Privacy policy

Last updated October 26, 2026

Lounge Monster is free, has no ads and sells nothing, including your data. We keep as little as we can. This page covers the website at lounge.monster and the Lounge Monster app.

Without an account

You don't need an account. The cards, status and memberships you pick, your home and starred airports, the people in your travel party and your light or dark theme are saved in your browser's local storage on your own device. They aren't sent to us. "Clear my saved data" in the footer wipes them, and so does clearing your browser's site data. The site also keeps copies of its own pages and lounge data on your device so it works offline.

When you vote for an airport to get lounges, we count the vote with a scrambled code made from your account or, signed out, your connection, so votes can't be doubled. We don't keep your IP address with it.

We don't use advertising cookies, and we don't follow you around other websites. To see where the site confuses people, Microsoft Clarity records how pages are used; see below.

With an account

If you make an account, we keep:

• Your email address and the name you give us.
• How you sign in: a password (stored only as a salted hash), passkeys (only the public key your device shares), and sign-in sessions, which record the IP address and browser they started from.
• Your saved setups, home and starred airports, and your travel party as you entered it.
• Your visit log, the visit allowances you track, and whether you want allowance emails.
• Reviews, photos, helpful votes, reports on reviews and suggested edits you send.
• Short-lived codes we email you, and counters that stop people from guessing passwords and codes.

Reviews and approved photos are public: they show your first name (or "Former monster" after you delete your account), your reviewer rank, stars, text and photos. Everything else in your account is only for you. Moderators see reported reviews and photos waiting for approval.

You can download everything in your account as a file from Account settings.

Deleting your account

Go to Delete your account, enter your email and type in the code we send you. You can also delete it from Account settings when you're signed in. Your setups, visit log, passkeys, sessions and profile are deleted right away. Your reviews stay, signed "Former monster", unless you choose to delete them and their photos too. Copies in our providers' logs and backups expire on their own schedules, listed below.

Who helps run the site

These companies handle data for us, only to provide their service:

Cloudflare

Hosts the website and app server (Cloudflare Workers) and stores accounts (D1 database) and review photos (R2 storage). Like any web host, Cloudflare sees your IP address and browser details when you load a page, and it protects the site from attacks. We use Cloudflare Web Analytics to count visits: it uses no cookies, doesn't fingerprint you and only gives us totals such as page views, countries, browsers and referring sites. Our server logs (errors and requests to the account server) are kept for a few days. Turnstile, Cloudflare's bot check, looks at your browser when you sign in, delete your account or send a report, to tell people from bots. See Cloudflare's privacy policy.

Microsoft Clarity

Shows us where people click, scroll and get stuck on the website, as heatmaps and replays of page visits. It records your browser, device, approximate location (from your IP address), the pages you open and what you do on them. It never records what you type into boxes, and we hide names, email addresses and account details from it. It sets two cookies on lounge.monster: one with a random ID that lets it link your visits (kept for a year) and one that joins the pages of a single visit (kept for a day). They don't hold your name or email, and Microsoft's advertising cookies are blocked. In the EEA, the UK and Switzerland it sets no cookies, so each page you open counts as a separate visit there. Clearing your browser's cookies removes them. It doesn't run on account or app sign-in pages, or if your browser sends Global Privacy Control or Do Not Track. Microsoft keeps replays for 30 days (a few saved or sampled ones, and heatmaps, for up to 9 months). The apps don't use it. See Microsoft's privacy statement.

Mailgun

Sends our emails (sign-in codes, password resets, email confirmations and allowance reminders) from hello@lair.lounge.monster, through Mailgun's US servers. Mailgun gets your email address and the message. We turn off open and click tracking. See Mailgun's privacy policy.

AeroDataBox, through RapidAPI

Looks up flights when you enter a flight number. We send only the flight number and date, never who you are. See RapidAPI's privacy policy.

GitHub

When you use "Report wrong info", or send feedback from the app, what you write (and your email, if you leave one so we can reply) becomes an issue in our private GitHub repository. App feedback also says which app and version sent it. See GitHub's privacy statement.

We don't share your data with anyone else, unless the law makes us.

Children

Lounge Monster isn't meant for children under 13, and they shouldn't make an account. You can add kids to your travel party by age range so the site can check lounge rules for them. That stays on your device, or in your account if you have one.

Changes and questions

If we change this policy, we'll update this page and the date at the top. Questions or requests about your data: email hello@lounge.monster.