Privacy Policy

Last updated: August 30, 2026

This policy covers all information collected on the Miles website and in your conversations with Miles, on any device.

Miles is built and run by one person, Andy Assareh. This policy says “I” because there is no company.

Information I Collect

Account Information

When you create an account, I collect your email address. It is used for sign-in and account email. Cookies keep you logged in.

You can give Miles a first name to call you by. That is optional, and it is the only name Miles asks for. No phone number is collected.

Conversation Data

I store every message you send to Miles and every response it gives you. That includes:

• Your questions and requests
• Miles' responses to you
• Conversation history and context
• Timestamps and usage patterns

Memory and Profile Data

Miles keeps notes from your conversations so it can remember your situation. These notes can include:

• Travel preferences: Airlines, hotels, destinations you prefer
• Spending patterns: Categories you spend in, types of purchases you make
• Credit card preferences: Types of cards you're interested in, annual fee tolerance
• Personal context: Family size, location, travel frequency
• Current goals: Card applications in progress, upcoming trips, financial goals

Technical Information

The server logs basic technical information: your IP address, browser version, and usage data.

Alongside a trial conversation I keep a coarse note of where it came from, so I can tell real visitors from bots and crawlers. That note holds the city and country Cloudflare resolves at its edge, your browser version, and a one-way keyed hash of your IP address — never the address itself. The hash lets me count distinct visitors and recognize a repeat visit. It cannot be reversed into an IP, matched against any other site, or used to look you up. Nothing here is shared with anyone or used for advertising.

Cookies

Miles sets three kinds of cookies:

• Authentication cookies: Keep you logged in across sessions
• Preference cookies: Remember your display settings (e.g., dark/light mode)
• Analytics cookies: Show me how visitors use the site. They may also assign you a version of a page when I am testing two versions of it.

All cookies are first-party, set by askmiles.ai. There are no third-party tracking cookies, and no cookie data goes to advertisers.

Feedback

I collect any feedback you send me via email, which may include your name, email address, and any other information you include.

Where Your Data Is Stored

Your account, conversations, wallet, and memory notes are stored in a database on hardware I own and control.

Your conversations, wallet, and memory notes are encrypted with a key that belongs to your account alone. Encryption happens before anything is copied to backup storage on Cloudflare R2. Deleting your account destroys the key. The security page explains how this works and where it ends.

Third-Party Services

Artificial Intelligence Processing

Your conversations are sent to third-party AI services to generate responses:

• OpenRouter: Routes your messages to the AI models Miles uses.
• Google: Processes messages for responses, context, and memory extraction.

These services generate responses. Your data is stored here, not with them, but they may process and temporarily retain conversation data under their own privacy policies:

• OpenRouter Privacy Policy
• Google Privacy Policy

Cloudflare

Cloudflare handles three things for Miles. Encrypted database backups replicate to Cloudflare R2 storage. Traffic to askmiles.ai is served through a Cloudflare tunnel, so Cloudflare handles your requests in transit. Inbound mail is routed through Cloudflare Email Routing and delivered to the Gmail account described in the Gmail section below. See Cloudflare's Privacy Policy.

Resend

Outbound account email — sign-in codes, verification links, and account notifications — is relayed through Resend. Resend processes your email address and the contents of those messages in order to deliver them. See Resend's Privacy Policy.

Gmail

Inbound mail for askmiles.ai addresses is forwarded to Gmail and stored there. Anything you write to [email protected] is held in Google's mail service. See Google's Privacy Policy.

Stripe

Payments are processed by Stripe, which may receive payment information and basic technical data. See Stripe's Privacy Policy.

How I Use Your Information

I use collected information to:

• Provide AI responses: Process your questions through AI services
• Account management: Manage your account, send account-related emails
• Improve personalization: Use conversation history and memory data to provide better recommendations
• Send notifications: Account-related email updates
• Process payments: Handle support payments and billing
• Improve the service: Analyze usage patterns and service performance
• Legal compliance: Meet legal obligations and protect my legal rights

Data Retention

Your data is not automatically deleted. Information is retained as follows:

