Privacy & terms

Trip Planner is a working name. It is a free trip-planning app that I run on my own laptop for a small group of invited friends and family. This notice covers:

• what the app stores and why;
• who else is involved;
• how you can see, correct or delete your data.

It applies to everyone who uses Trip Planner. It also applies to anyone who opens one of its pages, for example a shared trip. If anything is unclear, ask me.

1. Who runs it and how to reach me

Run by: the name is shown here once you sign in with your invite link.

I'm a private individual in Portugal, and Trip Planner is a personal, non-commercial project. Under the GDPR I am the "controller", which means I decide what your data is used for.

For anything at all, write to wip-trip-planner@proton.me. That includes questions, requests and complaints. The app never sends email. Replies come from me, from that address. There's no data protection officer, because a project this size doesn't need one.

2. The short version

• You sign in through a personal link that I made for you. Your account only needs a display name, and a nickname is fine.
• Three groups can see your trips: you, the people you share them with, and me. I can see them because they're stored on my laptop, but I don't look unless you ask me to or the law requires it.
• One cookie keeps you signed in. There are no ads and no tracking across other sites, and nothing is sold.
• A few outside services help run the app (see §4). Tailscale carries the connection, CARTO provides the map images, and Geoapify answers address searches.
• You can download your data or delete your account yourself, at any time, from your account page.

3. What I keep, why, and for how long

Account. For link sign-in: your display name, an internal placeholder instead of an email address (it isn't yours and never receives mail), and a fingerprint of your personal link, never the link itself. For a password account: an email address, and the password stored only as an argon2id hash. For everyone: any profile details you add (home city, home currency, travel styles) and your saved packing templates.

Why

To sign you in, to show your name to people you plan with, and to adjust the app to your settings

Legal basis (GDPR art. 6(1))

(b) contract: needed to provide the app under the terms below

Kept for

Until you delete your account or Trip Planner closes

Trips and their contents. Itinerary and notes, budget and expenses, packing lists, checklists, wishlist, bookings, people you add as travellers, and files you upload. Photos can be up to 8 MB each and documents up to 15 MB each, within a storage limit for each account. This also covers share links and calendar links you create, and the ratings, reports and author mutes you make in the catalog.

Why

This is what the app does

Legal basis (GDPR art. 6(1))

(b) contract

Kept for

Until you delete the trip or your account

Session cookie tp_session

Why

Keeps you signed in

Legal basis (GDPR art. 6(1))

(b) contract; strictly necessary

Kept for

30 days, then you sign in again

Server logs. One line for each request: which page (including trip numbers), when, the result, and how long it took. Logs never contain your IP address, cookies, passwords, anything you typed, or link codes. There are also short-lived performance traces, which follow the same rules.

Why

Keeping the app working and secure

Legal basis (GDPR art. 6(1))

(f) legitimate interests: running a working, secure service

Kept for

Logs: deleted after 30 days. The app's small rolling log file overwrites its oldest lines once it reaches 50 MB. Traces: 72 hours

Visit counts. When you open a page, your browser sends my server the page address (trip numbers replaced by ":id", link codes removed), your screen size and language, and the domain of the website that sent you, if there was one. The server passes a cleaned-up copy to a visit counter (Umami) that runs on the same laptop. Umami also records your browser, operating system and device type, plus a visitor code that changes every day. It stores no IP address and no name.

Why

To see which parts of the app get used

Legal basis (GDPR art. 6(1))

(f) legitimate interests (to object, see §8)

Kept for

6 months

Backups of the whole database

Why

So a broken disk or a bad update doesn't lose your trips

Legal basis (GDPR art. 6(1))

(f) legitimate interests: not losing your data

Kept for

One backup a night, and the last 7 are kept. Anything you delete is gone from every backup within 7 days

Emails you send me

Why

To answer you, and to show that I handled your request

Legal basis (GDPR art. 6(1))

(c) legal obligation, for data-protection requests; (f) legitimate interests, for everything else

Kept for

Until I've dealt with them, then up to 12 months

The only thing you have to give me is a display name. Everything else is up to you, although the app can't do much without trips.

