Privacy Policy

Chinerary is operated by Websta (CVR 38622307), C/O Steffen Andreas Kloster, Guldbergsgade 105, 1. 3, 2200 København N, Denmark. For anything in this policy (questions, requests, complaints) reach us at support@chinerary.com.

What we collect

Only what the product actually needs to work, plus what you choose to give us:

• Account info: your name and email address (and a hashed password, if you sign up with email rather than Google or GitHub; we never see or store the password itself, only a one-way hash of it).
• Trip content: the itineraries, cities, budgets, and notes you create. This is your data; we store it so the app can show it back to you.
• Payment info: if you buy a Silk or Jade pass, Stripe handles the actual payment; we never see or store your card number. We keep a record of the purchase itself (plan, amount, date, a Stripe reference) for receipts and support.
• Messages to Lulu: if you chat with our AI assistant, your messages are sent to our AI provider to generate a reply; see the Lulu Chat Policy for exactly how that works.
• Basic usage analytics: which pages get visited, so we know what’s actually used. This is deliberately built to avoid identifying you; see Cookies below.
• Sign-in security log: each time you sign in, we record the device/browser, IP address, and country (approximated from your IP, via Cloudflare). This isn’t used for marketing or profiling, only to detect accounts being shared outside a household, per our Terms, and other account-security issues. Kept for 90 days, then automatically deleted.

Why we process it, and on what basis

• Contract: account data and trip content; we can’t provide the service without them.
• Consent: the AI chat: you choose to use it, and can simply not use it.
• Legitimate interest: the anonymized usage analytics described above, fraud/abuse prevention, the sign-in security log (enforcing the personal-account terms every user agrees to, and account security generally), and the AI request log (keeping the AI features working, diagnosing failures, and controlling what they cost to run).
• Legal obligation: payment records, to the extent tax/accounting law requires keeping them.

Who we share it with

We don’t sell your data, and we don’t share it for advertising. We do use a small number of processors to actually run the service:

• OpenRouter (a US-based company) and the underlying AI model it routes to: processes chat messages sent to Lulu, to generate a reply. Which model is configured can change over time, and has included both US- and Chinese-developed models; every request applies one technical restriction regardless of which (never use a provider that would store the data or train on it), but we don’t otherwise restrict which country actually processes it. Before your first message, Lulu’s chat asks you to explicitly confirm you understand and accept this; see the Lulu Chat Policy for exactly what that covers.
• Stripe: processes Silk/Jade pass payments. Stripe is PCI-DSS compliant; we never see full card details.
• Mapbox: renders the route map. Map tile requests include the cities on your route, not your identity.
• Open-Meteo: weather and air quality lookups, by city coordinates only (no account or personal data sent).
• Our email provider: sends transactional email (welcome, receipts, password resets) to the address on your account.
• Our database and hosting provider: the app and its database run on Hetzner infrastructure in Germany (EU), storing the data described above under their own security commitments.
• Cloudflare: sits in front of the site for security and performance, and is the source of the IP address and country used in the sign-in security log above.
• PostHog: product analytics and, if you accept cookies, session replay: page views, the interactions described in Cookies below, and a recording of how you move through the app. Data is stored on PostHog’s servers in the EU (Frankfurt), and requests go through our own domain. See that section for exactly what PostHog receives before and after you accept.
• Sentry and PostHog (EU, Frankfurt): receive error reports (a stack trace and the page it happened on; Sentry also gets your IP) when something breaks, so we can find and fix it. Email addresses, sign-in links and the values of failed database queries are stripped from them first. Not conditional on the cookie choice below, though for visitors who accepted cookies a report can be linked to their account id; this runs under our legitimate interest in keeping the app working, the same basis most software uses for its own error monitoring.

Some of these are based outside the EU/EEA, notably the US, and, depending on which AI model is currently configured for Lulu, potentially China. Where that’s the case, we generally rely on the safeguards those providers offer for international transfers (such as Standard Contractual Clauses or, for the US-based providers, the EU-US Data Privacy Framework), consistent with GDPR Chapter V. China has no EU adequacy decision and no Data Privacy Framework equivalent, so for that specific transfer (a message you send Lulu, if the model configured at the time happens to route through Chinese infrastructure) we rely instead on your explicit, informed consent (GDPR Article 49(1)(a)): Lulu’s chat asks you to confirm you understand and accept this before your first message is sent, described further in the Lulu Chat Policy.