• Active accounts: All data is kept while your account is active
• Deleted accounts: When you delete your account through Settings, your encryption key is destroyed and the following become permanently unreadable, immediately, everywhere — backups included:
  • All conversation history
  • All AI-extracted memory and profile data
  • Your wallet and card information
  • Point valuations and preferences
  • Email address and first name
  • All other account data
• Connected apps: Deleting your Miles account deletes Miles' data only. If you connected Miles to another product (for example, Stub) through Connected Apps in Settings, that product keeps its own data. Disconnect and delete there separately.
• Audit logs: Minimal deletion logs may be kept for up to 90 days for compliance
• Shared pages: A wallet snapshot or a chat answer becomes a public page only when you click Share. The page is a copy made at that moment, published under a random link with no name, email, or account id on it. Deleting a share (or your account) removes the page; a copy may persist in an edge cache for up to a minute afterwards.
• Session analytics: Which pages a browsing session reads, whether it starts a chat, the country, region and city Cloudflare resolves at its edge for that session, and — if you arrived via a marketing link — the campaign tag and the referring site's domain, are kept for up to 400 days. This is stored under a random identifier in your browser's local storage, not a cookie, and is never linked to your account, your email, or a user id.
• Backups: Backups are encrypted with your key, and deleting your account destroys the key. So your data becomes unreadable in every backup already taken, the moment you delete. The backup files themselves expire from Cloudflare R2 after 7 days. Other products you have connected, such as Stub, keep their own backups — see their privacy policies.

You can delete your account at any time through your Settings page, or by contacting me at [email protected].

Data Sharing

I do not sell your personal information. In the ordinary course of business, data may be shared only as follows:

• Service providers: AI services, backup storage and network delivery, email delivery and storage, payment processing (each listed above)
• Aggregate statistics: Anonymous, aggregated data about service usage
• Legal requirements: When required by law, court orders, or to protect my legal rights
• Business transactions: In an asset sale or transfer of the service, user information may be transferred

What I Receive From Connected Products

Everything above describes data leaving Miles. Data can also come the other way, and this is the only place it does.

If you connect another product to Miles through Connected Apps in Settings and grant it trip access, an AI assistant using Miles' API can read your trips from that product while answering a question — for example, to check what a card's travel protections would cover on a trip you already have booked. Miles requests that access with a short-lived, read-only credential derived from the permission you granted, and only when your question calls for it. It can read; it can never change anything in the connected product.

Miles does not keep what it reads. Trip information fetched this way is used to answer the question in front of it and is not written to your conversation history, not used for the AI-extracted memory and profile data described above, and not written to logs. It is not part of your account data, so there is nothing about it to export or delete — it was never stored. The retention windows described elsewhere on this page, including the seven-day backup window, describe Miles' own data and do not apply here, because no copy is made.

You can stop this at any time by pausing or disconnecting the app in Settings → Connected AI Apps. Pausing stops the reads immediately. The connected product keeps its own copy of your trips and its own privacy policy — see theirs for how it handles that data.

Your Rights and Choices

Access and Control

• Account data: Access and modify through your account Settings page
• Data export: Download all your data in JSON format using the “Download My Data” button in Settings
• Account deletion: Permanently delete all your data using the “Delete Account” button in Settings
• Alternative: Contact me at [email protected] for assistance with data requests

For EU Residents (GDPR Rights)

You have the right to:

• Access your personal data
• Rectify inaccurate data
• Erase your data (“right to be forgotten”)
• Restrict processing
• Data portability
• Object to processing
• Lodge complaints with supervisory authorities

For California Residents (CCPA Rights)

You have the right to:

• Know what personal information is collected
• Delete personal information
• Opt out of sale (I don't sell data)
• Non-discrimination for exercising rights

Security

Security measures include:

• Your conversations, wallet, and memory notes are encrypted with a key that belongs to your account alone. That key is itself locked by a master key the application can use but never read or copy
• Deleting your account destroys your key, which makes everything encrypted with it unreadable
• Encryption happens before anything is copied to backup storage
• HTTPS for all communications
• Storage on hardware I own and control
• No passwords — sign-in uses emailed codes and passkeys
• Regular security updates and monitoring

The security page describes the full design and its limits.

International Data Transfers

Your information may be processed, stored, and used outside your country of residence, including in the United States. By using the service, you consent to these transfers. Data privacy laws vary by jurisdiction.

Children's Privacy

I do not knowingly collect information from children under 13. If you believe I have collected such information, please contact me immediately.

Contact

For privacy questions, data requests, or to exercise your rights, email [email protected].

Changes to This Policy

I may update this policy and will post changes here with revision dates.

Change Log: