Privacy Policy
Last updated: August 30, 2026
Introduction
Whimsy Travel ("Company," "we," "us," or "our") operates the Whimsy web application and related services (collectively, the "Service"), a travel planning tool that helps you map out trips, activities, and photos.
This Privacy Policy explains how we collect, use, disclose, and protect your personal information when you use our Service. It also describes your rights regarding your personal data and how to exercise them.
By using our Service, you agree to the collection and use of information as described in this policy. If you do not agree, please do not use our Service.
Information We Collect
Information You Provide Directly
Account Information. When you create an account, we collect:
- Email address
- Password (stored securely as a salted hash — we never store plaintext passwords)
- Name, if you provide it
- Profile information you choose to provide
User Content. When you plan trips, we collect:
- Trip details: destinations, activities, dates, notes
- Photos you upload to a trip
- Trips you choose to make public through our public trip sharing feature
Before a trip appears on our public sharing page, its photos are checked by an automated moderation service (OpenAI) to screen for inappropriate content. The photos are sent to OpenAI for this check and are not stored by the service.
Communications. When you contact us, we collect your email address, name, message content, and any attachments you send.
Payment Information. When you subscribe to Premium, payment is processed by our payment provider, Stripe, on Stripe's hosted checkout page. We do not collect or store your credit card number. Stripe collects your name, billing email, billing address, and card details directly, under Stripe's own privacy policy. We receive from Stripe only what is needed to run your subscription: your subscription status, plan, and billing email.
Information Collected Automatically
Log Data. Our hosting provider records standard server logs, including:
- IP address
- Browser type and version
- Pages visited and time spent
- Date and time of access
Device Information. Device type (desktop, mobile, tablet), screen resolution, language preference, and time zone.
Information from Third Parties
Google Sign-In. When you sign in with Google, we receive your email address, name, and profile picture from Google. We only request the minimum information necessary to create your account.
Map Services. When you search for or view places, search queries are sent to Mapbox (map tiles and city autocomplete) and Photon (komoot) (hotel and location search, based on OpenStreetMap data). Place photos shown on trip activities are fetched from Google's servers. These providers may process your search queries and IP address according to their own privacy policies.
Cookies and Local Storage
We use a small number of cookies and browser storage technologies to keep the Service working.
| Technology | Purpose | Duration | Type |
|---|---|---|---|
| Session cookie (JWT) | Keeps you signed in | Session (Secure, httpOnly) | Strictly necessary |
| localStorage (theme) | Remembers dark/light mode preference | Persistent, until cleared | Functional |
| localStorage (map) | Remembers map view preferences | Persistent, until cleared | Functional |
We do not use analytics, advertising, or marketing cookies. You can clear localStorage and cookies at any time through your browser settings. Disabling the session cookie will sign you out.
How We Use Your Information
- Create and manage your account
- Provide the Service: store your trips, activities, and photos
- Show your trip data on maps and plan your route
- Publish trips you choose to make public
- Moderate photos on public trips to screen for inappropriate content
- Send transactional emails (password resets, account notices)
- Process Premium subscriptions and payments (via Stripe)
- Provide customer support
- Analyze usage patterns to improve the Service
- Detect and prevent fraud, abuse, and security incidents
- Comply with legal obligations
Legal Basis for Processing (EEA/UK Users)
If you are in the European Economic Area or the United Kingdom, we process your data under these legal bases:
| Purpose | Legal Basis |
|---|---|
| Providing the Service and account management | Performance of contract |
| Transactional communications | Performance of contract |
| Analytics and service improvement | Legitimate interests |
| Security and fraud prevention | Legitimate interests |
| Legal compliance | Legal obligation |
How We Share Your Information
We do not sell your personal information. We share your information only with the service providers required to operate the Service:
| Provider | Purpose | Data Shared | Privacy Policy |
|---|---|---|---|
| Vercel | Hosting | IP address, request logs | vercel.com/legal/privacy-policy |
| Mapbox | Map tiles and city autocomplete | Search queries, IP address | mapbox.com/legal/privacy |
| Photon (komoot) | Hotel and location search | Search queries, IP address | komoot.com/privacy |
| Sign-In with Google, place photos (server-side) | Account info (email, name, photo) on sign-in | policies.google.com/privacy | |
| Backblaze B2 | Photo storage | Uploaded photos | backblaze.com/company/privacy-policy |
| Stripe | Payment processing for Premium subscriptions | Billing email, name, billing address, card details (collected and stored by Stripe) | stripe.com/privacy |
| Resend | Transactional email delivery (account verification, password resets) | Email address | resend.com/privacy |
| OpenAI | Automated moderation of photos before they appear on public trips | Trip photos (public trips only, processed transiently, not stored) | openai.com/policies/privacy-policy |
| Backend API provider | Core service: accounts, trips, activities | Account data and trip content | — |
These providers are contractually obligated to use your data only for the services they provide to us, to protect it with appropriate security measures, and to delete or return it when the relationship ends.
