Privacy

What happens to what you tell the planner

Waypoints plans a trip in a conversation. This page says what that conversation sends where, what is kept and for how long, and how to erase it. It describes the planner as it runs in version 0.2.1.

What goes to the AI planning service

Each time you send a message, the planner sends the conversation so far (at most the last 24 messages), the trip brief built from your answers — the city, the dates, who is travelling and the children's ages if you gave them, the budget, pace, interests and any notes — and your language to an AI planning service run for this site. It answers, and when the trip is ready it stores the plan here. It receives a random session id, never your IP address or an account.

The planning service keeps its own record of a request — with your messages and the whole brief — for as long as that service is set to keep one, so that a failure can be looked into. That period is set on the planning service, not by this site, and erasing, below, does not reach that record.

Who else is involved

• The AI planning service — an automated workflow run by the team that runs this site — and the language-model provider it uses to write each answer (a hosted large-language-model service): your messages and the brief, as above, and what you do on the plan page — what you looked at and booked, never who you are (below).
• The hosting provider that runs this site and its database: everything this page says is kept.
• A weather service: your browser asks it for the forecast at the plan's first stop, for the trip's dates, and nothing else — though, like any site your browser reaches, it sees your IP address.
• OpenStreetMap, for the street map on a plan: when the map comes into view, your browser fetches the map's tiles from OpenStreetMap's servers, which see your IP address and the area being viewed — nothing from the conversation.
• OpenStreetMap, for the trip's sunrises, sunsets and opening hours: this site's server asks OpenStreetMap's place search (Nominatim) where a city is when the planner's own list does not have it, and its map data service (Overpass) for the opening hours of the places a plan visits. It sends the city's name and where the plan's stops are — nothing about you, and from this site's server, not your browser, so OpenStreetMap does not see your IP address.
• Google Maps and WhatsApp: only when you open a map or share a plan, and only what that link carries.
• The speech service built into your browser, if you use the microphone button. The button appears only in browsers that have speech recognition, and the listening is done by the browser, not by this site: depending on the browser, what you say is sent as audio to a speech service run by the browser's maker — Chrome and Edge use servers run by Google and Microsoft, Safari uses Apple's — or is recognised on your device. The audio does not come to this site, which receives only the text you choose to send, exactly as for a message you typed.
• Flights and stays: no travel company. Booking on this site is a demonstration: the offers are samples kept on this site, so showing them sends nothing anywhere, and a booking is paid with a test card and reaches no travel company or payment service — its confirmation email, when the site sends one, goes out through the site's own email service.
• A ticketing partner, when a stop offers tickets: "Book ahead" sends that stop and its city there.
• If you ask for a travel expert: nobody — while booking here is a demonstration, neither the contact you give nor how and when you ask to be reached is passed on or kept.

What is kept, and for how long

• Your plan and the brief behind it, under the plan's share code, for 180 days after anyone last opened it; then it is deleted. Anyone with the link can open it; "Erase this plan", on the plan itself, deletes it at once, and search results made for it expire on their own within a day.
• The conversation — what you typed, what the planner answered and what each answer changed in the brief — for 30 days, so the planner's answers can be checked; then it is deleted. Not your whole brief, not your IP address, not your browser. "Delete this conversation now", in the planner's footer, erases it at once.
• What you do on the plan page — which flights, stays and activities you looked at, what you booked and at what price, a checkout you left or a card that was declined — without who you are: no name, no contact, nothing you type into a form, no card and no booking reference. It is shared with the planning service with every message, and on its own when you book, leave a checkout or have a card declined, ask for a travel expert, or rest on a choice while browsing — a flight, a stay or an activity you open, a pin on the map — so the planner knows what you have already seen and booked and can say something about it. It is kept as long as the conversation, 30 days, and "Delete this conversation now" erases it with the conversation.
• When the planner answers in the background, your message — with the conversation so far and the brief sent with it, children's ages included — waits in a queue until it is answered, and the answer waits there for the page for at most 10 minutes; whatever is left of it is deleted within 20 minutes of the message being sent.
• If you book, the order keeps a contact email and phone, a billing address and the names a booking needs: every traveller's for a flight, only the lead guest's for a hotel or an activity. Dates of birth are asked for flights only, where the fare depends on each traveller's age. On an order that expired unpaid, or failed without ever reaching the travel operator, those details are removed 30 days after it last changed. An order the operator took, or may have taken, keeps them: a paid booking as its booking record, and a failed one, so that it can be settled with you. How long a booking record is kept is the travel operator's decision; until it is made, nothing on this site deletes one.
• If you ask for a travel expert while booking here is a demonstration, neither the contact you give nor how and when you ask to be reached goes anywhere, and this site does not keep them.
• Backups of this site's database, taken on its host's schedule: something erased or expired here leaves them only as the older backups are replaced.

What stays in your browser

This browser remembers the last 4 plans you opened here, for 30 days, so it can offer to reopen one; erasing a plan removes it from that list too. For up to 8 plans it also keeps, for 30 days, what you booked on them here — each booking's reference, title, price, dates and how many are travelling — so the plan says "Booked" again, and whether you folded or opened their flights and hotels; never a name, an email or anything typed into the checkout, and erasing the plan removes these too. If you tell the planner where you are flying from, this browser also remembers that city, for 30 days from the last time you said it, and offers it as the first answer the next time the flights ask where you are leaving from. While you plan, it is also sent to the planning service with each message, as a suggestion it may offer you; it is never filled in for you. Erasing a plan does not remove it; clearing this site's cookies, below, does. The session id, and the campaign a link came from, are kept in this tab only and go when it closes. A cookie remembers a language you chose, and another ties everything this browser keeps for the planner to you: clear this site's cookies and the planner forgets all of it — the list, the departure city, the conversation, the session — and starts over as if you had never visited. The planner page also sets three short-lived cookies of the web framework — a session, its contents and a token that stops other sites forging requests — which expire after 2 hours.

No account, no tracking cookies, and no advertising or analytics script from anyone else.

Counting visits

We count how visitors move through the planner — a city page seen, a conversation started, a plan made, shared or exported — in this site's own database: the event, the session id, the plan's code, the language and the campaign a link carried. Never your IP address, your browser or anything you typed; nobody outside this site sees it. The counts are kept without a time limit: nothing in them says who you are.

Your country

Your country is estimated from your IP address, on this server, using DB-IP's database (CC BY 4.0), to choose a starting language and, for flights, where you are likely to leave from. The planning service is told that country too, so it can ask where you are travelling from rather than guess. Your IP address is not stored with anything you do here; to stop one address flooding the site, its requests are counted for a minute at a time under a keyed one-way hash of your address, deleted within two hours.

Erasing

A plan: "Erase this plan", on the plan. The conversation: "Delete this conversation now", in the planner's footer. A booking: through the travel operator, with its reference.

"Delete this conversation now" deletes, at once, this site's copy of the conversation open in this tab: every message recorded under its session id, and anything of it still sitting on the queue — your last message, with its brief, not yet answered, or an answer not yet read. It does not reach the plan, which has its own erase; the counted visits, which hold none of your words; the planning service's own record of a request; or the backups. A queued answer nobody erases is deleted within 20 minutes of its message regardless. Once the tab is reloaded or a new session is started, the conversation can no longer be deleted from the page, and it is deleted when its 30 days are up.

Questions

Questions about this page go to the team that runs this site.