Privacy Policy

Introduction

This Privacy Policy describes how Outdoor Hub LLC ("we," "us," or "our") collects, uses, and protects information through the AeroStack mobile application and website (collectively, the "Service").

By using AeroStack, you agree to the practices described in this policy. If you do not agree, please do not use the Service.

This policy is designed to comply with applicable United States privacy laws, including the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), the California Automatic Renewal Law (ARL), Apple App Store Review Guidelines (including the November 2025 AI disclosure requirements under Guideline 5.1.2(i)), and Plaid's end-user privacy requirements.

Information We Collect

How We Collect It

Directly from you

When you create an account, add credit cards, enter point balances, set preferences, or contact support — you provide this data directly.

Automatically

When you use the app, we automatically receive device information, usage patterns, crash reports, and technical diagnostics necessary for security and performance.

Via Plaid (with your explicit consent)

If you choose to connect a bank account, Plaid collects your bank account data on our behalf. You initiate this connection through Plaid Link inside the app. AeroStack never sees your bank username or password — Plaid handles that exchange directly and securely.

Via RevenueCat

RevenueCat processes your subscription purchases through Apple and reports your subscription status and entitlement level to AeroStack. We receive status only — never your payment card details.

Via AI providers (with your explicit consent)

When you use AI Chat, your messages and relevant card context are transmitted to your chosen AI provider (Anthropic, OpenAI, or Google). You provide explicit consent before first use, and you can withdraw it at any time in Settings.

Third-Party Services

AeroStack integrates with the following third-party services. Each has its own privacy policy governing how it handles data it receives.

AI Data Disclosure

AeroStack uses third-party AI services to power the AI Travel Concierge feature. This section provides the explicit disclosure required by Apple App Store Review Guideline 5.1.2(i) (effective November 2025).

Consent

Before your first use of AI Chat, you will be shown a consent screen that identifies each AI provider and explains what data will be sent. You must explicitly accept before AI Chat activates.

What is sent to AI providers

• Your chat messages and questions
• Relevant card portfolio context (point balances, benefit summaries) to enable personalized responses
• Your selected AI provider receives only what is needed to answer your query

What is never sent to AI providers

Storage

AeroStack does not store your AI conversation history after your session ends. Each session is independent. AI providers may retain messages per their own policies — review each provider's privacy policy linked in Section 4.

Your controls

• Change your AI provider at any time in Settings → AI Provider
• Disable AI Chat entirely in Settings
• Withdraw consent and reset AI data in Settings → Privacy → Reset AI Consent

How We Use Your Data

We use the data we collect solely for the following purposes:

App Functionality

• Authenticating your account and keeping it secure
• Displaying your card portfolio, point balances, and benefit tracking
• Powering award flight search, lounge finder, and travel recommendations
• Personalizing AI concierge responses with your card context

Subscription Management

• Verifying your subscription status and entitlement level
• Processing free trials and subscription upgrades via Apple

Communications

• Sending benefit expiration alerts and transfer bonus alerts (only if you enable notifications)
• Responding to your support requests

Product Improvement

• Analyzing aggregated, anonymized usage patterns to improve features
• Diagnosing crashes and performance issues

Legal Compliance

• Complying with applicable laws and regulations
• Preventing fraud, abuse, and unauthorized access
• Enforcing our Terms of Service

Data We Do Not Sell

We do not share personal information with third parties except:

• The service providers listed in Section 4 who process data on our behalf to operate the Service
• When required by law, court order, or government authority
• To protect the rights and safety of AeroStack users or the public
• In connection with a merger, acquisition, or sale of assets — in which case you will be notified in advance

California Privacy Rights

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), effective January 1, 2023.

How to Exercise Your Rights

Submit a verifiable consumer request by emailing:

Verification

We must verify your identity before processing certain requests. We will ask you to confirm your email address and account details. We will not charge a fee unless your request is manifestly unfounded or excessive.

Authorized Agents

You may designate an authorized agent to make a request on your behalf. The authorized agent must provide written authorization signed by you, and we may still verify your identity directly.

California "Shine the Light" (Civil Code § 1798.83)

California residents may request information about disclosures of personal information to third parties for direct marketing purposes. AeroStack does not make such disclosures for direct marketing, so there is nothing to report under this law.

Subscription & Auto-Renewal

AeroStack Premium is an auto-renewable subscription offered through Apple's In-App Purchase system. The following disclosures are required by the California Automatic Renewal Law (Cal. Bus. & Prof. Code §§ 17600–17606) and Apple App Store Review Guidelines.

Auto-Renewal Terms

• Your subscription automatically renews unless cancelled at least 24 hours before the end of the current period.
• Your Apple ID account will be charged for renewal within 24 hours before the end of the current period.
• The subscription price will not increase without your prior notice and consent.
• During a free trial, your subscription will auto-renew at the end of the trial period unless cancelled at least 24 hours before the trial ends.

Cancellation

• Manage or cancel your subscription at any time in: iOS Settings → [Your Name] → Subscriptions → AeroStack
• Cancellation takes effect at the end of the current billing period. You retain access until then.
• We do not offer refunds for partial billing periods. Refund requests must be submitted to Apple — AeroStack has no control over Apple's refund decisions.

Payment Processing

All payments are processed by Apple through the App Store. AeroStack never sees, stores, or processes your payment card information. For billing disputes, contact Apple Support.

Price Changes

If we change the subscription price, we will notify you in advance through Apple's standard price change notification process. You may cancel before the new price takes effect.

Data Security

We implement industry-standard security measures to protect your information:

• Encryption at rest: AES-256 encryption for all data stored in Supabase
• Encryption in transit: TLS 1.3 for all data transmitted between the app and our servers
• Row-level security: Database policies ensure you can only access your own data
• No plain-text credentials: Passwords are hashed using industry-standard algorithms — we cannot see your password
• SOC 2 compliant infrastructure: Supabase maintains SOC 2 Type II compliance
• No bank credential exposure: Plaid handles all bank authentication — your bank username and password never touch AeroStack servers
• Regular security audits: We review security practices and promptly address vulnerabilities

No security system is impenetrable. While we take reasonable precautions, we cannot guarantee absolute security of your information against all threats.

Data Retention

Account Deletion

To delete your account and all associated data, go to Settings → Account → Delete Account in the app, or email support@outdoorhubusa.com with the subject "Delete My Account." We will process your request within 30 days.

Children's Privacy

AeroStack is not directed to children under the age of 13. We do not knowingly collect personal information from children under 13 years of age.

If we learn that we have inadvertently collected personal information from a child under 13, we will delete that information immediately. If you believe we may have collected information from a child under 13, please contact us at support@outdoorhubusa.com.

Users between the ages of 13 and 17 should review this policy with a parent or guardian before using AeroStack.

Changes to This Policy

We may update this Privacy Policy from time to time. When we make changes, we will:

• Update the "Last updated" date at the top of this page
• For material changes: notify you via email and/or in-app notification at least 30 days before the changes take effect
• For minor, non-material changes (e.g., clarifications, formatting): update the policy with reasonable notice

Continued use of AeroStack after the effective date of any changes constitutes your acceptance of the updated policy. If you do not agree to the updated policy, you should stop using the Service and may request account deletion.

Contact Us

If you have questions, concerns, or requests about this Privacy Policy or our data practices, please contact us: