Privacy

• Your sign-in details. If you sign in with Google, Teepee gets your name, email address and avatar image from Google. It also stores the OAuth tokens Google issues for your session: the access token, refresh token, ID token, the granted scope, and a session token that identifies your browser. If you use a sign-in link, Teepee stores the email address you typed, sends one email to it through Resend, and keeps a one-use sign-in token that expires after a day. The account it creates holds only that address.
• Everything you put in a trip. The stops, transport, accommodation, items, costs, notes, journal entries and checklists that you and the other travellers on a trip enter.
• Your Globe. Markers for places you, and anyone who shares your Globe, want to visit someday. The Globe belongs to your account and is kept apart from any trip.
• A record of changes to a trip. When someone creates, changes or deletes a stop, item, transport, accommodation, chapter or cost, or leaves a note, it is logged as an activity: who did it, when, and for a change, which fields went from what to what. This is the trip's shared history. The travellers on that trip can see it.
• Files you upload. Attachments such as tickets, confirmations and screenshots.
• Push subscriptions. If you turn on the Digest on a device, Teepee stores what that device's browser gives it to deliver a push notification. It also stores a rough device type ("iPhone", "Mac" and so on, worked out once from the browser's user agent and never anything more specific), the timezone that device last reported, and when it was last seen.
• Error reports. When something in Teepee breaks, including a failure caught in your browser, it records the error message, a stack trace, the route it happened on, and your account id if you were signed in at the time. The error is also written to Vercel's own runtime logs. The first time a given server-side failure is seen, its raw error message is pushed to each Admin's device, if they have one registered. A repeat of the same failure only bumps a count and is never pushed again. A failure reported by a browser is never pushed this way at all.
• Access requests, including from people who never get an account. Teepee is invite-only. If you try to sign in, with Google or by asking for a sign-in link, and your address is not on the invite list, sign-in is refused and no link is sent. The refusal itself is recorded: your email, how many times you've tried, and, from Google, your name and avatar. That way I can see who has asked and decide whether to invite them. So Teepee can hold a record about you even if you are never granted an account. I can approve a request, which grants access, or dismiss it. A dismissed request is closed for good. It does not come back to the Admin queue, even if you sign in again.
• Feedback notes. A note you write to me about Teepee itself (a bug, an annoyance, a suggestion) carries the note text and where it was written: the route, a page label, the trip you were viewing (if any), your browser's viewport size and user agent, and your name. In the app you see only your own notes. Only an Admin sees everyone's.

Nothing in Teepee is sold, and nothing is shared for marketing. These are the services Teepee's code contacts:

• Google: sign-in. Your avatar image is also loaded straight from Google by whoever's browser is showing it, so Google sees that request too, apart from sign-in.
• Apple Push and FCM (Firebase Cloud Messaging): deliver the Digest and other push notifications to your devices.
• OpenStreetMap (Nominatim), Photon (komoot) and CARTO: turn place names you type into map coordinates (Photon for as-you-type search, Nominatim when a place is saved), and draw the map tiles you see on the Summary, the Globe and the Day map.
• Open-Meteo: a stop's coordinates and a day's date, sent to get a weather forecast. For a date too far out to forecast, it gives a typical reading from the same calendar date last year.
• Frankfurter: currency codes (for example "AUD" → "EUR"), sent to get an exchange rate. Only the currency pair is sent, with no trip content.
• Resend: sends the sign-in link email. It sees the address the email goes to and the link inside it.
• Anthropic (Claude), an optional AI assist. It is off unless I turn it on. Teepee has an AI assist for three things: suggesting activities, drafting a packing list, and reading a booking you import (a Booking import). It only runs if I have set an API key for it. That is a deployment setting, so it can be switched on or off without any change to this page. When it is on, Teepee sends: a stop's name and country, plus the titles of the items already on that stop (so it doesn't repeat them), for a suggestion; the trip name with its stops and dates, for a packing list; or, for a Booking import, the file you choose to import or the entire text you paste in, to be read. That can include names, addresses and booking or confirmation numbers, since it is whatever you chose. Teepee keeps it only if you confirm something it found: an imported PDF or image is then saved to that entry as an Attachment. Pasted text and emails are never kept.
• Cloudflare R2: stores uploaded attachments and trip cover images.
• Vercel: hosts the app, runs the database migration on a production deploy, and runs the Web Analytics and Speed Insights described below.
• Neon: hosts the database.
• GitHub: the nightly database backup (see "How long it is kept" below) is uploaded to GitHub as a GitHub Actions build artifact and stored there for up to 30 days. It is a complete copy of the database, with every trip, note, email address, access request and error report in it. Who can download a GitHub Actions artifact is exactly who can read the repository it belongs to. That setting lives on GitHub, not in Teepee, and I can tell you what it is today.

Teepee has no advertising and no ad-tech trackers. There is no cross-site tracking, no ad targeting and no data broker, and nothing is sold.

Teepee uses Vercel Web Analytics (part of the Vercel hosting above) to count page views in aggregate: which pages get opened, on what kind of device, plus the referrer and a rough country. Vercel's own infrastructure adds those details. None of it is read from your account. It uses no cookies and builds no personal profile.

Teepee also uses Vercel Speed Insights (part of the same hosting) to measure how quickly pages load and respond on real devices. It gets the page address, the kind of device and the timings. That is page timing only, no trip content.

A share link's address carries a secret token, so that token is stripped before the page view is sent to analytics, and before a page timing is sent to Speed Insights. It still appears, unredacted, in an error report if that page happens to throw (see "What Teepee collects" above).

A trip's id in an address like /trips/… is left in the analytics on purpose, so usage can be broken down per trip. A trip id is useless to anyone without an account on that trip. Beyond those page views and page timings, there is no other analytics.

• Database backups run nightly, so there is a way back if a bug or a bad migration damages data. Each one is held on GitHub for up to 30 days as a build artifact. During that window I also copy it to storage outside GitHub. This page makes no claim about how long that separate copy is kept.
• Deleted files are kept for at least 35 days after you delete them, so they still exist in any backup taken before the deletion. After that they are removed the next time I run the cleanup. There is no scheduled job that does this on its own.
• Error reports and access requests are not deleted on a timer. An Admin can clear an error report once it is understood, and approve or dismiss an access request. Until then, both sit in the database (and so in the nightly backups above) like everything else.

There is no self-serve export yet. Ask me and I'll send you a copy.