What this product knows about you
Written from the code rather than from a template. If something is not on this page, the product does not do it.
Contents
Who is responsible
Westengen Studio (sole proprietorship), org. no. 937 785 704, Ulvefaret 124, 1488 Hakadal, Norway, is the controller for the personal data described here. Contact: privacy@westengenstudio.com.
You must be 16 or older to use the product.
Without an account
Everything works signed out.
What stays on your device
Your trips, your profile and preferences, the places you have saved, the activities you have marked to join, the example chat and your My World map are stored in this browser (local storage and IndexedDB) and in an offline cache. Clearing your browser data deletes them, and we cannot get them back.
What is sent to our server, and why
- To plan a trip: the answers you give (the place, dates and arrival and departure times, the kind of trip, how many of you, budget, pace, interests, food you love, alcohol and what you want to avoid) are sent to our server so it can plan from current place data. The server uses them to build the plan and does not store them.
- If you give ages, they leave your device only as an age group (0–2, 3–12, 13–17, 18–64 or 65+), never as an age. Diet and accessibility needs are used and sent only if you tick the consent box where you fill them in, and only for the plan you asked for.
- To search for a place: the letters you type into a place field are sent to our server, which looks them up with Photon, a place search run by komoot on OpenStreetMap data. Your IP address is not passed on.
- Anonymous usage counts: when a trip is planned, saved, shared, opened, changed or completed, the app sends a short event: what happened, a code derived one way from the trip (not the trip itself, not your name), the day it concerns and the date. No name, email, device or IP address is stored with it, and it reads and sets no cookies. Usage counts are deleted after 12 months.
- Date night: what you write about the person you are going out with is sent with that one evening's request, used only for it, and not stored: not in a saved trip, a share link or the URL. A refresh loses it.
- Your AI choice: in the iPhone app we ask before anything is sent to AI. Your answer (yes or no), when you answered and which version of the text you saw are stored on our server. Without an account it is tied to an anonymous account with no name, email or password, which the app creates only for this. If the app has not used the service for 30 days, the anonymous account and the answer are deleted automatically; the app then asks again.
Share links
Making a share link stores that trip on our server under an anonymous account with no name, email or password, so the link can open on another device. If that browser has not used the product for 30 days, the anonymous account, its copy of the trip and the link are deleted automatically.
With an account
You can sign in with a link sent to your email, or with an email and a password. An account exists so your trips and settings follow you to other devices.
What is stored
- Your email address, and, only if you choose a password, the password as a one-way hash. We never see or store the password itself.
- Your profile: display name, language, currency, home airport, and the defaults you set for pace, travel style, interests, diet, alcohol and accessibility. Diet and accessibility are stored and used only after you consent on the profile screen; we store when you consented. Untick the box to withdraw: both are deleted, here and in your account. Your answer about AI (yes or no), when you answered and which text version you saw. You can change it in Profile at any time; saying no stops every AI request from the app.
- Your trips: destination, dates, the answers you gave, and every place, meal and open hour in the plan.
- Places and links you have saved.
- My World: the countries and places you mark, your notes and photos, your collections, the people you invite and the map links you share. Photos are kept in private storage and shown only through short-lived links.
- Share links you have made, and the anonymous reactions people left on them.
Signing in from a browser that already holds trips moves them into your account.
AI
Some features use Anthropic's Claude model, through our server: the one-sentence summary at the top of a trip; reading a change you ask for in your own words ("make tomorrow lighter"); choosing among replacements the planner already proposed when a day is disrupted; planning from your answers and the candidate places; and the date-night evening. The model may only use places, times and prices already in the plan. Anthropic processes these requests for us and, under its commercial terms, does not use them to train models. Your email address, your name and your location are never sent to Anthropic.
For each AI request we record the task, model, size, cost and an irreversible code (a salted hash) instead of your account or IP address, to keep within a spending limit. These records are deleted after 40 days: the limit is monthly, so a whole month must stay countable.
To stop abuse, we count requests per minute. The counters store only an irreversible code (a keyed hash) of your IP address or account, never the address or the account itself, and every counter is deleted after 24 hours.
Your location
The website and the iPhone app ask for your location only when you tap "Find the nearest stop" on today's plan. It is used once, on your device, to find the stop you are nearest. It is not sent to us or anyone else, and it is not stored. You can say no, or turn it off in settings at any time. Everything else works without it.
What is never collected
- Payment details. There is nothing to pay for.
- Anything for advertising: no ad network, no tracking pixel, no third-party analytics.
Where place data comes from
Places, opening hours and photographs come from OpenStreetMap, Overture Maps, Wikidata and Wikimedia Commons; city guides from Wikivoyage; forecasts from the Norwegian Meteorological Institute; climate from NASA POWER; travel advice from the UK Foreign Office and the US State Department; place names from GeoNames; travel times from OSRM. Our server fetches all of it; none of these sources receives anything about you. The sources page lists every licence.
Why we may use your data
- Contract (GDPR art. 6(1)(b)): planning your trips, your account, sync, sharing, AI features you use.
- Legitimate interest (art. 6(1)(f)): security and abuse limits, error handling, anonymous usage statistics and AI cost records. You can object; write to us.
- Diet and accessibility needs can reveal health or religion. They are used only with your explicit consent (art. 9(2)(a)), given where you fill them in, only to plan your trips, and you can withdraw it at any time on the profile screen. Ages are used as age groups to plan, under the contract.
How long we keep it
- On your device: until you delete it.
- Your account: until you delete it. Deletion is immediate and covers every row we hold about you, and the photos.
- Anonymous share accounts: 30 days without use.
- Usage counts: 12 months. AI cost records: 40 days. Abuse counters: 24 hours. Each is deleted automatically, every day or every hour.
Your rights
- Delete: delete your account from the profile screen. It is immediate and complete.
- Download: download everything stored in your account from the profile screen ("Download your data"). Any single trip can also be copied as text or added to your calendar.
- Correct: change your name and defaults on the profile screen.
- You also have the right to access, restriction, objection and data portability, and to complain to Datatilsynet (the Norwegian Data Protection Authority), datatilsynet.no.
Write to privacy@westengenstudio.com for anything else.
When more features are switched on
These exist in the code but are off in production today. Each adds text here when it is switched on:
Push notifications
- Adds
- Stored with an account: the address your device receives notifications on, its language and time zone. Recipient: Apple, Google or Mozilla push services (a notification with no content). Legal basis: consent.
Sign in with Apple or Google
- Adds
- A sign-in option, and an encrypted token kept only so it can be revoked when you delete your account. Recipients: Apple, Google (USA).
Google Places, Foursquare
- Adds
- Added to the place-data sources (server-side; nothing about you is sent).
Booking (flights and hotels)
- Adds
- Search data sent to the booking providers; the providers' names, their role as seller, and commission disclosure.
AI research on cities
- Adds
- No personal data; no change to this page beyond the AI section.
Changes
If this page changes in a way that affects what is collected, the date at the top changes with it.