planPrivacy Policy
This policy explains what data Plan Your Trip ("the app") processes and why. The app is a tool that lets tour guides plan itineraries and share them with their clients.
1. Data we collect
- Account data: name and email address. If you register with a password, we store only a salted hash of it (PBKDF2), never the password itself. If you sign in with Google, we also receive your profile picture and Google account ID; we request only the basic
openid,emailandprofilepermissions and never access Gmail, Drive, contacts or other Google data. - Content the guide enters: trips, days, places, notes, flights, lodging, expenses, uploaded photos, and the optional business profile (business name, logo, phone, WhatsApp, contact email, website).
- Client comments sent from a shared itinerary page: the name the client writes (optional), the message, and a one-way hashed, daily-rotating fingerprint of the IP address used only to limit spam. The IP itself is not stored.
- Subscription data (Pro users): plan, status, renewal date, the last 4 digits and brand of the card, and payment amounts, received from Lemon Squeezy. We never see or store full card numbers. For referrals we store who invited whom.
- Technical cookies: a session cookie (
sid, 30 days) to keep the guide signed in, and a short-lived security cookie during Google sign-in. The interface language is saved in the browser. We use no advertising or analytics cookies.
2. How we use data
Only to run the app: signing in, storing and showing the guide's itineraries, generating the shared page and PDF, delivering client comments to the guide, and preventing abuse. We do not sell data, show ads, or use data for profiling.
3. Who sees what
Each guide sees only their own trips. A shared itinerary is visible to anyone who has its secret link, together with the guide's business profile. Client comments are visible only to the guide who owns the trip. The administrator can see the list of accounts (name, email, number of trips) to manage the service.
4. Service providers
The app runs on Cloudflare (hosting, database, AI translation). Payments are handled by Lemon Squeezy, which processes card and billing data under its own privacy policy. To provide its features it sends limited requests to: OpenStreetMap / Nominatim and Photon (map tiles and place search), Wikipedia, Wikidata, Wikimedia Commons, Openverse and Mapillary (place descriptions and photos), MyMemory (text translation as a fallback), and AirLabs (flight-number lookup). These requests contain only the search terms, coordinates or text being translated, never your account details.
5. Retention
Data is kept while the account is active. Deleting a trip deletes its places, days, flights, lodging, expenses and comments. Sessions expire after 30 days. On request we delete the account and all its content within 30 days.
6. Your rights
You may request access to, correction, export or deletion of your data, or object to its processing, by writing to info@planyourtrip.eu. Clients who left a comment may ask the guide or us to remove it. You can delete your account yourself at any time: see Delete your account.
7. Security
All traffic uses HTTPS. Session tokens are stored only as hashes. Access to every trip is checked against its owner on each request.
8. Changes
We will update this page if the way we handle data changes. Last updated: 25.10.2026.