Cookies & privacy
Updated 24 October 2026
Fareo asks for permission before loading optional analytics in every country. Rejecting optional cookies does not prevent flight searches. You can change your choice using Cookie settings in the homepage footer. Changing the display country or currency does not grant permission or reset a refusal.
Your choices
Accept all, reject optional cookies, or choose categories in the settings. Choices are kept for up to 180 days, whether you accept or reject. A changed consent notice can require a fresh choice. If your browser blocks storage, choices may not survive a page reload. A Global Privacy Control signal prevents Google Analytics and Microsoft Clarity from loading, even if analytics was previously selected. Advertising collection is disabled.
What Fareo stores
| Storage / provider | Purpose | Lifetime |
|---|---|---|
| stcm.fareo.* and fareo-consent-record / Fareo local storage | Remember consent categories, notice version and time of choice | Up to 180 days; replaced when you change your choice |
| fareo-region / Fareo local storage | Remember country and currency you explicitly select | Until you change or clear it |
| fareo-detected-region / Fareo session storage | Cache approximate detected country and currency | Up to 24 hours, or until the browser session ends |
| fareo-visitor / Fareo HttpOnly cookie | Keep flight searches attached to your visitor session and prevent other visitors accessing them | Browser session; server search results expire after ten minutes |
| _ga and _ga_* / Google Analytics, if configured and accepted | Measure website usage; advertising features are disabled | Configured for up to 180 days without extending on each visit; removed on withdrawal where Fareo can access them |
| _clck and _clsk / Microsoft Clarity, only after analytics consent | Session recordings, heatmaps and interaction analytics to improve Fareo; Microsoft advertising consent remains denied | _clck: up to one year; _clsk: up to one day. Removed on withdrawal where Fareo can access them |
Browser security
Fareo runs locally hosted browser checks to help investigate automated abuse. The checks report coarse automation and browser-consistency flags and counts of interactions to Fareo's own server. They do not send the text you type, pointer coordinates, graphics identifiers, or browser fingerprints to an external detection service. Optional usage reporting in the bundled BotD library is disabled. Missing browser features are treated as unknown, and the new detection rules run in observation mode without automatically blocking searches.
Security reports and decisions are kept for up to 30 minutes; recent activity and rate counters expire after their short windows, and report nonces expire after two minutes. Session records use a temporary keyed session identifier. Connection addresses are used for broader short-lived network limits, while normal quotas apply to the browser session. If configured, our self-hosted Valkey-compatible store shares this state between server processes. The security session cookie expires with the browser session.
External services
Fareo's server uses GeoJS to estimate your country and suggest a departure airport from your public IP address. Your browser contacts Fareo's own location endpoint; it does not contact the IP-location provider directly. Fareo compares approximate coordinates with a locally hosted OurAirports airport list and returns only a country code and airport suggestion to your browser. Raw IP addresses and coordinates are not returned to the browser or stored in its location cache. Airport suggestions and country preferences may be cached for up to 24 hours. The server keeps a bounded location cache for up to 24 hours indexed using a temporary keyed hash, without retaining raw IP addresses or coordinates. IP location can be inaccurate, especially on VPNs and mobile networks; you can change the suggested airport and country. See GeoJS privacy information.
Flight searches send your requested route, dates, passenger categories, currency, browser information and, where available, public IP to our flight-search service providers. They return prices and booking links. Booking links take you to a separate provider with its own privacy practices.
Google reCAPTCHA Enterprise helps protect flight search against automated abuse. It loads after the homepage appears and analyses browser and interaction signals. When you submit a flight search, Fareo sends a fresh verification token, browser user agent and, where available, your public IP address to Google to assess the request. reCAPTCHA may set a security cookie (_GRECAPTCHA). Google Analytics runs only when configured and you opt in. See Google’s Privacy Policy, Terms for provider information.
Microsoft Clarity loads only after you accept analytics cookies. It records page layout and interactions such as clicks and scrolling to provide session recordings and heatmaps. Microsoft receives technical browser and network information. Fareo does not send custom user identifiers to Clarity. See Microsoft’s Privacy Statement. Google Analytics loads only after analytics consent to measure page visits and website usage. Advertising features remain disabled.
Operational monitoring
Fareo sends small aggregate server-health summaries and limited redacted error samples to Google Cloud Logging to diagnose reliability problems. These contain request counts, broad operation categories, response-time buckets and allowlisted error codes. This export excludes IP addresses, browser identifiers, search details, request bodies, query strings, raw error messages and credentials. It does not add browser tracking or cookies. Standard log retention is 30 days, with access restricted to authorised project administrators.
Withdrawal and deletion
Use Cookie settings to turn analytics off. Fareo disables Google Analytics, stops Clarity recording, sends denied consent to Clarity and attempts to remove accessible Google Analytics and Clarity cookies. This does not erase information already received by Google or Microsoft. You can also clear cookies and site storage using your browser settings. Clearing your consent preference will cause Fareo to ask again.
Contact Fareo
For privacy questions and requests, email [email protected].
Notice status
This notice describes the current development website. The legal operator’s registered identity, full service-provider disclosures, international transfer arrangements and applicable rights information must be completed before public launch.