights: live flight availability, prices and booking-result links.
• PostHog: optional product analytics after consent.
• Google Forms: voluntary feedback and privacy requests.
• Ticketmaster, Wikimedia, Wikivoyage and OpenStreetMap services: destination information and events.
• Travelpayouts and Kiwi.com: affiliate handoff after you select an eligible link.

Providers process information under their own contracts and privacy terms. Our Somewhere may also disclose information when required by law, to protect people or the service, or as part of a lawful business reorganisation with appropriate safeguards.

Some Kiwi.com links are affiliate links supplied through Travelpayouts. They contain a route-specific referral marker. If you follow one and make an eligible booking, Our Somewhere may earn a commission at no extra cost to you. Affiliate eligibility does not affect destination ranking.

After you leave Our Somewhere, Travelpayouts, Kiwi.com, airlines, booking sites and other external services may receive the destination URL, referral information, your IP address, browser or device information and timestamp. They may set their own cookies and control any account, booking and payment data you provide.

Our Somewhere does not receive your card details. Read the Travelpayouts Privacy Policy ↗ and Kiwi.com Privacy Policy ↗.

Share links can contain departure-airport codes, destination codes, month, trip length, currency and shortlisted destinations. Anyone who receives the link may see those selections. Do not share a link if those travel plans are confidential.

If you use the device’s native sharing function, your browser, operating system and chosen messaging service handle the recipients and message under their own privacy terms. Our Somewhere does not receive your address book.

• Providing the service you request: processing search choices and contacting route, fare and destination providers.
• Legitimate interests: security, abuse prevention, cost controls, caching and limited beta diagnostics, balanced against the pseudonymous and restricted nature of the records.
• Consent: optional PostHog analytics and information you voluntarily provide in a feedback form, where consent is the applicable basis.
• Legal obligations: records or disclosures required by applicable law.

The precise legal basis can vary by country. Where local law requires consent for a use described as a legitimate interest, Our Somewhere will seek consent or not perform that use.

Our Somewhere and its providers may process information outside your country, including in the United States. This includes PostHog’s US ingestion region and global hosting, security, search and feedback infrastructure.

The controller operates from Saudi Arabia. Where applicable law requires a transfer mechanism or assessment, the controller will rely on the relevant provider contract and safeguards or stop the affected transfer. Further information about a particular provider transfer is available through the privacy contact form.

• Ticket and route provider-usage records: up to 35 days, subject to routine request-time cleanup.
• First-party beta diagnostic events: up to 90 days, subject to routine request-time cleanup.
• Live-flight and route cache records: for their operational cache period, with expired records removed through routine cleanup.
• Browser preferences: until you change them or clear this website’s stored data.
• PostHog product-analytics events: no longer than 12 months.
• Google Form submissions: deleted within 90 days after the relevant issue or request is resolved, unless a legal obligation requires longer retention.
• Security logs held by infrastructure providers: according to the provider’s documented retention and the controller’s contract.

Information may be kept longer when necessary for a legal claim, security investigation or legal obligation, then deleted or anonymised when no longer required.

Depending on where you live, you may have rights to be informed; access personal data; receive a readable copy; correct, delete or restrict it; object to processing; withdraw consent; and complain to a privacy authority. You will not be discriminated against for exercising a privacy right.

Use the private form below to make a request. State that it is a privacy request and provide enough information to locate the relevant record. Do not send identity documents unless requested through a secure method. Our Somewhere may need to verify a request and may retain limited evidence that it was handled. The controller aims to respond within 30 calendar days, or sooner when applicable law requires it.

Because analytics uses a random identifier rather than an account, include the current identifier from your browser if you request access or deletion of analytics. When analytics are allowed, open “Privacy choices” and select “Copy my analytics reference.” If the record cannot reasonably be linked to you, the request may be limited.

You may complain to the Saudi Data & AI Authority ↗ where the Saudi Personal Data Protection Law applies, or to the privacy regulator in your country. You may also contact the controller first so the issue can be investigated.

Our Somewhere is a general travel-planning tool and is not directed to children. It does not knowingly collect personal information from a child who cannot validly consent under applicable law. A parent or guardian who believes a child submitted personal information may request its deletion.

Our Somewhere limits analytics fields, keeps provider credentials on the server, uses encrypted HTTPS connections and relies on access controls and provider security measures. No online service can guarantee absolute security.

If a personal-data breach creates a legally reportable risk, the controller will notify the appropriate authority and affected people as required by applicable law.

This notice will change when the service, providers or legal requirements change. The date at the top identifies the latest version. A prominent notice or renewed consent will be used when a change materially affects a consented use.