MileSmith (milesmith.app) helps UAE residents compare airline award prices and work out the best way to use their credit card points and miles. This page explains what we store, why, who helps us run the service, and how to delete your data. MileSmith is run by an individual developer based in Dubai.
What we store
Your email address, so you can sign in with a one-time link. We don't use passwords.
The cards in your wallet: which card you hold, the points or cashback balance you enter, and, only if you choose to add them, the last four digits so you can tell two cards apart.
Your Seats.aero connection, if you connect it: the access and refresh tokens Seats.aero issues. These are encrypted before they are saved and are only ever used on our server.
What we never ask for or store
Full card numbers, card expiry dates, CVV codes, online banking usernames or passwords, and your Seats.aero password. We also don't store award availability or flight data from Seats.aero: each search is fetched fresh for you and not kept.
How we use it
Only to run MileSmith for you: to show which of your cards can reach a flight, rank your options, answer questions in NOOR, and show live award seats if you've connected Seats.aero. We also record searches (destination, cabin, travel date and how many options were found) without linking them to your account, to decide which routes to add next. We don't sell your data, share it with advertisers or banks, or use it for marketing.
Services that process your data
MileSmith relies on these providers, each only for its part of the service:
Supabase stores your account, wallet and encrypted Seats.aero tokens.
Vercel hosts the website and runs our server code.
Resend sends your sign-in emails.
Anthropic powers NOOR. When you ask NOOR a question, your message and the cards and balances in your wallet are sent to Anthropic's API to write the answer.
Seats.aero, only if you connect it. We send the route and dates you search, using your own Seats.aero account. Seats.aero's own privacy policy covers the data it holds about you.
Cookies and local storage
Your browser keeps your sign-in session so you stay logged in. While you connect Seats.aero, we set one short-lived, secure cookie that expires within 15 minutes, to make sure the connection completes in the same browser it started in. If you search without signing in, we set one cookie that counts your free searches (it lasts 30 days). To limit abuse we also keep a daily search count against a scrambled, one-way hash of your IP address, never the address itself. The searches are recorded without any link to you, like those of signed-in users. We don't use advertising or tracking cookies.
Deleting your data
Cards: remove any card from your wallet at any time and it is deleted.
Seats.aero: press Disconnect and your tokens are deleted from MileSmith straight away. You can also revoke MileSmith's access in your Seats.aero settings, and we delete your tokens the next time we notice the revocation.
Your whole account: email support@milesmith.app from the address you sign in with, and we'll delete your account, wallet and any Seats.aero connection.
Security
All traffic uses HTTPS. Seats.aero tokens are encrypted with AES-256 before storage, and the keys and service credentials are kept on the server, never in the browser. If we ever discover a breach that affects your data, we'll tell you.
Not financial advice
MileSmith gives information to help you decide. It isn't financial advice, and award prices, transfer rates and card terms change. Always confirm on the airline's or bank's own site before transferring points, because transfers usually can't be reversed. MileSmith isn't affiliated with any bank, airline, or Seats.aero.
Who can use MileSmith
MileSmith is for adults aged 18 and over.
Changes and contact
If this policy changes, we'll update the date at the top. Questions, or a request about your data: support@milesmith.app.