The short version: you pay a few dollars once, so you're the customer — not the product. We don't run ads, we don't use analytics or trackers, and we never build a profile of you. Building a trip asks nothing of you — no account, no card, no email. Buying one lets you make an account, and that account holds your email address, your password scrambled one way so nobody can read it back, and a list of which trips are yours. That's the entire record.
What we store
Only what your crew puts on the trip:
- The stops, posts, notes, and pins you add — places, dates, captions, and the words you type.
- Photos and videos, if you're on the tier that includes them.
- Two scrambled passwords per trip (edit + view). We scramble them on the way in, one way only, so we can't read a phrase back or tell you what yours was. That is no longer the same as saying we can't open your trip — if you have an account, signing in opens the trips on it, so the server can reach their contents. See “What signing in can do” below.
If you have bought a trip, we also store, on the trip itself:
- Which tier was bought, and when the trip expires (on the $2.50 tier).
- The Stripe checkout id — an opaque reference like
cs_live_…, used to make sure one payment creates one trip.
And if you chose to make an account after buying, we store exactly three things about you:
- Your email address — the one you gave Stripe at checkout.
- Your password, scrambled one way on the way in. We can't read it back — we can only check that what you typed matches. Nor can anyone who steals the file.
- A list of which trips are yours — the ones you bought, and any you added with a personal link.
Said plainly, because it matters: that list is stored in a form we can read, and so are your trips. Signing in opens the trips on your account, which means the server can open them too — and so could anyone who got the whole database. We used to say the opposite here, and it was true then: nothing but the phrase could open a trip. We changed it because the alternative was worse in practice. The account could tell you which trips were yours and then not let you into any of them, and people lose links. This is the trade, and you should know it is the one we made: a customer who can get back in, at the cost of a database that could be made to give trips up.
What signing in can do
An account opens the trips you bought and the ones you were invited to — nothing else. It does not make you a person on the trip: easter eggs left for someone else stay shut, because who you are on a trip comes from a personal link, never from being signed in. And only the person who bought a trip can delete it, change its passwords, or remove people from it. Someone you invited can add to the trip; they cannot take it away from you.
When you buy a trip, we make you an account from the email address Stripe already collected to send your receipt — checkout never sends you through a signup form, and we never ask you for anything extra. (Since D-076 anyone may also make an account for themselves, without buying; it holds the same email and list and nothing more.) It exists so you can find your trips again later. Setting a password is optional; if you don't, we'll email you a link to set one when you need it. And an account still holds no name, no profile, nothing about what you did, and nothing a data broker would want.
How long: a trip and its contents stay until you delete them, or until a $2.50 trip reaches its one-year end and deletes itself. An account stays until you ask us to remove it — email support@thistripbtw.us and it's gone, along with the list.
We do not store your name, contacts, location history, what you browse, or any advertising or tracking identifiers. We do not build a profile of you, and there is nothing here a data broker would pay for.
Who we work with
A few services help run the trip. Here's the whole list and what each one sees:
| Stripe | Handles payment when you buy a trip, and collects the email for its receipt. We receive the email address and make your account from it, and we learn which tier was bought — we never see your card number, your billing address, or your name. If you arrived from a page that names a channel — say, our page for AI assistants — the checkout carries one word saying so (via_agents), so we can tell whether that channel works. It is a word on a payment: not a cookie, not an identifier, not kept on our side, and nothing about you. |
| DreamHost / Cloudflare | Host and serve the site (in the United States). Like any web host, they process the normal request data (including IP addresses) needed to deliver pages. Cloudflare also adds a script of its own to every page, after it leaves our server and before it reaches you. It is bot detection, and it loads from a path on our own domain ( /cdn-cgi/…), so it does not look like an outside request and would be easy for us to leave unmentioned. We did not write it and cannot see what it collects. We have turned off every setting that is supposed to control it and it is still there; we are still working out why. Everything else on the site is served from our own domain on purpose — the map library and the fonts are copies we host, not links to somebody else’s server. |
| OpenStreetMap | The map itself comes from their data. Your browser no longer contacts anyone for it. We used to load map tiles from Carto, which meant a third party saw the areas you looked at and your IP — a map of where you were planning to go. We now build the map from OpenStreetMap data ourselves and serve it from this domain, so the places you look at stay here. OpenStreetMap and Protomaps are credited on the map because their licence asks for it, not because anything is sent to them. |
| OSRM (OpenStreetMap) | Draws driving routes along real roads. Your browser no longer contacts them: we ask on your behalf and cache the answer, so they see our server rather than you, once per distinct road path. Roads are public and road shapes do not change, so most routes are answered from that cache without asking anyone. |
| Nominatim (OpenStreetMap) | Your browser no longer contacts them either. Turns places into points and back — what you type in the search box, and the coordinates of a spot you tap so we can name it. Our server makes this call on your behalf (it used to come straight from your browser), which means Nominatim sees our server, not you. We cache the answers so the same place isn’t looked up twice. |
| Anthropic | Runs the optional “Describe” assistant. Only if you use it: what you type, plus the stops and dates already on the trip, are sent so it can answer and add legs. It is not used to train their models, and nothing is sent unless you open Ask and type. |
| AeroDataBox | Looks up a flight's scheduled times, only when you give Ask a flight number. It receives the flight number and date — nothing about you or the trip. |
Ask is opt-in. Never opening it means nothing on your trip is ever sent to a model. We do not keep the conversation — only a count of requests, to stay inside our own budget.
All of these are used only to run the trip — never to profile you, and we never sell or share your trip's contents with anyone.
Deleting everything
Every trip has a delete button (Info → Trip settings) that removes the trip and every photo and video, for good. Every trip also self-deletes when its term is up — one year, five or ten, depending on the tier — on purpose. Data we don't keep can't leak.
Questions
Email support@thistripbtw.us. The client is being open-sourced so anyone can read exactly what it does.