Privacy policy

itero is a trip planner built and run by one person, me, Freddy Khant. It isn’t a company. Sign-up is invite-only through a waitlist.

This page describes what itero actually does with your data today. If that changes, I’ll update this page and the date at the top. You can reach me at freddyhmk@gmail.com.

Your account. Your name, email address, whether the email is verified, when you last signed in, and when the account was created and last changed. If you sign in with Google, also the link to your Google profile picture.

Sign-in sessions. Each time you sign in, itero records a session with a random token, the IP address you signed in from and your browser’s user agent (the string that names your browser and operating system). A session lasts seven days and is extended while you keep using itero. Signing out deletes it.

Google sign-in. If you use Google, itero asks Google only for your basic profile and email address. It stores your Google account ID so it can recognise you next time. It doesn’t keep the access tokens Google hands back, so it can’t read anything else from your Google account.

Email sign-in codes. If you sign in by email, itero stores the six-digit code with your email address. A code expires after 10 minutes and is deleted once used. Expired codes are cleared out the next time a code is checked.

The waitlist. The name and email you enter, when you joined, and whether you’re pending, approved or declined, plus the date you were approved.

Your trips. Everything you put into a trip: title, destination, dates, time zone, currency, banner image and whether it’s shared. For each day, your notes, and for each place you add, its name, address, times, cost, category, notes and the Google Places ID and photo reference. When you remove a day or an activity it’s hidden and can be restored, but it stays in the database until you delete the whole trip.

Rate-limit counters. To stop abuse and keep API costs in check, itero counts requests. Sign-in requests and place photo loads are counted per IP address. Place searches are counted per account. Waitlist sign-ups are counted per IP address, or per account if you happen to be signed in. Each counter stores the IP address (for IPv6, only the first half) or your account ID, the action, a count and when the counting window started. No window is longer than a day. Counters older than a day are deleted by a cleanup that runs on a random sample of requests, so they usually disappear soon after a day, but there’s no fixed deadline.

itero sets these cookies, all needed for signing in:

• A session cookie holding your session token, which keeps you signed in.
• A signed copy of your session and account details, so the server doesn’t have to look you up on every request. It’s refreshed every five minutes.
• During Google sign-in, a short-lived cookie (10 minutes at most) that lets itero finish the sign-in securely.

In your browser’s local storage, itero remembers which days you’ve expanded and which category filter you picked on each trip. That stays on your device and isn’t sent to itero.

itero has no analytics, no advertising and no third-party tracking scripts.

itero runs on a few outside services. Each one gets only what it needs for its part of the job, and each has its own privacy policy.

• Vercel hosts itero. Every request you make goes through Vercel, so it sees your IP address and the pages you request, and keeps its own logs. Profile pictures and banner images are resized through Vercel before they reach you. Error logs can include your email address if, for example, a sign-in email fails to send.
• Neon hosts the database. Everything in section 2 is stored there.
• Google handles Google sign-in, and shares your name, email address and profile picture with itero when you use it. Google also provides place search: the text you type into a place search is sent to the Google Places API, along with itero’s API key. Those requests come from itero’s server, so Google doesn’t get your IP address or account from them. Place photos are fetched by itero’s server too, and cached on Vercel for up to a day.
• Resend sends itero’s emails. It receives your email address and the message: your sign-in code, or your invite with your name in it.
• UploadThing stores the banner images you upload. Your browser sends the image straight to UploadThing, and it’s served from their servers afterwards.

I don’t sell your data or use it for advertising. As the person running itero I can access the database. The only screen built for that is an admin page listing waitlist entries.

Trips are private by default. If you turn on sharing, anyone with the link can see the whole trip without signing in: the title, destination, dates, banner, days, accommodation and activities, including your notes and costs. The shared page doesn’t show your name or email address.

Shared pages ask search engines not to index them, but anyone who has the link can pass it on. Turn sharing off and the link stops working.

Deleting a trip removes it from the database along with its days, accommodation and activities, including any you’d removed earlier, and deletes its banner image from UploadThing.

Deleting your account (Settings, then Delete account) removes your account, your sign-in sessions, your Google sign-in link, all of your trips, your waitlist entry and the banner images you uploaded. Any trip you’d shared stops working at its link straight away.

If removing a banner image from UploadThing fails, the file can be left behind there. Email me and I’ll delete it.

Account deletion needs a recent sign-in. If you signed in more than a day ago, sign out and back in first.

If you’d rather I handle it, email me from the address on your account and I’ll delete everything by hand.

• Your account and trips: until you delete them, or ask me to.
• Sessions: deleted when you sign out. One you never sign out of stops working seven days after you last used itero, but its record can stay in the database until your account is deleted.
• Sign-in codes: until used, and no more than 10 minutes.
• Rate-limit counters: about a day, as described in section 2.
• Waitlist entries: until you delete your account, or until I delete them.
• Vercel’s logs: as long as Vercel keeps them.

You can ask for a copy of the data itero holds about you, ask me to correct it, or ask me to delete it. Email freddyhmk@gmail.com from the address on your account (or the one you used for the waitlist) so I can tell the request is yours.

You can change your display name yourself in Settings. The rules for using itero are in the terms of use.