Privacy policy — Journey Builder

This policy explains what personal information Journey Builder ("we", "us") collects, why, who we share it with, and the choices you have. It covers this website, journeybuilder.app, the Journey Builder app at roadtrip.journeybuilder.app, and Facebook Pages and Instagram accounts connected to Journey Builder with Facebook Login.

The short version: we collect what we need to plan your trips and run the service, we don't sell your personal information, and you can ask us to see, correct or delete it at any time.

What we collect

When you pre-register

Your email address, your first name if you give it, the page or campaign you came from, and the time you agreed to hear from us. Your IP address is used briefly to limit repeated or automated sign-ups.

When you have an account

Account details: your name and email address. If you sign in with a password, it's held by our authentication provider and we never see it. If you sign in with Google, we receive your name and email address from Google.
Preferences: things like your home region, home airport, units, meal times and how you like to travel.
Saved travellers: the people you plan trips for, if you add them. Every field is optional: a name, relationship, age range, birth year (the year only), phone, email, home town, and their likes and dislikes. If you add someone else, please make sure they're happy for you to do so.
Your trips: routes, stops, dates, notes, the places you pick, and your day-by-day plans.
Bookings and costs: details you add or that we read from a confirmation, such as confirmation numbers, check-in and check-out times, flight numbers, rental car details, and costs in your budget.
Confirmations and receipts: when you upload, paste or forward one, we read it to fill in the details. The file itself is not stored. Forwarded emails are deleted once they're processed. An email we can't match to a trip is kept in the mailbox so we can sort it out by hand.
AI chats: the messages you send and the replies, saved with your trip so you can come back to them.
Payments: payments are handled by Stripe. We never see or store your card number. We keep a record of what you bought, when, and the amount.
Support: the messages you send us and our replies.
Usage and diagnostics: which pages you use and for how long, how quickly they load, error reports (including your browser type), and when you sign in. This is stored in our own database and isn't shared with an analytics company.

If you connect a Facebook Page or Instagram account

Journey Builder can publish posts to a Facebook Page, and the Instagram business account linked to it, once they're connected with Facebook Login. The road-trip app doesn't offer signing in with Facebook. When a Page is connected, we store:

the name and ID of the Facebook Page, and the username and ID of the Instagram account linked to it;
the access token that lets us publish to them, kept encrypted and never shown on screen;
a record of each post we publish: when it went out, and its ID and link on Facebook or Instagram.

We don't keep anything from your personal Facebook profile, and we never see your Facebook password.

How we use it

To plan your trips: routing, finding places, arranging your days, reading your confirmations, and answering your questions in the AI chat.
To run your account, take payments and provide support.
To publish posts to a Facebook Page and Instagram account that have been connected.
To tell you when your account is ready and about Journey Builder's launch, if you pre-registered. You can unsubscribe at any time.
To keep the service secure, prevent abuse, fix problems, and understand which features are used so we can improve them.
To meet legal, tax and accounting obligations.

Who we share it with

We don't sell your personal information. We share it only with the service providers that help us run Journey Builder, and only what each one needs:

Supabase: our database, sign-in and server functions. Your data is stored in the United States (Ohio).
Vercel: hosts this website and the app.
Anthropic and OpenAI: power the AI features. They receive the trip details and messages needed to answer you, such as your route, stops, dates, notes and chat messages, and the confirmations and receipts you ask us to read. Saved travellers' contact details and birth years are not sent.
Google: maps, routes, directions, place search and address lookup, and Google sign-in if you use it. Features powered by Google Maps are subject to the Google Maps Terms of Service and the Google Privacy Policy.
OpenFreeMap: map images, loaded by your browser.
Wikimedia Commons: photos on our destination pages and road-trip articles, loaded by your browser from Wikimedia's servers. Each photo's author and licence are credited on the page. What Wikimedia does is covered by the Wikimedia Foundation Privacy Policy.
Open-Meteo: weather and air quality, using the location and date of a stop.
AeroDataBox (through RapidAPI): flight times, using the flight number and date you enter.
Stripe: payments, including your email address and what you're buying.
Amazon Web Services: sends our text messages and our emails, if you agreed to receive them. It receives your mobile number or email address and the message.
Hostinger: sends our emails and receives the confirmations you forward to your trip.
Meta (Facebook and Instagram): if a Facebook Page is connected, the posts we publish to it and its linked Instagram account, sent with that connection's access token.
Booking partners: when you choose "Compare rates" or search for flights, hotels or rental cars, you go to a partner's site, such as Booking.com, Expedia, Viator, Rentalcars, Aviasales, Hotellook or GetRentACar, some through Travelpayouts. They receive what's needed for your search, such as the place, dates and number of guests. They may set their own cookies, and we may earn a commission. What they do is covered by their own privacy policies.

