Privacy

Itinerama has no accounts, no ads and no tracking. It keeps what a group trip needs, and nothing about who you are beyond the first name you type.

Itinerama is run by its maker, a private person in Switzerland. Questions, requests and complaints: zeus.dev.eng@gmail.com.

What a trip stores

• The trip: its name, the home town (name, country, coordinates), whose public holidays count, the currency, look and colour, the deadline, and the first names on the guest list.
• Each route: its name, one line about it, the start date, the stops (town, coordinates, nights, a note, costs) and how you travel between them.
• Stop photos are links to Wikimedia Commons with their author and licence; the photos themselves stay on Commons.
• The edit link is never stored, only a one-way fingerprint of it (SHA-256), so a database copy can’t be used to edit a trip.

What an answer stores

A trip takes up to 150 answers, and the planner can close the answers at any time.

• The first name you type, the route you pick, which parts of the trip you’re in for, your note, and when you answered.
• To keep one answer per device, your browser gets a random code in a cookie (itin_d, for 400 days, not readable by scripts). The trip keeps only a fingerprint of that code and the trip together, so your answers on different trips can’t be linked. It’s needed for the vote to work, so it isn’t optional, and it’s used for nothing else.

What stays on your device

• The trips you’ve made or opened (their link, name and, for your own trips, the edit link), the look you tried, and the first name you last used, in your browser’s storage, so the home page can list them. To show how many answers each one has and which route leads, the home page sends their share links (never the edit links) to Itinerama, which answers and keeps no record of the request.
• If you switch the theme, a cookie (itin_theme, for 400 days) remembers it. It holds only the word light or dark, goes with each page request so the page arrives in that theme, and isn’t stored by Itinerama.
• Photos you add to a reel are resized and stripped of their location and camera data in your browser and kept there. They are never uploaded. The video is made on your device.

Who else handles data

• Cloudflare hosts the app and the database (database location: the EU). It processes your IP address to deliver pages and to limit abuse (too many searches or answers in a minute); we don’t store it. Cloudflare is certified under the Swiss-U.S. Data Privacy Framework.
• Geoapify (Germany) receives what you type into the town search. We keep searches and their answers for a week to answer repeats faster; they aren’t linked to anyone.
• Wikimedia Commons receives photo searches from the editor, and your browser loads stop photos from it.
• Polar (polar.sh) sells the HD trip pass as merchant of record and handles the payment and its receipt under its own privacy policy. We receive only the order number and the trip it’s for; never card details.

The town list built into the app comes from GeoNames (CC BY 4.0), the map from Natural Earth (public domain) and the satellite imagery from NASA’s Blue Marble (public domain).

How long, and how to delete

• A trip and everything in it stays until the planner deletes it (Share tab, Delete the trip). Deleting removes the trip, its routes, its answers and its link preview at once.
• You can remove your own answer on the trip page at any time; the planner can remove any answer.
• Lost your edit link, or want a trip or an answer gone? Write to us with the trip link and we’ll help.
• The app’s error logs at Cloudflare (no addresses, no links) are deleted after a few days.

Your rights

You can ask what we hold about you, have it corrected or deleted, and object to its use, under the Swiss Federal Act on Data Protection and, if you’re in the EU or UK, the GDPR. Write to the address above. You may also complain to the Swiss FDPIC or your local data protection authority.

Itinerama isn’t meant for children under 16.

Last updated 1 November 2026.