We may also disclose your information if required to comply with a legal obligation, subpoena, or court order; to protect our rights, property, or safety; or to detect, prevent, or address fraud, security, or technical issues. If we are involved in a merger, acquisition, or sale of assets, your information may be transferred; we will notify you before your data becomes subject to a different privacy policy.
International Data Transfers
Your information is processed and stored in the United States and Canada. If you are in the EEA or the UK, your data may be transferred outside those regions. When we do this, we rely on appropriate safeguards, including adequacy decisions and EU-approved Standard Contractual Clauses with our service providers. Some US providers are certified under the EU-US Data Privacy Framework.
Data Retention
We retain your information for as long as necessary to provide the Service to you, comply with legal obligations, resolve disputes, and enforce our agreements.
| Data Type | Retention Period | Reason |
|---|---|---|
| Account data | Until account deletion | Service provision |
| Subscription and billing records | Until account deletion | Service provision |
| Trips and photos | Until account deletion or deletion request | Service provision |
| Server logs | Up to 90 days | Security and debugging |
When data is no longer needed, we securely delete or anonymize it.
Data Security
We implement appropriate technical and organizational measures to protect your information:
- Encryption in transit (TLS/HTTPS)
- Passwords stored as salted hashes, never in plaintext
- Access controls and authentication on our systems
- Secure, httpOnly session cookies
However, no method of transmission over the Internet or electronic storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security. If you discover a security vulnerability, please report it to whimsy.travelapp@gmail.com.
Your Rights and Choices
All Users
- Access: Request a copy of your personal data
- Correction: Update or correct inaccurate data
- Deletion: Request deletion of your data
EEA/UK Users (GDPR)
If you are in the EEA or the UK, you also have the right to erasure ("right to be forgotten"), to restrict processing, to data portability, to object to processing based on legitimate interests, and to withdraw consent at any time.
To exercise these rights, email us at whimsy.travelapp@gmail.com with "GDPR Request" in the subject line. We will respond within 30 days. You may also lodge a complaint with your local data protection authority.
California Residents (CCPA/CPRA)
Under the California Consumer Privacy Act and California Privacy Rights Act, you have the right to know what personal information we collect, use, and share; to request deletion of your personal information; to correct inaccurate information; and to non-discrimination for exercising your rights. We do not sell or share personal information as defined by the CCPA.
Categories of information collected in the past 12 months:
| Category | Collected | Source | Purpose | Shared With |
|---|---|---|---|---|
| Identifiers (email, name) | Yes | You, Google | Account | Backend provider |
| Payment and billing information (subscription status, billing email) | Yes | Stripe | Premium subscriptions | Stripe |
| User content (trips, photos) | Yes | You | Service provision | Backblaze B2, OpenAI (public trip moderation), backend provider |
| Internet activity (logs) | Yes | Automatic | Security | Vercel |
| Search queries | Yes | You | Maps and place search | Mapbox, Photon (komoot) |
To exercise these rights, email whimsy.travelapp@gmail.com with "CCPA Request" in the subject line. We will verify your identity before processing requests.
Children's Privacy
Our Service is not directed at children under 16, and we do not knowingly collect personal information from children under 16. If you are a parent or guardian and believe your child has provided us with personal information, contact us at whimsy.travelapp@gmail.com and we will delete it promptly.
Third-Party Links
Our Service may contain links to third-party websites or services. We are not responsible for their privacy practices. We encourage you to read their privacy policies before providing any information.
Changes to This Privacy Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new policy on this page and updating the "Last updated" date above. We encourage you to review this policy periodically.
Contact Us
If you have questions about this Privacy Policy or our data practices, contact us at whimsy.travelapp@gmail.com.