What we store

Without an account

Nothing leaves your browser. Plans are generated on our own hardware, and trips you save are kept in that browser's local storage — which also means they are not on your other devices, and clearing your browser data removes them.

With an account

• Your email address, encrypted. We keep a separate keyed hash of it purely to look your account up.
• Journeys you save, encrypted — including the destination, so a leaked database is ciphertext rather than a list of who is going where.

What we deliberately never store

• Your starting point. A saved journey is trimmed to begin at least 15 km from where you set off. Your phone knows where you are when you start driving; we don't need to.
• Your travel dates. The planner works in “5 days”, never “15–20 August”. We cannot know when your home is empty.
• Your address. Places resolve to towns. There is no field that accepts a street.

Those three together — who you are, where you live, and when you are away — are the combination that could actually hurt someone. We are built so we never hold it.

Third parties

None. No analytics, no tracking, no advertising, no map tiles fetched from anyone else — the map is drawn from data we ship with the site. The AI runs on our own machines, so what you plan is never sent to an AI provider.

Deleting everything

One button on your Profile page, under “What you agreed to”, removes your account, your journeys, your sessions and the record of what you agreed to, immediately. There is no soft delete and no retention period. You can also withdraw the journey storage on its own there, which deletes the journeys and keeps the account.

Honest limits

Your data is encrypted at rest with a key held outside the database, so a leaked backup is useless on its own. It is not end-to-end encrypted: our server can decrypt in order to show you your journeys. We would rather say that than imply a protection we haven't built.