Development preview — not launch-ready
Privacy — preview notice
Not a launch policy
This is a development disclosure, not an approved public-service privacy policy. The legal operator, contact address, applicable jurisdiction, provider agreements, and backup retention periods must be confirmed before launch. Do not upload sensitive information during evaluation.
Data used to run the app
Accounts store your name, email, authentication methods, sessions, and security metadata. Journeys store the content and dates you supply. Photos use private object storage; optimized derivatives discard embedded image metadata. Browser storage holds account-scoped drafts; essential cookies support sessions and viewer access.
Who can see a journey
Owners, accepted editors, and anyone holding an active view link can read the journey. Editors can change content. Sharing links are capabilities: do not post them publicly unless you intend anyone to read or join. Viewer grants and links are stored as hashes.
Providers and external requests
The backend uses Cloudflare Workers, D1, R2, and Images. Email uses Resend when configured. Google/Apple sign-in and passkeys depend on enabled configuration. The app loads Google Fonts. Travel maps use Mapbox and load automatically when visible in both view and edit modes. Mapbox receives map-area requests, network metadata such as your IP address, and SDK usage events. Map asset requests disclose only the app origin as a referrer, not the journal URL. Car routing sends ordered stop coordinates through our API to Mapbox Directions; journal text, place labels, account IDs and sharing tokens are not sent with those requests. Road routes are suggested paths, not navigation or evidence of the path traveled. Place searches send your submitted query to Mapbox Geocoding only after Enter or Search, never while typing or focusing the field. Search requests omit cookies and disclose only the app origin as a referrer. Permanent geocoding allows selected place labels and coordinates to be saved in your journey. No advertising or separate product analytics is installed in this preview.
Deletion and retention
Delete your account from Account & security after a fresh sign-in. Owned journeys and access are removed, media cleanup is queued, and account identity is deleted. Contributions to other owners’ journeys remain with account attribution removed. Personal information typed into content is not automatically scrubbed. Downloaded copies and provider backups cannot be promised immediate erasure; backup windows remain a launch gate.