Privacy Policy

Otinerary is operated by David Kim. The initial service audience is in the United States. This policy explains the information processed by the service and the choices available to users. The stated audience and governing law do not mean that the same privacy laws apply to every user.

For privacy questions or requests for a copy, correction, or deletion of your data, contact davidkim9299@gmail.com.

• Account: email address, identifiers related to email verification and sessions, display name, the display language you chose, the accepted Terms version and time, and the Privacy Policy version presented.
• Trips and collaboration: trip names, trip tags, destinations and additional destinations, dates, time zones and currencies, visit and travel itinerary items, descriptions and private notes, companion display names, memberships, invitations and roles.
• Places: names, addresses, coordinates, time zones, countries, provider place identifiers, data sources, licenses and selected saved information. This includes places created manually.
• Bookings: lodging, flight and transport bookings entered by users, dated segments, booking references and related notes.
• Expenses: dates, amounts, currencies and exchange rates; payers, cost sharers and shares; refunds; optionally linked itinerary items or bookings; shared-fund contributions, spending, returns and claims; settlement calculations, recorded actual payments and change history.
• Photos and public trips: processed trip photos, publication links and versions, photo confirmations and withdrawals, and relationships and provenance for saved and copied public trips. Status information for unconfirmed upload candidates and cleanup targets after replacement or removal may remain temporarily. Existing files and references for retired STOP photos and previous standalone public covers are retained and cleaned up separately from new upload features.
• Saved places and trips: places you save in Explore (name, address, coordinates, provider place identifier) and the public trips you save. Only you can see them.
• Security and operations: identifiers and times for access, changes, confirmations and deletion requests; audit records; request limits; and duplicate-request protection. App request limits use pseudonymous identifiers derived from IP addresses. This is separate from connection and operational logs processed by hosting, authentication and email providers.

This account flow does not collect birth dates, passwords or card payment information. Expense features provide trip records and calculations; they do not execute payments or transfers. Please avoid putting such information in free-text fields or photos.

We use information for sign-in and account protection, trip planning and collaboration, booking records, expense sharing and settlement calculations, publishing, saving and copying public trips, and handling inquiries and data deletion. We also use operational records needed to check permissions and request limits and investigate errors or misuse.

Minimal records of photo confirmations and processing results identify what was confirmed, prevent duplicate application of requests after failures, lost responses or retries, and track publication withdrawals and deletion. Necessary minimal links to authentication identifiers and the original request, withdrawal and processing times may be managed separately as protected encrypted evidence to prevent deleted or withdrawn information from reappearing when older backups are restored. Email addresses, authentication tokens and photo content are not retained long term in this evidence. Encrypted evidence and restoration keys are kept in restricted storage. Unnecessary identifier links and keys are minimized when their purpose and the permitted restoration period end. Providers' separate backup and retention scopes are described based on verified contracts and settings. These purposes alone do not justify continued retention of unused photo files.

Anonymous statistics and recommendations: we add up, only as counts per place or trip, the places added to users' itineraries and lodging bookings and the places and public trips users save. Explore uses these counts to show frequently used places first and displays them only as numbers such as “Used in N trips” or “Saved by N people.” Only places identified by a map provider or Wikidata are counted; manually created places, itinerary descriptions and notes, trip dates, companions, booking details, expenses and photos are not used. We never show other users who used or saved a place, and places used or saved by fewer than 3 people are neither shown with a count nor used for ordering. Deleted trips and accounts are excluded from later statistics.

The original trip is private collaboration data accessed according to membership and roles. A public trip is a separate public version that a user reviewed and published, and it may be displayed to internet users.

Public titles, descriptions, author display names, trip tags, destinations, relative DAYs and order, included STOP/MOVE descriptions, selected local times, time zones and stay information, place names, addresses, saved coordinates and sources, and trip photos approved for public display may be published.

The original actual trip dates, companions, booking references and details, expenses, private notes and authentication identifiers are excluded. Editing the original title, description or itinerary does not change already-published text. To publish those changes, you must review them in a publication update.

Replacing or removing a trip photo, or adding the first photo while published, requires a separate review of the photo state and its public effect. The confirmed state applies to both the private trip photo and the public photo. Approving only the photo does not also publish unreviewed title, description or itinerary changes.

Changing private text or photos while publication is stopped does not republish the trip automatically. Republishing requires reviewing the current text and saved trip photo, or the no-photo state, again.

Addresses and coordinates of manually created places may also be public. Personal information in free-text titles, descriptions and itinerary notes, or inside photos, is not all removed automatically. Review the preview before publishing.

