Privacy Policy
Effective date: October 14, 2026
About this notice
This notice explains how Viajero handles personal information when you use the service. Contact support@getviajero.com about privacy, access, correction or deletion.
Information and purposes
We handle your sign-in email/provider details, account identifiers, handle, display name, optional photo and bio, account settings, accepted terms version and acceptance time. When access is restricted, we store approved email addresses before those people create accounts. After you verify your sign-in identity, we associate the approval with your account identifier to grant and manage access. We also record approval and revocation dates. An approval does not create a profile or complete onboarding for you. Setup asks you to confirm you are at least 16; we do not ask for a birth date in that step. We store saved places and their locations, notes, audiences, follows, requests, mute/block choices and relevant dates to provide your account and sharing controls. These records can reveal travel interests, routines or locations; consider that before sharing.
We also handle support requests, reports, moderation decisions, short-lived abuse counters and deletion/recovery records to operate and protect the service and carry out requests. Reports may retain snapshots of reported notes, handles, display names or bios, together with report details and moderation decisions; we do not retain a reported avatar image as a report snapshot. Hosting, sign-in and map providers receive network and request information needed to supply their services. Searches and map requests can disclose the area or place you are exploring.
When you import places, we process the text or article link you submit to identify places and prepare results for your review. Import processing sends submitted text or extracted article content to Anthropic and uses Google Places to match places. For some place matches, we also send extracted place names to Wikidata to identify alternative names. Import history can contain source information, results and place associations. Removing an imported save does not automatically delete that history.
We use optional analytics only with your consent. We do not sell personal information or share it for cross-context behavioral advertising. We send emails needed to operate your account and respond to your requests. We do not send marketing emails.
Visibility
Private account does not mean hidden profile: your handle, name, photo and bio can be publicly reachable. Shared saves of private accounts require approved following; Only me saves are not shown to other members or signed-out visitors. Viajero and its service providers process them for the purposes described in this notice. Public accounts' Shared saves can be viewed without signing in. Going public changes the audience of existing Shared saves. Going private preserves existing followers until removed. Follow/following lists and counts are owner-only. Other people see coarse save times rather than exact activity times.
New accounts default to asking search engines not to index their profiles. Making an account public does not change that preference. This request does not prevent direct-link access or guarantee that a search engine will comply. People search is separate: contact support to request exclusion. Exclusion does not disable profile links or existing follows. Old handles may redirect until retired. Blocking removes relationships but cannot prevent viewing public content while signed out. Other people and external services may retain copies already received.
Analytics and storage on your device
With explicit consent, PostHog receives usage events, page views, interactions, errors and a service identifier that may be associated with your account. This is not anonymous data. We do not record new sessions using session replay. We do not use PostHog's optional third-party AI analysis features or enable its internal AI-training option for this service. This does not change the Anthropic processing used when you import places, described above.
Decline or withdraw consent in Analytics preferences. Withdrawal stops new optional collection on that device and clears its queued analytics; it cannot recall data already sent or a server event authorized by an earlier request. Do Not Track and Global Privacy Control block optional analytics. Sign-in/session storage and a record of your privacy choice serve essential purposes separately from optional analytics storage.
Service providers
Supabase supplies sign-in and database storage. Vercel hosts the web/API service and private deletion/recovery storage. Google Places and Mapbox supply place search, maps, photos and information. Resend supplies transactional account email. PostHog supplies consented analytics. Anthropic processes import content to identify places, and Wikidata receives extracted place names for the matching described above. Providers receive information needed for those purposes. Google’s handling of information is described in its Privacy Policy. Moderation and support records are available to the people handling those functions, not other members. Infrastructure and providers may process information outside your country.
