What we store

Without an account

Nothing about you is kept unless you share a trip or ask for a reminder yourself. Plans are generated on our own hardware, and trips you save are kept in that browser's local storage — which also means they are not on your other devices, and clearing your browser data removes them.

When you send a trip to someone

“Send this trip to who you're travelling with” makes a private link to a copy of the trip without your starting point, hidden from the gallery and from search. Your phone's share sheet or your own mail sends it — we see no address and no recipient.

When you ask for a reminder

“Remind me before we go” mails the trip to the address you type, through our mail provider, with a private link back to it, and asks you to confirm. Until you click that link we send nothing else, and an address nobody confirms is deleted after 7 days.

• A plan holds for 30 days. In its last week we send one note that it runs out, with a one-click refresh (not when the reminder comes that same week); and shortly before the month you picked we plan the trip again with that day's prices — and for that month, so a campsite, sight, mountain pass or ferry that is shut then is not in it — and send it to you once, with what changed.
• To plan it again we keep, encrypted with your address, the trip's settings — where it starts and ends, the days, the vehicle, who is coming — and that month (only the month), plus the first plan's prices to compare with. The settings are deleted the moment the reminder is sent or your month has passed, and with your address if you unsubscribe first.
• The mails are plain: no tracking pixel, nothing loaded when you open them.
• Every mail has a one-click unsubscribe; it deletes the address at once.

When you report a wrong number

• “Wrong?” on a cost line or a stop keeps what you wrote, the right value and where you saw it if you add them, and the trip's destination and vehicle — no route, no position, no account.
• An email only if you leave one for an answer; it is stored encrypted, read only by us, and deleted with the report.

When you write to us from the press page

The form on /press keeps your message, your publication, your name if you give it and the address to answer to — the address encrypted, read only by us, and used for nothing but the answer.

When you answer our one question

After you keep a trip we ask what the hardest part of it is for you. If you answer, we keep your words with the trip's destination, vehicle, number of days and who is going — never where you start — on our own server, read only by us, to decide what to build. It is tied to your account only if you tick “you may answer me by email”; otherwise it is nobody's. Ask us and we delete it.

With an account

• Your email address, encrypted. We keep a separate keyed hash of it purely to look your account up.
• Journeys you save, encrypted — including the destination, so a leaked database is ciphertext rather than a list of who is going where.
• The town you start from, if you ask us to keep it — encrypted, a town or a village and never a street. You set it yourself, on your profile page or with “remember as my start” on a trip; it then fills in the start on every device you sign in on. Clearing the field deletes it, and deleting your account deletes it with everything else.

What we deliberately never store

• Your starting point — unless you asked us to keep it. A saved journey is trimmed to begin at least 15 km from where you set off. Your phone knows where you are when you start driving; we don't need to. There are exactly two exceptions, both of them something you asked for: a reminder you confirm keeps the trip's start beside that address until the mail is sent, and an account can keep the town you start from (both above). Without an account your last start is remembered in that browser and nowhere else — never against an address you are browsing from, a session or a fingerprint.
• A start we guess. When you open a trip before saying where you start, we guess a nearby big town from your connection's address — the address every website receives. The guess is made on our own server from an offline file (DB-IP's free city database, db-ip.com); no other service is asked. It names a town, never a street, and is said on the trip as a guess you can change. We do not store the guess, tie it to you or write it to your device; the page holds it while it is open. The legal basis is our legitimate interest in showing you a trip from a sensible start (GDPR Art. 6(1)(f)); you object simply by setting your own start, and there is nothing kept to delete.
• Your travel dates. The planner works in “5 days”, never “15–20 August”. We cannot know when your home is empty. (The only exception is a reminder you ask for and confirm — above: then the month and the trip's start are kept, encrypted, until that one mail is sent.)
• Your address. Places resolve to towns. There is no field that accepts a street.

Those three together — who you are, where you live, and when you are away — are the combination that could actually hurt someone. We are built so we never hold it. An account holds the first two at most — your address and, if you set one, your town; the dates are the piece we do not have. The one place all three could meet is a reminder you asked for and confirmed, which is encrypted and deleted the moment that single mail is sent.

In drive mode

Your position stays on your phone, except what you ask for. When you start guidance, when the route is calculated again, or when you ask for something nearby, the one point where you are goes to our own server to be answered. We don't store it and don't write it to a log. If our own map data has nothing there, a public open map-data service is asked about the area (the point blurred to about a kilometre, or the next stretch of road ahead, with nothing that names you), and in Germany a fuel-price service about the stations around that blurred point.

• The speed-limit sign sends the route line only, to our own server (after a re-route that line begins where the car was), never your position as you drive.
• A recording of your drive stays on your phone and leaves it only as a file you share yourself.
• Members who turned on notifications: when you hand off to your navigator we receive the next stop's name, its opening hours and when you expect to arrive, so a reminder can be sent — no position. The notification address of your phone is kept encrypted.
• The break reminder is your own setting on your profile; the reminder itself runs on your phone.
• If you speak a question, your phone's own speech service may process what you say.
• Counting is page and button totals per day, with no id. Drive mode's leg figures are counts and milliseconds with a random drive code the phone made — never a place.

What drive mode is and isn't, and who answers for what, is in the terms.

Third parties

None for tracking you. No analytics, no advertising, no map tiles fetched from anyone else — the map is drawn from data we ship with the site. What we do count, ourselves, is how many times a page was opened and which parts of it reached the screen — as daily totals per page, with no id and no cookie, and nothing written to your device for counting.

Our web server's log. Like every website, our server writes a line for each request: the time, the page, your connection's address, your browser's name and the page you came from. We keep these lines for 14 days, to keep the site safe from abuse and to make the daily totals above, and then they are deleted. To count how many people came on a day (not just pages), each visitor's address and browser name are turned into a code under a random key that changes every day and is deleted after two days — from then on, nobody, us included, can tell whose code it was. The codes themselves are deleted after 35 days. The legal basis for all of this is our legitimate interest in running a safe site and knowing whether it is used (GDPR Art. 6(1)(f)).

Everything you plan stays with us. One exception, for members: if our trip assistant is busy or resting when you ask it to change your plan, a contracted language-model service answers instead — it sees your plan and your request, only to answer it, and doesn't keep them or learn from them. It may process the request outside the EU, under the European Commission's standard contractual clauses.

Separately, and it never involves your data: the “machine-analysed” readings on some places (likely step-free, dogs welcome, and so on) are produced from the place's public text — its OpenStreetMap notes, its own website — by an AI model, once, offline. Nothing about you, your trip or your device is in those requests. Each reading says where it was read from and how sure the model was, and you can contest one with a reason.

Deleting everything

One button on your Profile page, under “What you agreed to”, removes your account, your journeys, your sessions and the record of what you agreed to, immediately. There is no soft delete and no retention period. You can also withdraw the journey storage on its own there, which deletes the journeys and keeps the account.

Honest limits

Your data is encrypted at rest with a key held outside the database, so a leaked backup is useless on its own. It is not end-to-end encrypted: our server can decrypt in order to show you your journeys. We would rather say that than imply a protection we haven't built.