Privacy Policy
This policy explains what information MyTrip Builder (“we”) collects when you use the website and app, why, who receives it and what choices you have. It is part of the Terms of Use.
1. What we collect
- Account data. When you sign in (for example with Google), we receive your email address and basic profile details that the sign-in provider shares, such as your name.
- Trip data you enter. Trips, stops, notes, ratings, costs, shared-trip settings, and files or photos you attach, including any names or details of travel companions you choose to type.
- Public content you publish. Travel journals you publish (including the title, trip details, text, destination and traveler names you add, and your account name only if you choose to show it on the journal card) and comments you post (the name you type and the text). These are public.
- Journal checks. When you publish a journal we run an automated completeness check on it and keep the result, together with a one-way fingerprint (hash) of its text that lets us detect copied journals.
- Journal imports. When you publish a journal, we store a copy of the route only (days, stops, place names, types, times and the location details of verified places; no costs, notes, photos, flight or booking details, names or real dates). When a member imports a journal we record which account imported which journal and when, to apply the monthly import allowance, to credit the author and to count reputation. The author is not told who imported.
- Creator program. If you apply to be a creator, the display name and text you choose, a public page address, your application status and any note we add. The name, text, level and journals are shown publicly once you are approved. We also keep a plain view counter per journal per day (no visitor identifiers), and, for imports, whether the member who imported went on to open the flight and hotel search; the creator sees these only as totals.
- Member benefits. We record whether your account qualifies for a member benefit (for example being among the first members, or publishing a complete journal), any benefit code issued to your account or that you redeemed, and, to limit guessing, the time of your failed attempts to enter a code.
- Where you came from. If you arrive through a campaign link that carries a short source tag (for example ?src=name), we keep the tag in your browser and, when you sign in, store it once against your account so that we can tell which channels bring members. No other detail of the link is stored.
- Public counters. The website may show totals only (for example how many community-founder spots are left, how many accounts exist and how many were active in the last 30 days). They contain no personal data.
- AI assistant requests. When you use the AI assistant, the details needed for that request: for example destination, dates, number of travelers, the stops and place names in your trip, preferences you choose (such as interests, budget and pace) and any text you type (questions, notes, requests). We keep only usage records for each request (provider, model, task, token counts, estimated cost and time) to apply your monthly allowance; we do not keep the text of your questions or of the answers except what you add to your trip.
- Reports. If you report a journal, the reason you choose.
- Feedback form. If you fill in the feedback form on the website: your answers (what you tried to do, where you got stuck, what is missing, your device and browser, your ratings, and whether you would use or recommend the service), the language of the page and the time. Your email address is saved only if you choose to give it; we use it to send news and updates about MyTrip Builder and keep it with your answers until you ask us to remove it. The form does not need an account.
- Security checks. When a trip is created, we keep for up to 90 days a few technical details of the request: the website it came from and the type of browser or tool. We use them only to detect automated misuse of the service. We do not store the IP address in this record.
- Usage records. Sign-in events (email, sign-in method and time), a log of actions such as saving, deleting or importing a trip, the name of the device that saved a trip, and records of which external services your use called, which we use to run the Service and enforce usage quotas. Some actions taken before you sign in are logged without an account.
- Website visits. On the marketing site, a random visitor identifier stored in your browser, the page, the language and the time. No account is needed.
- Approximate location. Our hosting provider derives your country from your IP address. We keep it in a short-lived cookie (24 hours) to choose the default language. IP addresses are processed by our hosting and security providers as needed to deliver pages.
- Analytics and performance. Aggregated page-view and speed measurements through Vercel Web Analytics and Speed Insights, which Vercel describes as not using cookies to track individuals.
- Google Analytics. Our pages, including the app, carry a Google tag (Google Analytics) that collects usage data such as the pages you view, your approximate location, your device and browser, and uses cookies and similar identifiers set by Google. Analytics cookies are set only if you accept in the cookie banner; until then the tag runs in a restricted mode (Google Consent Mode) without analytics cookies, and you can change your choice at any time with the cookie settings link. Google processes this data under its own privacy policy. You can also opt out with Google’s browser add-on for blocking Google Analytics, or by blocking cookies in your browser.
- Error reports. When enabled, technical details about errors, through Sentry, to fix bugs.
2. Information sent to map, weather, flight and currency services
AI providers. Only when you use the AI assistant (and only while signed in), the request described above is sent through our server to an AI provider: Anthropic (Claude), or Google (Gemini) where we enable it. We do not send your email address or account details with it. The provider processes the request under its own terms and privacy policy. Please do not type sensitive personal data or details about other people into the assistant.
To work, some features send data to other services: place names and coordinates you search or verify go to Google Places and Routes (through our server, which hides our access key and enforces quotas) and to OpenStreetMap services (Nominatim, OSRM); stop coordinates and dates go to a weather service (Open-Meteo); flight numbers go to a flight-data provider when you ask to fetch a flight; a currency-rates service is used for conversions. Map tiles are loaded from third-party providers such as Esri, and the Bookings page loads partner icons. These services receive your IP address and the data needed for the request, and handle it under their own policies.
3. How we use information
- to provide the Service: save and sync your trips, calculate routes, share, run the AI assistant when you ask, and show content you publish;
- to keep the Service secure, prevent abuse, enforce quotas and fix errors;
- to understand overall usage and improve the Service;
- to respond to your requests and reports, and to comply with law.
We do not sell your personal data and we do not use it for advertising profiles.
4. Legal grounds
Where the GDPR or similar laws apply, we rely on: providing the Service you asked for (contract); our legitimate interests in security, preventing abuse, quota control and basic analytics; your consent where the law requires it, which you can withdraw at any time; and legal obligations.
6. International transfers
Our providers may process data in countries other than yours, including outside Israel and the European Economic Area. Where required, we rely on the safeguards those providers offer.
8. How long we keep data
We keep your trips and files until you delete them or ask us to delete your account. Public journals and comments stay until you or we remove them. Usage and security records are kept only as long as needed to operate and secure the Service, and are then deleted or aggregated. Backups and copies made by others may persist for a while after deletion.
9. Your rights
Subject to the law that applies to you, you may ask to access, correct or delete your personal data, restrict or object to its processing, receive a copy, and withdraw consent. Under the Israeli Protection of Privacy Law you may review information about you held in a database and ask to correct or delete it. Write to mytripbuilder@gmail.com; we may need to verify your identity, and we will respond within a reasonable time, normally within 30 days. You may also complain to your local data-protection authority. Most of your own content can be deleted directly in the app.
Providing data is voluntary, but without an account we cannot save your trips to the cloud.
10. Security
We use reasonable technical and organizational measures, such as access controls and encrypted connections. No system is completely secure, so we cannot guarantee absolute security. Choose what you upload and publish accordingly.
11. Children
The Service is not directed to anyone under 16 and we do not knowingly collect their personal data. If you believe a child has given us personal data, contact us and we will delete it.
12. Other people’s data
If you add information about other people, such as travel companions, make sure you are entitled to and that they are comfortable with it, especially before you publish a journal.
13. Changes to this policy
We may update this policy. The date above shows the latest version. When a change is significant we will make a reasonable effort to tell you.
14. Contact
For privacy questions, access or deletion requests, or to report content: mytripbuilder@gmail.com.