SpeedBooker privacy
Updated 18 October 2026.
SpeedBooker uses the technical data described below to provide account access, appointment alerts and support. For privacy requests, contact hello@speedbooker.app. Data controller and contact.
Your number, your account
SpeedBooker does not collect an email for account access and sends no sign-in or alert emails. Your randomly generated 40-digit account number is a secret key. We store a keyed cryptographic fingerprint, not a recoverable copy. Save your number privately: anyone who has it can use your account. Without the number or a valid session, there is no email recovery.
What we process
We store an opaque internal account ID, hashed session identifiers, monitor settings, pass entitlements, payment references and released alerts. Browser push endpoints and their encryption keys are encrypted in our database; an endpoint hash detects duplicate subscriptions. We record notification consent, a short-lived test receipt, and delivery attempts. Push endpoints can identify a browser and are treated as personal data. One notification device is supported per account. We do not ask for passport numbers, permit identifiers, immigration files or official booking credentials. Technical request data is processed to deliver and protect the service, including keyed IP fingerprints for rate limits.
Providers and purposes
Cloudflare hosts the application and database. D1 uses the EU jurisdiction; other Cloudflare services may process data outside the EEA under their applicable safeguards. Notifications use the browser’s push provider, such as Apple, Google or Mozilla, with encrypted content. Generic lock-screen notices ask you to open SpeedBooker for appointment details.
Creem independently handles checkout, buyer taxes, receipts and payment records as Merchant of Record. Creem may require your email and billing details. We send Creem opaque account/order identifiers and the selected software product, without your account number, appointment reason, identity documents or push endpoint. This service does not promise anonymous payments or the absence of financial records.
Service data is processed to perform the contract; necessary security data supports our legitimate interests; required accounting data is retained for compliance. Browser push permission and the onboarding confirmation control notifications. No advertisements, marketing lists or analytics cookies are used. Essential HttpOnly cookies maintain access and protect requests. The account number is not saved to localStorage or URLs. No private API responses are cached by the service worker.
Retention and your controls
Test receipts expire after three minutes. Pre-session records and expired sessions are cleaned after expiry. Sessions expire after 30 days, or 24 hours of inactivity. Encrypted push payloads are cleared one day after their delivery window; envelope records and source observations are cleaned after seven days. An unused push subscription expires after 30 days unless a paid pass remains active. Rate-limit entries expire within their short security windows.
You can disconnect notifications, sign out, replace your account number, pause or finish a monitor, export service data, or delete the account. Sign-out disconnects push delivery for this account. Replacing the account number revokes previous sessions. Deletion removes the credential, sessions, subscriptions and monitor data; minimal purchase references remain separately for accounting, receipts and refunds, with the application account link removed. Financial records held by Creem follow its own policy.
You may request access, correction, deletion, restriction, objection or portability where applicable. Contact us using your authenticated session where possible; never send the secret account number in support correspondence. You may complain to Malta’s Information and Data Protection Commissioner at idpc.org.mt.
Data controller and contact
Chpl Limited is responsible for the account and alert data described in this notice. For data protection requests, contact hello@speedbooker.app. Registered office and company details: service operator.