Privacy Policy

Anyone with an account: the account holder who creates trips, and any traveler they invite to view or contribute to a shared trip.

We do not collect data through ads or third-party trackers. There are no analytics or advertising cookies on this service.

Ticket, receipt, and document scanning send the file you upload to Anthropic's Claude Haiku API to extract details (dates, amounts, document type). Nothing is saved to your account from a scan until you review the suggestion and confirm it — the AI step is read-only until you click Upload/Save.

• To operate the service: store and display your trips, documents, budgets, and media back to you and travelers you've shared a trip with.
• To power AI-assisted features (scanning, itinerary/budget suggestions) as described above.
• To send account and invite emails (magic links, sharing notifications).

We do not sell personal data, and we do not use it for advertising. When you pay for access, the payment is taken by Paddle, acting as merchant of record. Paddle collects your card details directly and we never see or store them. What we receive back from Paddle is only what we need to give you access and keep our records: the status and dates of your subscription, the amount and currency, and Paddle's own transaction reference. See the sub-processor table in the Data & Cookies notice.

Only the infrastructure providers needed to run the service. See the Data Processing & Cookie Notice for the full sub-processor list (currently Supabase, Vercel, Resend, Anthropic, OpenFreeMap). We do not share your data with advertisers, data brokers, or anyone else.

Within the app, sharing is opt-in and granular: a trip owner chooses which invited travelers can see a given trip, and per-document/ per-journal-entry sharing toggles exist for finer control. Travelers with view access to a shared trip cannot see trips that haven't been shared with them.

Data is stored in a Postgres database and private file storage (Supabase), with row-level security so every record is scoped to the account that owns it. File downloads use short-lived signed URLs rather than public links.

Honest caveat: as of this draft, no independent third-party security audit of this service has been completed. One is planned before any public launch. This section will be updated once that review happens.

Families using this service may live across multiple countries, and documents/trips may reference multiple countries and citizenships. Hosting infrastructure region: [confirm — Supabase/Vercel default region, to be stated explicitly once decided]. (future) If the service opens to users in the EU/EEA or UK, this section will need GDPR-specific transfer language added before launch.

This service is intended to be used by adults (18+) managing a family account. A traveler profile may include information about a minor (name, avatar, documents) added by the parent/guardian who holds the account — that is the account holder's responsibility, not a minor holding their own account. We do not knowingly collect information directly from a child creating their own account. If any invited traveler on a shared trip is a minor, the same rule applies: the inviting adult account holder is responsible for that data.

Data is retained while your account is active. Deleting your account removes your personal data from the service (see the in-app account deletion flow). To request deletion outside the app, contact travel@notetoself.online.

Depending on where you live, you may have rights to access, correct, export, or delete your data, and to object to certain processing. We honour access, correction, export, and deletion requests from anyone who asks, wherever they live, and we do not require you to cite a law to make one. You can delete your account and its data yourself at any time from within the app, or email travel@notetoself.online.

See the Data Processing & Cookie Notice.

We'll update the version stamp at the top of this document and, for material changes, notify account holders by email.

travel@notetoself.online