Trip photos are private by default. The existence of a saved photo or a previous public cover does not create new permission to publish it. Trip photos are managed in Edit trip details; publication management has no separate photo picker. Uploading or publishing STOP photos and choosing a standalone public cover are currently unavailable. Retiring a feature and physically deleting its old files are separate actions.

Initial publication and republication require reviewing the text and saved trip photo, or the no-photo state. If there is a photo, you must review its rights, personal information and public effect. Confirming no photo does not approve photos added later. Replacement, removal and first-photo additions while published also require reviewing the state being applied and its public effect.

Canceling before confirmation leaves the previously confirmed trip photo and publication state unchanged. If confirmation fails and does not reach the server, the previous confirmed state remains. However, a response can be lost after the server saves a change, so a network error alone does not prove it was not saved. Check the screen again or retry the same request to confirm the current result. Unconfirmed upload candidates may remain queued for cleanup.

Ordinary sign-out or normal session termination does not withdraw a previously confirmed public photo display approval. An ended session cannot make new changes or reuse an unused confirmation proof. Explicit publication withdrawal, unpublishing, and restrictions based on the current account, permissions, trip, photo and publication state continue to apply.

Current trip photo uploads send an image cropped and resized in the browser and store a server-reencoded file. This path does not retain the selected original file unchanged or include additional metadata such as EXIF or GPS in the stored file. This describes the current path; it does not mean every historical file was rechecked or converted retroactively. Faces, addresses or documents visible in the image may remain, so review photos before uploading and publishing.

Copying a public itinerary in the app excludes photos, previous public covers and photo publication permissions. Approving public display does not grant others the right to copy a photo. Image bytes already delivered externally, or screens and files saved separately by others, cannot be recalled after unpublishing.

We use Vercel for web hosting and request processing, and Supabase technology for authentication, the database and photo storage. Account, trip, photo and connection information needed to provide the service may be sent to or stored by providers according to the feature. Email authentication may send the recipient address and verification message to the configured SMTP provider. The actual email provider and what it retains are described based on verified deployment settings and contracts. Local development mailboxes are separate from the service's actual email provider.

On the live site we use Vercel Web Analytics and Speed Insights to count visits and measure page speed without cookies. The visited page address (query strings such as search terms are removed before sending), the referring site, country, browser, operating system and device type, and speed measurements may be sent to Vercel. Vercel distinguishes visitors only with a hash that resets daily. We use this information only to understand overall service usage and performance, not to identify individuals.

Geoapify may receive destination and place search terms and search areas entered by users, and the two endpoint coordinates and travel mode of routes they request. Trip notes, expenses and photos are not included in map search or route requests.

When an Explore search or a trip's place search (“Search other names”) has no or few results, the search text you entered and the selected city and category may be sent to the AI provider Anthropic to suggest corrected search terms. For a trip's place search, the trip's destination name and country are sent instead of a city. Account information and the rest of the trip (itinerary, notes, companions, bookings, expenses and photos) are not sent. Anthropic's Privacy Policy

In the same searches, the search text may be sent through Otinerary's servers to the search service of Wikidata, operated by the Wikimedia Foundation, to check a place's names in several languages. “Famous” places in Explore are looked up in public Wikidata and Wikipedia information using the coordinates and range of the selected area. These requests are sent by Otinerary's servers, so your IP address, browser information, account information and trip contents are not sent.

Place photos in Explore and Saved are fetched from Wikimedia Commons by Otinerary's servers and shown from there. Your browser does not connect to Wikimedia's servers to show a photo, so your IP address and browser information are not sent to Wikimedia. Account information and trip contents are not sent either. Tapping the credit under a photo opens the Wikimedia page, where Wikimedia's privacy policy applies. Wikimedia privacy policy

When Google Maps is displayed, the browser connects to Google's map service, which may process map location, network and device information. If Google Routes public transit routing is offered, requested endpoint coordinates and travel mode are sent and results are displayed temporarily. These requests are not sent while public transit routing is currently paused. Actual trip dates and times, notes, expenses and photos are excluded from route requests.

Opening an external Google or Apple Maps link may send the destination name, address or coordinates. Otinerary does not collect the device's current location through this feature. If the external map service requests location access, you choose within that service.

The Ko-fi support link in My account opens the external Ko-fi service, whose policies and payment terms apply. Supporting through Ko-fi may provide your email and support details to the operator depending on your selected display and transaction settings. Otinerary does not collect card details directly or execute a payment through this link. Support information received externally by the operator is separate from app trip-data processing. We do not describe support as a tax-deductible donation.

