Privacy Policy

What we collect

When you sign up, we collect your email address and a password (handled securely by our authentication provider; we never see or store your password in plain text). If you use "Continue with Google", we receive your email address from Google instead of asking you to set a password. When you use the app, we also store the itinerary content you create (titles, destinations, dates, activities, checklists, budget items) and any photos you choose to upload.

Why we collect your email

Your email address is used solely to create and secure your account: signing up, logging in, confirming your email, and password/session management. We do not use your email for marketing, newsletters, or promotional messages, and we do not sell, rent, or share it with third parties for advertising purposes.

Public itineraries

If you choose to make an itinerary public, its content (title, destination, dates, activities, checklist, budget, photos) becomes viewable by anyone with the link, and may appear in the Explore page. Your email address is never shown alongside a public itinerary; only a short name derived from your email is shown next to any comments you post.

Where your data is stored

Data is stored with Supabase (Postgres database, authentication, and file storage), protected by Row Level Security policies that restrict access to your own private data. Uploaded photos are stored in a Storage bucket; see our note on photo visibility if you have concerns about a specific upload.

Your rights

Regardless of where you're signing up from, you can always:

• Access the personal data we hold about you
• Correct inaccurate personal data
• Withdraw your consent and request deletion of your account and data
• Ask us to limit how your data is processed

You can delete individual itineraries yourself at any time from your dashboard. To request full account deletion or ask any question about your data, contact us at privacy@jomtravel.example.

Consent

By creating an account, you consent to us collecting and processing your email address for the purposes described above. You may withdraw this consent at any time by requesting account deletion, which will stop all further processing of your personal data.