How long we keep it

• Account and trip data: for as long as your account exists, or until you delete it.
• Chat messages: by default, we don’t store a transcript of your conversations with Lulu ourselves; a conversation lives in your browser for that session and is gone on refresh. Separately, every AI request (a Lulu message, an AI suggestion, a next-city suggestion) is written to a technical log that only our administrators can view, used to diagnose failures and see what drives costs. That log has two parts: usage metadata (which model, token counts, cost, timing, success or error, and the error message if it failed), kept for as long as your account exists; and the full request and response (your message, the itinerary and budget context sent along with it, any tool lookups Lulu made, and the AI’s reply), kept for 30 days and then automatically deleted. Both are deleted along with your account. If you turn on “Save Lulu conversations” in Settings (off by default), your messages and Lulu’s replies are saved to your account until you delete them yourself. Separately, a reply you explicitly report as a problem using the Report button is always saved regardless of that setting; see the Lulu Chat Policy for exactly what both of those save.
• Payment records: as long as required for accounting/tax purposes.
• Usage analytics: before you accept, the identifier rotates daily and is never linked to an account or stored on your device (see Cookies). If you accept, analytics events and session recordings are kept for up to 12 months and deleted with your account on request.
• Sign-in security log: 90 days from each sign-in, then automatically deleted.
• AI request log: the full content of each AI request and response for 30 days, then automatically deleted; the usage metadata (model, tokens, cost, timing, errors) for as long as your account exists.

Your rights

Under GDPR (and similar laws elsewhere), you can:

• Access & export your data: Silk and Jade’s self-service export (JSON or PDF) in Settings covers your itinerary data (cities, route, budget, weather) instantly, any time. For a complete copy of everything else we hold about your account (profile, billing history, AI usage records including any AI request content still within its 30-day window, support messages), email support@chinerary.com; available on any plan, honored without undue delay and within one month as GDPR requires. This page already covers what we collect, why, and who we share it with, which forms part of that same right.
• Correct it: update your name and trip details directly in the app.
• Delete it: Settings has a “Delete account” option. Your account and everything tied to it is scheduled for deletion and you’re signed out immediately, but nothing is actually removed for 30 days; we email you a link to restore it during that window in case it wasn’t you, or you change your mind. After 30 days, it’s permanently and irreversibly deleted.
• Object to or restrict processing, or ask questions about any of this: email support@chinerary.com.
• Complain to a regulator: in Denmark, that’s the Danish Data Protection Agency (Datatilsynet); if you’re elsewhere in the EU, your own country’s data protection authority.

Cookies

Two are strictly necessary and always on. The analytics storage below is optional and only set if you accept it, though we still receive a limited, anonymous page-view signal even before you decide, explained below:

• Session cookie (strictly necessary): keeps you signed in. Set only once you log in.
• Locale cookie (functional): remembers which language you’re reading the site in.
• PostHog analytics cookie and storage (optional): help us understand which pages get visited, where visitors come from, which features get used, and where people get stuck, so we can improve the site. Never used for advertising. Nothing is stored on your device until you accept in the cookie notice; before that, PostHog runs in a cookieless mode: it registers that a page was viewed, using a daily-rotating anonymous identifier that can’t be tied to you or followed across days. If you accept, it stores a persistent identifier, records the actions you take in the app, links them to your account once you’re signed in (by account ID only, never your email or name), and records your session so we can watch how the app is used. Session recordings mask everything you type into form fields and exclude the Lulu chat entirely, but they do show the rest of what is on screen, such as your cities and budget figures. Sign-in recovery and password-reset pages, and our admin area, are never recorded.
• Signup source cookie (optional, 30 days): only set if you accept the analytics cookie. It remembers which site or campaign link first brought you here (the referring site’s hostname, any utm_ or ref values in the link, and the first page you landed on, never a full address or your IP). If you create an account, we store that on your account so we know which channels bring people in, then delete the cookie. If you reject or withdraw consent, nothing is stored and the cookie is removed.

You can accept or reject the analytics cookie at any time via the “Cookies” link in the footer, which reopens the same choice you saw on your first visit.

Children

Chinerary isn’t directed at children, and we don’t knowingly collect data from anyone under 16.

Changes to this policy

If this changes materially, we’ll update the date at the top of this page and, for significant changes, let you know directly.