Information needed to provide the service may be processed in the United States or other countries depending on providers and operating environments. Providers' connection and operational logs and backups have separate retention scopes under their contracts and policies. You can review Vercel's privacy notice, Supabase's Privacy Policy, Google's Privacy Policy, Geoapify's Privacy Policy, Ko-fi's Privacy Policy. Providers' own notices are separate from contractual processing of information Otinerary entrusts to them as a customer. You can contact the operator about the processing or deletion of your information.

We use authentication, session, CSRF and pre-authentication request-protection cookies needed to keep you signed in and protect requests. Browser tab storage may contain invitation state, publication drafts, photo confirmation work, the place you chose in Explore to add to a trip, and necessary temporary information. Choosing “Later” on the prompt to publish a finished trip is kept in this browser's storage per trip and is not sent to the server. On sign-out, the app attempts to clear account-linked temporary work state it manages. Browser storage restrictions may prevent cleanup. Ending a session is separate from withdrawing a public photo on the server. You can clear stored site data in your browser settings.

After an account deletion request, an encrypted status cookie tied to a single request may be used for up to 30 minutes so you can check progress in the same browser. Page scripts cannot read it directly, and it grants neither sign-in access nor new deletion authority. Status access expiry is separate from deletion times for minimal server records and backups. After access expires, you can make an inquiry with the necessary identity verification.

The app currently has no added proprietary advertising trackers, cross-site behavioral advertising or behavioral analytics tools. It offers no feature designed for the operator to sell or share personal information for those purposes. The legal classification and contracts for information processed by external map, hosting and other providers are assessed separately under their services and applicable law.

Because the app does not conduct its own cross-site behavioral advertising, browser Do Not Track signals do not change such app tracking behavior. External services such as Google Maps follow their providers' policies. Where applicable law requires handling choice signals such as Global Privacy Control, processing and notices must meet those requirements.

We retain information needed to provide accounts and trips, current private trip photos and confirmed publication links while their use or references continue. Our operational standard is to review retention needs at least once a year and clean up information no longer in use under the criteria below. Audit or dispute handling alone does not justify permanently retaining unnecessary photo files.

Replacing or removing a trip photo, or unpublishing, changes access or display on screen; it does not mean the file is physically deleted at the same time. Our operational target is to remove actual stored files for replaced or removed photos within 7 days after confirming cleanup eligibility, once valid references and confirmation success, lost responses and retry states are resolved. Canceled, expired or failed upload candidates are targeted for cleanup within 24 hours after the last valid confirmation and lease period ends and success and references are checked. Candidates left uncertain by lost responses are reinvestigated within 7 days and are not deleted before the responsible person verifies whether they succeeded.

Follow-up cleanup is limited to explicitly confirmed requests and targets whose references and processing states have been reviewed. New account deletion requests and trip photo changes confirmed after this policy takes effect are handled within their reviewed scope; older stored material is not cleaned up in bulk. Existing material directly included in a new account deletion request is reviewed individually for valid references and scope. Bulk automatic cleanup of retired STOP photos, previous standalone public covers and existing unprocessed files is not enabled. Follow-up work requiring separate review is shown as waiting or on hold until its scope and conditions are confirmed, and is distinguished from actual deletion completion. Rights inquiries and deletion requests remain available. A need for protection or review alone does not postpone statutory request receipt or response deadlines.

Deleting a trip blocks access to the original and its publication. The manager who deleted it can restore it for 30 days. This is a trip restoration period, not the retention period for every photo. After the restoration deadline, our operational target is to check valid references and necessary exceptions and remove eligible trip data and photos from service storage within 7 days. Expiry alone is not shown as completed cleanup, and restoring a trip does not republish it automatically.

Saved places and saved public trips are deleted as soon as you remove them; on account deletion they are cleaned up on the same basis as other personal information in the service.

Final confirmation of account deletion blocks app account access and that user's public versions and changes display information to “Former user.” This is separate from completed deletion of personal information, the authentication account, photos and backups. The trip's 30-day restoration period does not apply to account deletion. Our operational target is to remove eligible personal information, authentication accounts and photos within the service within 7 days of confirmation. Request receipt and access blocking, review and waiting or holds, actual processing and retries after failure, and confirmed service cleanup are distinguished. Where valid references, external dependencies or legal exceptions remain, we explain the remaining scope and reasons. Applicable statutory response and processing deadlines are followed separately.