Retention and your requests
We retain account information and saved content until you delete them or your account is erased, subject to the exceptions below. A deletion request hides the account during a 30-day grace period; erasure then removes its profile, saves, notes, relationships and terms acceptance records. Sign-in and analytics cleanup run separately and retry failures. PostHog deletion is asynchronous; we do not promise a fixed completion time. Analytics collection stops for the account from its deletion request, but information already in transit cannot be recalled.
| Information | Retention and exceptions |
|---|---|
| Import input and results | For text and article imports, we process the content to identify places. We do not store the full submitted text in your import history. Extracted names and snippets are retained while results await review and cleared when you decide a result. Unreviewed results become eligible for deletion 30 days after review becomes available; scheduled cleanup may be delayed. Source history and decided-result records remain until your account is erased. Removing a saved place does not remove that history. Backup retention is described below. |
| Access approvals | We remove unused email approvals manually after 30 days. Once linked to a login, approval records remain until that login or its account is erased. Revoking access blocks protected use but does not itself erase the approval or account. Backup copies follow the limits below. |
| Abuse counters | Expire within 24 hours. Physical cleanup can be delayed without extending the restriction. |
| Declined-follow wait records | Expire after seven days. Physical cleanup can be delayed without extending the restriction. |
| Reports and reported-text snapshots | Open reports remain until resolved. Resolved reports become eligible for deletion 90 days after resolution; scheduled cleanup may be delayed. Snapshots may remain after account erasure. |
| Retired handles | A hashed reservation prevents reuse and impersonation through old links. It is no longer linked to your account in our handle records, but is not anonymous and currently has no scheduled deletion date. |
| Support exports | We remove operator-controlled export files and delivery copies within 14 days of creation, including undelivered exports. Copying a file does not restart this period. You control copies you download. |
| Support correspondence | We delete ordinary support correspondence within 90 days after the request is resolved. We may retain the limited information needed for a documented dispute or legal obligation for as long as that need continues. Support correspondence is handled separately from account erasure. |
| Analytics events | Under our current PostHog plan, analytics events remain available for analysis for seven years. That limit does not automatically erase older data. Withdrawing consent stops new collection but does not delete earlier events. After your account is erased following the 30-day grace period, we request deletion of analytics linked to it; this may take additional time. |
| Earlier session recordings | Any recordings collected before recording was disabled remain subject to the retention period that applied when they were collected, or an earlier completed deletion. Changing the recording setting does not itself erase existing recordings. |
When you request account deletion or cancel a deletion request, we keep a small record of that choice to help preserve it when restoring a backup. These records and their separate recovery copies become eligible for deletion 21 days after they are copied to recovery storage. Records used to carry out cleanup, and their recovery copies, become eligible for deletion 21 days after cleanup completes. Failures or incidents can delay cleanup, so these are the earliest removal dates, not guaranteed ones. Daily database backups are kept for seven days, and manual exports containing user data for no more than 14 days. Those copies may therefore still contain account identifiers after the live recovery records are removed: up to seven days in daily backups and up to 14 days in manual exports. If we restore a backup, we reapply retained deletion choices before the service resumes.
Deletion from Viajero's database does not simultaneously delete information held in provider logs or backups. Anthropic's standard API policy provides for deletion of inputs and outputs within 30 days, with exceptions for contractual arrangements, particular services, safety enforcement and legal requirements. Wikimedia's guidelines generally provide for search terms and automatically collected nonpublic personal information to be deleted, aggregated or deidentified within 90 days, with exceptions. See Anthropic's retention policy and Wikimedia's retention guidelines. Resend's standard Free, Pro and Scale plans retain email and log data for 30 days; this is separate from correspondence retained in the support mailbox.
You can request access, correction, export or deletion through the app or support. Depending on applicable law, you may also have rights to object, restrict processing, withdraw consent or complain to a supervisory authority. We verify request ownership without asking for unnecessary information. You may contact support for access or export without accepting updated Terms. Contact support@getviajero.com. Withdrawing consent does not change the lawfulness of earlier processing.
We use encrypted connections to the app/API and access controls, but cannot guarantee complete security. Delivery of email between mail servers is not guaranteed to remain encrypted throughout its journey. We update this notice as practices change and identify it by date. Where consent is required, we request it separately; accepting terms is not analytics consent.