Skip to main content

Trust & Security

Trust and Security at SkyThru

At SkyThru (skythru.com) the trust of travelers and commercial partners is foundational to our business. This page describes the technical and operational controls currently in place to protect user data, preserve the integrity of search results, and describe how we work with travel partners and affiliate networks when those relationships are enabled. The content is maintained by the SkyThru team and is updated as the product evolves; it is not a third-party certification.

Access and identity

  • Sign-in with a one-time code sent to your email (OTP); the website also offers Google sign-in. We do not store passwords on our servers.
  • Each user has an isolated profile; no account can read another account's data.
  • Administrative privileges are stored in a dedicated roles table and verified server-side via security-definer functions.
  • Admin sessions are protected by an additional auth gate and logged for audit purposes.

Data we collect

  • Account data voluntarily provided by the user (name, email, avatar).
  • Search parameters (destinations, dates, traveler count) used to produce accurate results.
  • Anonymized technical data (device, browser, partner-link click events) used for performance analytics.
  • Error logs to improve reliability. We never collect card numbers or banking credentials.

Data protection and infrastructure

  • All traffic between the user and the platform is encrypted using modern TLS/HTTPS certificates.
  • The database enforces row-level security (RLS) policies that prevent cross-account access.
  • Commercial partner keys and identifiers are stored in server-side secret vaults and are never exposed to the browser.
  • Backup and recovery capabilities depend on our cloud infrastructure provider’s configuration and are not independently certified on this page.

Cookies and analytics

We use browser local storage to remember language and session, and lightweight first-party analytics events to improve search quality. No affiliate or referral-tracking scripts are loaded: SkyThru holds no account with any affiliate network. We do not sell users’ personal data to any party.

Our relationship with travel partners

SkyThru is a metasearch and comparison engine only; we are not a travel agency and we do not complete bookings ourselves. When a user selects an offer they are redirected to the seller's official site, where booking and payment are completed under that seller's terms. SkyThru currently has no commercial partnership or commission agreement with any seller or network; a seller's name in search results does not mean a partnership with it.

Privacy requests and account deletion

To request a copy of your data, delete your account, or raise any privacy question, please contact the privacy team at hello@skythru.invalid . We respond within 7 business days.

Responsible vulnerability disclosure

We welcome responsible disclosure of security vulnerabilities. Please do not publish details publicly and contact our security team at hello@skythru.invalid . All reports are handled in strict confidence.