Privacy Policy

Overview

Tokyo Stay & Fly helps travelers compare Tokyo hotels and reference flight fares. This policy describes what information we process when you use our website. We do not sell your personal information and we do not build advertising profiles about you.

We do not offer user accounts. Most browsing data stays in aggregate analytics or in operational caches that are not linked to a named individual.

Information we do not collect

• We do not require an account, password, or sign-in.
• We do not ask for your name, email address, phone number, or payment details on this site.
• We do not store your full IP address in our affiliate click database (see below).
• We do not use cross-site advertising cookies or sell personal information to data brokers.

Information stored on your device

We store small amounts of data in your browser on that device only. We do not sync this data to our servers.

• Favorites (localStorage) — hotel identifiers, names, addresses, ratings, image URLs, and cached summary text you save with the heart icon (up to 60 hotels)
• Recent areas (localStorage) — up to six Tokyo area names you recently selected on the home page
• Cache version marker (sessionStorage) — a short internal version string so the app can invalidate stale in-memory hotel results after we update ranking logic (cleared when you close the tab)

You can remove Favorites and Recent areas by clearing site data for this website in your browser settings.

Analytics (Vercel Analytics)

We use Vercel Analytics to understand aggregate traffic and product usage. Our custom events are designed to be cookieless and avoid personally identifiable information (for example, we do not send names, emails, or raw place IDs to analytics).

Examples of custom events include:

• Area and tier selection on the home or explore pages
• Hotel compare button clicks (provider, area, page surface, rank)
• Flight route changes and outbound flight partner link clicks
• Favorites added or removed (area and page surface only — not hotel names)

Vercel may process standard web analytics signals (such as page views and coarse device information) according to its own privacy practices. See Vercel's Privacy Policy.

Affiliate and outbound click measurement

When you click a hotel comparison button (Booking.com, Agoda, or Trip.com), the link goes through our server (/api/affiliate) before redirecting you to the partner site. For normal browser requests, we may record a click-out event in our database to measure link quality and site health. Automated bot traffic is excluded from this database.

Flight partner links (for example Skyscanner, Kayak, or Aviasales) open the partner site directly in a new tab. We do not store those flight clicks in our affiliate click database. Aggregate flight link usage may still appear in Vercel Analytics custom events (see above).

Fields we may store server-side for hotel compare click-outs include:

• Timestamp
• Provider (for example, booking, agoda, trip)
• Whether the link was a verified property URL or a search fallback
• Google Places identifier (place_id) when available
• Tokyo area name and page surface (home or explore), when available
• Approximate country code from hosting headers (not a full IP address)
• Referring site hostname, when available
• Whether the request looked like a normal browser or an automated bot

We do not use this data to identify you personally. Events are stored in Supabase (affiliate_click_events) with service-role access only and are not exposed to other visitors.

Retention: we keep click-out events to monitor link health over time. If the table grows very large (hundreds of thousands of rows), we may delete events older than about one year.

Other server-side data (not linked to your account)

To run the product, we also store operational data that is not tied to a user profile or login:

• Hotel summary cache (Supabase) — AI-generated pros/cons, hotel name, area, Google place_id, and a hash of review text used to generate the summary. Retained while the summary remains valid for the current prompt version.
• OTA link cache (Supabase) — verified Booking.com, Agoda, and Trip.com property URLs keyed by Google place_id. Updated by batch jobs, not by visitor identity.
• OTA discovery queue (Supabase) — when a compare click uses a search fallback for Agoda or Trip.com, we may queue the hotel name, area, and place_id so a background job can try to find a better property URL later. This reflects product demand, not a user account.
• Flight fare snapshots (Upstash Redis in production; local file in development) — aggregate reference fares for fixed routes, refreshed on a schedule. No visitor identifiers are stored in these snapshots.

Data processed transiently when you use the site

When you search or view hotels, our servers may call third-party APIs using server-side credentials. We use the responses to show rankings, photos, and summaries. We do not persist your individual search history on our servers.

• Google Places API — hotel listings, photos, and public review excerpts for the area and filters you request
• Google Gemini API — hotel name, area, and truncated public review excerpts to generate optional card summaries (results may be cached as described above)
• Geo suggestion for flights — our host may provide an approximate country code (for example via x-vercel-ip-country) to suggest a default departure city. We do not store this as a persistent user profile; it may appear once in an affiliate click-out row if you use hotel compare.

Google's privacy practices apply to data processed by Google services. See Google's Privacy Policy.

Third-party services

To operate the site, we use server-side APIs and infrastructure, including:

• Google Places API — hotel listings, photos, and review excerpts
• Google Gemini API — optional AI-generated hotel summaries shown on cards
• Travelpayouts — reference flight fare snapshots (not live booking on this site)
• Vercel — hosting, edge routing, and analytics
• Supabase — OTA link cache, AI hotel summary cache, and hotel compare click-out events
• Upstash Redis — cached reference flight fare snapshots (production)
• SerpAPI — batch discovery of OTA property URLs (server-side; not used when you click Compare)
• Slack (optional) — aggregate anomaly alerts about affiliate click volume; no visitor names or emails are sent

When you leave Tokyo Stay & Flyvia an outbound link, the destination site's privacy policy and terms apply.

Security

API keys and database credentials are kept server-side and are not exposed to browsers. Supabase tables that hold click-out events and caches use row-level security with access limited to our backend service role. Affiliate redirect responses use Referrer-Policy: no-referrer when sending you to partner sites.

International data processing

Our service providers (for example Vercel, Google, and Supabase) may process data in the United States and other countries where they operate. By using the site, you understand that information may be transferred to jurisdictions that may have different data protection rules than your own.

Your choices and privacy requests

• Device data — clear site data in your browser to remove Favorites and Recent areas.
• Analytics — we do not use an on-site consent banner because our custom analytics are designed to be cookieless and non-identifying; you can use browser privacy tools or blockers if you prefer.
• Server-side events — because we do not use accounts, we usually cannot identify which click-out rows belong to a specific person without additional information you provide (for example approximate time and action). If privacy law in your region gives you rights to access or delete personal data, contact us and we will respond reasonably.

Children

Tokyo Stay & Fly is not directed at children under 16, and we do not knowingly collect personal information from children.

Changes

We may update this policy as the product evolves. The "Last updated" date at the top of this page reflects the latest revision.

Contact

For privacy questions, please contact the site operator. A contact email will be listed here once available.