We may also disclose information if the law requires it, to protect people's safety, or as part of a sale or reorganisation of the business, in which case this policy would continue to apply to your information.

A small number of people who run Journey Builder can see account information to provide support. Access is limited to that purpose and is logged.

Text messages (SMS)

If you tick the box agreeing to text messages, we use your mobile number to send you the messages you signed up for, such as trip reminders, confirmations and replies to your questions. Message frequency varies. Message and data rates may apply. Reply STOP to any message to stop receiving them, or HELP for help.

We do not sell or share your mobile number. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Your text-messaging opt-in and consent are never shared with any third party. We share your number only with the provider that delivers the messages for us (Amazon Web Services), and only to send them.

Where it's stored

Your information is stored in the United States, and some of our service providers may process it in other countries. When it's outside your country, it's subject to the laws of that country, and may be accessible to its courts and authorities.

How long we keep it

Your account and trips: for as long as you have an account. A trip you delete stays in your trash for 30 days, then it's permanently removed with everything in it.
Pre-registration: until your account is ready and you've been told, or until you unsubscribe or ask us to remove it.
Usage and diagnostics: page timings for 30 days, error reports for 90 days, and usage and sign-in records for 180 days.
Payments: purchase records are kept as long as we need them for accounting and tax.
A Facebook or Instagram connection: the access token and the Page and Instagram account names and IDs are kept until the Page is disconnected in Journey Builder or you ask us to delete them. Records of the posts we published are kept until you ask us to delete them.

Cookies and browser storage

This website sets no cookies until you accept them. The app keeps you signed in by storing your session in your browser's local storage, and uses session storage for a few technical settings. Google Maps and the booking partners' sites may set their own cookies when you use them.

Analytics and advertising measurement

We use Google Analytics to see which pages and articles help people, and whether they lead to a pre-registration. Nothing is sent to Google, and no analytics cookie is set, until you choose "Accept" on the cookie notice. If you choose "Decline", the site works exactly the same and we collect nothing.

What Google Analytics collects: the pages you view, the links and buttons you click (such as an article's call to action, a link to another article, or the pre-registration form being sent), the page you arrived from, your device and browser type, and your approximate location, worked out by Google from your IP address. We don't send it your name or email address.
Who handles it: Google acts as our service provider (processor) for this data, under the Google Privacy Policy. See also how Google uses data when you use sites that use its services.
How to withdraw: choose "Cookie settings" in the footer of any page and then "Decline". We stop loading Google Analytics and remove its cookies from your browser. You can also block cookies in your browser settings.

If we later add other measurement tools, such as the Meta Pixel to see how our Facebook and Instagram posts and ads lead to visits, they will be listed in this section and covered by the same choice.

Your choices and rights

See or correct your information: most of it you can change in the app. For anything else, contact us.
Delete your account: email us from the address on your account and we'll delete it, along with your trips, travellers, chats and bookings. Data deletion explains how to ask, what we delete and what we keep, including for a connected Facebook Page or Instagram account.
Stop emails: use the unsubscribe link in any email, or contact us.
Withdraw consent: you can withdraw your consent to how we use your information at any time, though some features may then stop working.

If you're not satisfied with how we've handled a privacy concern, you can also contact the Office of the Privacy Commissioner of Canada, or the privacy regulator where you live.

Children

Journey Builder isn't meant for children to use on their own, and we don't knowingly collect personal information directly from children under 13. A parent or guardian can add a child as a saved traveller. For children, we suggest adding only a first name and an age range.

Security

We protect your information with access controls, encrypted connections, and database rules that keep each person's data to themselves. No system is perfectly secure, so please use a strong password and keep it to yourself.

Changes to this policy

If we make changes, we'll update the date at the top of this page. If a change is significant, we'll let account holders know by email or in the app.

Contact us

Email support@journeybuilder.app or call +1 (647) 346-2780, Monday to Friday, 9 AM to 5 PM Eastern.