4. Who else is involved

Tailscale (Tailscale Inc.) connects your device to my laptop

What they get

Your IP address, the site's address and the timing of connections. It does not get the content, because the encryption ends on my laptop

Where

Its relay servers may be outside the EU

Safeguard

EU Standard Contractual Clauses in Tailscale's data processing addendum

CARTO (CartoDB Inc.) provides the map images

What they get

Your browser downloads the images straight from CARTO. CARTO therefore gets your IP address, your browser type, this site's address and the map area you're looking at. It shortens your IP address as soon as it arrives and keeps those logs for 30 days. It works on my behalf, as a "processor"

Where

United States

Safeguard

EU Standard Contractual Clauses in CARTO's data processing agreement

Geoapify (Geoapify GmbH) runs address search and the "what's here?" lookup

What they get

The text you search for, or the point you picked, plus the area of the trip. My server sends the request, so it doesn't include your IP address or anything else that identifies you

Where

Germany (EU)

Safeguard

None needed: the data stays in the EU

Proton (Proton AG) hosts the mailbox behind the contact address

What they get

Emails you send me

Where

Switzerland

Safeguard

The EU's adequacy decision for Switzerland

The Tailscale and CARTO documents are published on their websites, and I'll point you to the exact ones if you ask.

My server also fetches a few things that carry no information about you:

• currency exchange rates;
• points of interest for the map area, from the Overpass API;
• the weather at the trip's first location, from OpenWeather, if a forecast appears on your itinerary.

I don't sell your data, and I don't give it to anyone else unless the law requires it.

5. Who can see your trips

• You, and the people you add to a trip. They see the whole trip and your display name.
• Anyone who has a share link or calendar link you made. A share link shows the trip's name, destination, dates and day-by-day stops, including each stop's notes. A calendar link shows the dated stops and their notes. Neither needs a sign-in, so anyone the link is forwarded to sees the same thing. You can turn either one off at any time in the trip's settings.
• Everyone, if you publish an itinerary to the catalog. You only publish if you choose to. A published itinerary is public on the internet, search engines may list it, and it shows your display name as the author.
• Me. Trip Planner runs on my laptop, so I can technically access everything in it, including uploaded files. I only look at your trips or files when:
  • you ask me to, for example to fix a problem;
  • I'm handling a request you made;
  • I'm checking something you submitted to the catalog;
  • the law requires it.

Please leave health details, religion and other private matters out of a trip unless the trip needs them, and keep in mind who can see each trip. When you add other people as travellers, you're giving me information about them, so add only what the trip needs.

6. Cookies and storage in your browser

There's one cookie, tp_session. It's set when you sign in, it keeps you signed in, and it lasts 30 days. It's essential to the app, so it doesn't need a consent banner. There are no advertising or tracking cookies.

Your browser also keeps your display choices in its own storage: the theme, the map layer, and the currency you chose for price hints. These stay on your device and are not saved to your account. The visit counter in §3 sets no cookie and stores nothing on your device.

7. Security, briefly

• The connection is encrypted (HTTPS) all the way to my laptop.
• Passwords are stored only as argon2id hashes, and personal links only as fingerprints.
• Backups are encrypted before any copy leaves the laptop.

It's still one person's laptop, not a data centre. The terms explain what that means for you.

8. Your rights, and how to use them

At any time you can:

• Get a copy of your data. You can do this yourself. Account → Your data downloads your account and your trips as a JSON file. Each trip can also be exported as a spreadsheet (XLSX) and a calendar file (ICS). The JSON file lists your uploaded photos and documents but doesn't include the files themselves, so save them from the trip if you want copies. For anything else, such as what the logs hold, email me.
• Correct it. Edit your display name and your trips in the app, or ask me to do it.
• Delete it. You can do this yourself in Account → Danger zone. If you sign in with a link, you confirm by typing your display name. Deletion happens straight away and can't be undone:
  • Your account is deleted, along with every trip you own and everything in those trips. Those trips disappear for everyone you shared them with too, so export a trip for them first if they need it.
  • Anything you added to trips that other people own stays in those trips, because it's part of their trip.
  • An itinerary you published stays in the catalog, but without your name. Ask me and I'll take it down as well. Submissions still waiting for review are deleted.
  • Within 7 days the backups no longer contain your data. Logs and visit counts don't carry your name, and they are deleted on the schedule in §3.
  If you'd rather not do it yourself, email me and I'll delete it for you.
• Object to anything I do on the basis of legitimate interests: logs, visit counts and backups. For visit counts, the quickest way is to turn on "Do Not Track" or "Global Privacy Control" in your browser. Visits from a browser sending either signal aren't counted at all. If your browser has neither setting, email me. I'll stop counting your visits, and if I can't do that for you alone, I'll turn the counter off for everyone.
• Restrict what I do with your data, which pauses it while we sort out a disagreement.
• Take your data elsewhere using the export described above.

