Privacy policy

What the extension does

It shows the historical probability that a given flight is operated by an aircraft carrying modern high-speed satellite wifi, meaning Starlink or Amazon Leo, rather than legacy service. The odds appear as colour-coded badges on airline search results and as a ConnectScore in the popup.

Nothing personal is collected

The extension does not collect, store, transmit, sell or share personal information. There are no analytics, no tracking pixels, no accounts, no sign-in, and no server of mine that receives anything you do. The list below is the complete set of things that happen.

• Reading pages, locally. On a flight search at united.com, alaskaair.com or Navan, the extension reads the routes and flight numbers already displayed on the page in front of you. That parsing happens in your browser. Nothing about the page is uploaded.
• Odds lookups. To attach odds to a flight the extension asks the public APIs of the independent community trackers unitedstarlinktracker.com and alaskastarlinktracker.com. Each request carries a route such as DEN to SFO, or a flight number and a date. No booking details, no passenger names, no fare or payment data, nothing that identifies you.
• Caching, locally. Responses are cached for about six hours in the browser's extension storage, next to a handful of interface preferences: panel collapsed, keep-sorted, and whether you turned Alaska support on. Clearing that storage or uninstalling removes all of it.
• Selector updates. Roughly once a day the extension fetches a small configuration file from wifiodds.com that says where the relevant elements sit on the airline pages, so a site redesign does not break it. That request carries nothing about you beyond what any web request reveals to a host, which is your IP address. It is not logged and not joined to anything.

What wifiodds.com does

wifiodds.com is a static site on Cloudflare Pages. It sets no cookies, runs no analytics and embeds no third-party script. Fonts are served from this origin. Cloudflare processes standard short-lived request logs as the hosting provider, which I neither read nor keep.

Almost every page is prerendered, so it arrives holding its numbers and fetches nothing while you read it. The exception is the route optimizer, and it is a real one.

The United route optimizer calls another site

/united/ ranks the flights on a city pair, and the ranking comes from somebody else's data. With JavaScript running, opening that page makes your browser send three requests to unitedstarlinktracker.com, and picking a different route sends three more. The requests happen at the moment you look, not at build time, so the tracker sees them.

With script off, that page now sends nothing. It carries static tables instead: the last answer the tracker gave for each of the 57 routes in the cache, prerendered into the page when the site was built, with every flight number, its Starlink draw rate, the count of departures behind that rate and the date the answer was cached. 34 of those routes have flight rows, holding 174 departures between them, and the 23 with none are named on the page too. Nothing on that path is fetched, stored or timed while you read it. Until this revision the page rendered no tables at all with script blocked, and this section described the live calls as the whole story.

• What is sent. Two three-letter airport codes, and a row limit. That is the whole payload: no date, no name, no flight you booked, no fare, nothing typed anywhere else on the site. The page loads on DEN to SFO by default, so the first pair goes out before you have typed anything.
• What the tracker can see anyway. Your IP address and your browser's user-agent string, as any host sees on any request. What they do with that is their policy, not mine.
• What is kept in your browser. The answer, under a localStorage key of the form usl2:DEN-SFO, one key per route, holding the flight list and routings the tracker returned and the time it answered. It is reused for six hours so the same lookup is not requested twice, and it is ignored after that. Nothing in it describes you. Clearing site data for wifiodds.com removes it.
• The round-trip builder looks up the return leg too, so a page visit usually writes two keys rather than one.

Blocking scripts on wifiodds.com stops the call and leaves you the static tables, which is the cheapest way to read that page without touching another host. Three more pages carry United material and are prerendered the same way: the hangar floor and full tail registry, the day-by-day install archive, and the United score page with the arithmetic on it. The optimizer says the same thing at the top of itself when script is off.

Reported Read off the page's own source on 26 Jul 2026: one GET to /api/plan-route and two JSON-RPC calls to /mcp, per direction, all of them behind the script. The static tables are baked from the same data file the rest of the site is built from.

What this site writes to your browser

One thing, and only on the page above, and only when its script runs: the optimizer's route cache described in §4. Read that page with script off and it writes nothing at all, because the route tables are already in the HTML and there is no answer left to keep. No cookie is set on any page, and there is no session storage, no fingerprinting and no advertising identifier anywhere on the site.

The light and dark switch in the header stores nothing at all. It holds your choice in a class on the page until you reload, and then the page goes back to following your operating system. An earlier version of this site kept that choice under a localStorage key called woTheme. That key is gone, along with the script that read it, and the policy that still described it was corrected on 25 Jul 2026.

Field reports you send me

The report form at the foot of the airline pages posts to /api/report. It asks what you flew, when you flew it, which system was onboard and what it did. The longer version on the methodology page also takes a speed and a latency reading. There is no account step and no email field on either, so the report is the only thing that arrives.

Something has to stop one connection filing a thousand rows, and a captcha cannot do it here: Turnstile, reCAPTCHA and hCaptcha are all third-party scripts, which this site does not load. The cap is server-side instead. Your network address goes into a SHA-256 digest along with a secret salt and the current UTC hour, and the digest is what gets stored beside the report. The address itself is hashed in memory. It is never written down, never logged and never sent back to you.

Because the hour is part of the input, the digest changes on the hour, and a stored one stops matching anything about an hour after it was written. Two hours of submissions from one connection cannot be joined to each other. Five reports per digest per hour is the limit. No cookie is set, no captcha is served, and nothing is measured about your browser.

Every submission lands unpublished and a person reads it before it appears on the site. The only thing about you that can ever be published is the name or handle you type into the credit box, and that box can be left empty.

Every permission, and the reason for it

Data from children

The extension and the site are general-audience tools that collect no personal data from anyone, so they collect none from children.

When this policy changes

The effective date at the top changes with it, and the version it replaced stays in the public git history of the repository below. This revision rewrote §4 and §5 because the route optimizer changed underneath them: it now prerenders its route tables, so a reader with script off gets the data and sends nothing. The revision before it, on 25 Jul 2026, corrected the storage claim in §5 and added the account of the optimizer's outbound calls to §4.

Who runs this

WiFi Odds is an unofficial, free, open-source hobby project (source code). It is not affiliated with, endorsed by or sponsored by United Airlines, Alaska Airlines, any other airline, Navan, SpaceX/Starlink, Amazon, Viasat, or the trackers whose data it credits.

Questions go on the issue tracker.