Itinerary, expense and settlement records in shared trips with participation by other accounts may be retained as needed for others' data integrity and use or settlement of the trip. The deleted person's display name is changed to “Former user.” Private notes, booking references and account links no longer needed are removed in follow-up cleanup. Changing a label alone does not make every record irreversibly anonymous. Roles must be resolved before account deletion in shared trips that require a manager.

The operational retention standard for minimal pseudonymous records of publication confirmations, withdrawals and deletion processing is 2 years from the first recorded confirmation that their purpose has ended. Detailed retry results for ordinary commands are retained for 90 days from the original record. Old creation times alone do not establish purpose completion, and retries or restoration do not extend the original time. Valid references and necessary business evidence are protected. Even when unnecessary details are later minimized, minimal non-content records preventing command replay or revival of withdrawn states are retained. Structural history needed for shared expense records is distinguished from the retention needs of those records. Individual exceptions, such as legal disputes, specify necessary scope, duration and responsibility and are reviewed regularly. Pseudonymous records are protected as personal information that may permit reidentification.

Operational targets are 14 days for ordinary access and error logs, 90 days for security incident investigation records, and 7 days after purpose completion for email delivery status. This does not mean providers already have matching retention or automatic deletion settings. App request-limit event records are considered for cleanup after 8 days, and expired temporary request permits after 1 day past expiry, with references and processing state checked. Authentication codes, session tokens, user free text and photo content are restricted from general logs. Actual retention of externally managed logs and email delivery records follows verified contracts and settings; identical periods or bulk deletion through the app are not guaranteed.

Our operational target is 30-day rolling backup retention. This does not mean all providers currently have the same backup lifespan or automatic expiry settings. Actual backup types, retention periods and restoration coverage are described based on verified contracts and settings. Information removed from service storage may remain in existing backups, which have restricted access during the permitted retention and restoration period and are not used for ordinary service delivery. On restoration, verified deletion and publication withdrawal states are reapplied before access is allowed to prevent deleted data or withdrawn photos from reappearing. Database backups alone do not back up or restore photo files; stored files are managed separately.

Current deletion and withdrawal evidence and encrypted links needed for restoration are not discarded before restorable backups reach the end of their lifespan. They are minimized per target after checking retention deadlines after purpose completion, approved backup restoration deadlines and necessary exceptions. If evidence, keys or current state are missing, or a backup is older than its permitted restoration deadline, service access is blocked first for review. Authentication identifiers or deletion states are not guessed and generated automatically. Completed service cleanup, retention of necessary minimal records, and backup remnants or expiry are described separately.

Deletion within the service does not recall independent trip copies already created by other users or screens and files stored externally. Delayed cleanup or information remaining under specific exceptions is explained separately from completed deletion. Contact the operator about current processing status or a specific request.

You can edit your display name and request account deletion in My account. Depending on trip permissions, you can view and edit information, delete a trip or stop publication. Saving a photo, approving its public display, accepting the Terms and receiving the Privacy Policy notice are separate actions.

To access, obtain a copy of, correct or delete personal information, or exercise rights under applicable law, contact davidkim9299@gmail.com. We review your identity and the request's scope and respond under applicable legal deadlines and exceptions. Sending an email does not complete a request automatically. If further verification or some retention is needed, we explain the necessary reasons and status.

Rights based on residence, including California, may vary with the law's applicability requirements. We do not unfairly discriminate because you make a rights request. Role-resolution requirements before account deletion protect shared-trip permissions and records; they are not a reason to refuse a legal privacy rights request to the operator.

Privacy and account provides the account features and contact options.

Otinerary is intended for users aged 18 or older. We do not request a birth date; age eligibility and Terms acceptance are confirmed during initial account setup. This confirmation alone does not guarantee verification of every user's actual age. Notify the operator if you identify use that does not meet the age requirement.

We use access controls checking membership, roles and ownership, database row-level permissions, private photo storage, request protection and limits. Public photos are served through app routes that verify current publication state and the photo's confirmation and permission conditions. Sign-out is separate from publication withdrawal; account, permission and publication restrictions continue to apply. These measures do not eliminate every risk or guarantee complete security.

When information processing changes, we update this policy and its revision date. Material changes are announced appropriately, such as within the service. Changes requiring separate consent or other procedures under applicable law follow those procedures. Policy notice, Terms acceptance and confirmation of a specific photo for publication do not substitute for one another.

For inquiries, contact the operator, David Kim, at davidkim9299@gmail.com.