I don't rely on your consent for anything, and no decision about you is made automatically.

If you email a request, I'll answer within one month, usually sooner. It's free. I won't ask for an ID document. If I'm not sure a message really comes from you, I'll check with you through another channel that I know is yours.

If you think I've got something wrong, please tell me first. You can also complain to Portugal's data protection authority, the Comissão Nacional de Proteção de Dados (www.cnpd.pt). If you live or work in another EU country, you can complain to the authority there instead.

These rights also apply to people who don't use Trip Planner. That includes someone who appears in another person's trip and anyone who opened a share link.

9. Children

Trip Planner is for people aged 13 and over, and I only make links for people who are at least 13. If you're under 18, I'll only give you a link if a parent or guardian agrees.

10. Changes

If I change what Trip Planner does with your data, I'll update this notice first and change the date at the top. I'll tell you personally before any significant change takes effect, so you have time to export or delete your data first. Significant changes include:

• a new outside service receiving your data;
• a new use for your data;
• Trip Planner opening to the public.

These terms are short because Trip Planner is a free favour between people who know each other, not a business. Signing in means you agree to them.

1. What it is. Trip Planner is a free, non-commercial trip planner that I run on my own laptop for the people I invite. There are no ads and no fees. It's an early version and it will change.
2. Your link is your key. Your personal link signs you in without a password, so anyone who has it can sign in as you. Don't forward it. If you lose your link, or think someone else has it, tell me. I'll turn it off, which also signs you out on every device, and I'll give you a new link to the same account.

   I can also turn off anyone's access. If I do that to you, I'll tell you why and give you a chance to export your trips first. The one exception is a security problem that can't wait.

3. Use it fairly.
   • Nothing illegal, and nothing that harasses anyone.
   • Only add other people's details if they'd be happy with that, and only upload things you have the right to share.
   • Address search sends your text to Geoapify. Search for places, not people, and don't type in names or private home addresses.
   • Don't try to get into other people's trips, get around the sign-in, or overload the server with scraping or automated requests. If you find a security problem, please tell me. That's a real help.
   • Trip Planner isn't file storage. Photos are limited to 8 MB each, documents to 15 MB each, and each account has a storage limit.
4. Your content stays yours. You allow me to store it and to show it to the people you share it with, and nothing more. If you publish an itinerary to the catalog, you also allow me to show it publicly. If you later delete your account, I'll keep showing it, but without your name. If you want it taken down, ask me and I will.
5. No guarantees. Trip Planner runs on one laptop over a home internet connection.
   • It will sometimes be down.
   • Data can be lost despite the backups. Keep your own copy of anything important, such as bookings, tickets and documents. The export makes that quick.
   • Maps, addresses, prices, exchange rates and catalog itineraries come from other sources, and they can be wrong or out of date. Always check with the airline, hotel or other provider.

   Trip Planner is a notebook, not a booking system.

6. Responsibility. As far as the law allows, I'm not responsible for losses caused by using Trip Planner or by it being unavailable. This doesn't limit any responsibility that the law says can't be limited. That includes harm caused on purpose or through gross negligence, and injury to a person.
7. Ending. You can stop using Trip Planner at any time and delete your account yourself. If I close Trip Planner, I'll give you at least 30 days' notice so you can export your trips. The exception is something outside my control that makes notice impossible, such as the laptop failing. After the notice period, I'll delete everything.
8. Changes. I'll tell you personally before any significant change to these terms takes effect. If you don't agree with a change, you can export your data and delete your account.
9. Law. Portuguese law applies. Nothing in these terms takes away any rights the law gives you.
10. Contact. wip-trip-planner@proton.me