Privacy policy

What we collect

• Account details: your email address, if you create an account to save boards. If you sign in with Google, we receive your email address from Google; we never see your Google password.
• Trip inputs: what you tell the planner — destination and origin, dates, budget, who is coming, dietary notes, and the passport country used only for visa guidance.
• Planning choices: the keeps and skips you make in the discovery feed, which shape the board we draft for you.
• Saved boards: the itineraries you choose to save.

Saved boards and share links

Saving a board mints a random share link. Anyone who has that link can open the board, so treat it like a private URL and only pass it to people you want to see the trip. The board carries the itinerary, not your email address or account details. Ask us and we will delete a saved board.

How trip plans get written

Your trip inputs are sent to a large-language-model provider (currently OpenRouter, or Google’s Gemini API as a fallback) to draft the itinerary, and to Google Places to look up real venues and photos. We send the trip details needed to write the plan — not your email address or account identifiers.

Cookies

• A private-preview cookie that remembers you have entered the site password.
• Authentication cookies from our login provider, if you sign in.
• Partner cookies: when you follow a booking link, the travel partner may set its own cookie to attribute the booking. See our affiliate disclosure.

We do not run advertising or third-party analytics trackers.

How we protect your data

We protect personal data with encryption in transit (HTTPS/TLS) and at rest where our providers support it, and with access controls that limit what can read your data — our database is reachable only through restricted server-side credentials, never from your browser. If a security breach ever affects your personal data, we will notify affected users as required by applicable law.

Services we use

We rely on a small set of providers to run the product: Supabase (authentication, database, and image storage), Google Places (destination information and photos), Mapbox (maps and geocoding), OpenRouter and Google Gemini (writing the itinerary), Unsplash and Pexels (photography), and our travel booking partners when you follow a booking link. Each processes data under its own terms, and we share only what is needed to provide the service you asked for.

Your rights and choices

Sign out at any time to end your session. You may request access to, correction of, or deletion of the personal data tied to your account by emailing us, and we will take care of it. If you are a California resident, the CCPA gives you the right to know what we collect, to request deletion, and to opt out of the sale of personal information — and we do not sell personal information. We keep data only as long as needed to provide the service or as required by law.

Changes and contact

We may update this policy as the product evolves; the date above reflects the latest version. Questions or requests go to hello@vacayboard.co.