What this product knows about you

Without an account

Everything works signed out, and everything stays in your browser. Your trips, the answers that produced them, what you have locked and what you have swapped: all of it lives in this browser's local storage and is never sent anywhere. Clearing your browser data deletes it, and nobody — including us — can get it back. One exception: making a share link stores that trip on our server, under an account with no name and no email, so the link can open elsewhere. If this browser does not visit for 30 days, that account, its copy of the trip and the link are deleted.

With an account

Signing in moves your trips out of the browser and into a database, so they follow you to another device. That is the only reason an account exists.

What is stored

• Your email address, because a sign-in link has to go somewhere. There is no password, so there is none to lose.
• Your trips: the destination, the dates, the answers you gave, and every place, meal and open hour in the plan.
• What you keep, swap, skip and complete, and the reason you gave when you swapped something. This is what makes the next trip better than the last one. It is the most useful thing the product holds and the most personal, and it is deleted with everything else.
• Places you have saved, including links you have pasted from elsewhere.
• Links you have created to share a trip, and the anonymous reactions people left on them.

What is never stored

Some of these are worth naming because a reader would reasonably assume otherwise.

• What you write about the person you are going out with on the date-night screen. It lives in the page: not in the saved trip, not in the share link, not in the exported text, not in the URL. When the AI layer is on, it is sent once, with the request that plans that evening, and is not cached or logged there. A refresh loses it, which is the point.
• Your location. The product does not ask for it and does not read it.
• Payment details. There is nothing to pay for.
• Anything for advertising. There is no ad network, no tracking pixel and no third-party analytics.

Who else sees it

A share link renders your trip to anyone who has it, without an account. It shows the plan and the places in it. It does not show your email address, the answers that produced the trip, or that any other trip of yours exists. A link you revoke stops working immediately.

Reactions on a shared trip are anonymous, including to you. You see how many people loved something, never who.

Where the place data comes from

Places, opening hours and photographs come from OpenStreetMap, Overture Maps, Wikidata and Wikimedia Commons, and bookable tours from Viator where that is switched on. City guides are quoted from Wikivoyage. Forecasts come from MET Norway, monthly climate from NASA POWER, and travel advice from the UK Foreign Office (FCDO) and the US State Department. Our servers fetch all of it, never your browser, so none of those sources learns anything about you. The one exception is photographs, which load from Wikimedia's own servers and so reach them the way any website does. Each fact carries its source and when it was fetched, and the sources page lists every licence.

When the AI layer is on, a plan's wording may be written by Claude from data already in our database. It is never sent anything you typed that we do not otherwise store, except the date-night line, which goes with that one evening's request and is not kept. It cannot invent a place, a price or an opening hour.

Getting it back, or getting rid of it

Delete your account from the profile screen. It is immediate, it is complete, and there is no recovery period during which we quietly keep it. Every row belonging to you is removed by name.

Any trip can be copied as plain text or added to your calendar from the trip itself.

For anything else, write to privacy@example.invalid.

Changes

If this page changes in a way that affects what is collected, the date at the top changes with it.