Privacy policy

Quiet Route is operated by David O'Sullivan as a sole trader based in the United Kingdom. This policy covers the website and the iPhone app. It explains what data we collect, who else receives it, how long we keep it, and your rights under UK GDPR and the Data Protection Act 2018.

If you have any questions, email david@quietroute.io.

What we collect

When you create an account and use Quiet Route, we collect:

• Your email address, and your password if you set one. Passwords are stored hashed, never in plain text
• Your name and profile photo, if you add them or sign in with Google
• Your vehicle details and travel preferences, and where you heard about Quiet Route if you tell us
• What you put into a trip: destinations, dates, stops, interests, budget and notes
• The trips we build for you, and every change you make to them
• Your subscription: which plan, when it started and renews, and whether you paid on the web or in the iPhone app. Card details stay with Stripe or Apple
• Feedback you leave on a trip and messages you send us from your account
• A record of what happens in your account, linked to it: trips created, edited, shared, exported, deleted and restored, subscription changes, and whether each happened on the web or on iPhone, with the app version

We do not collect your device's location. If you sign up to the newsletter we keep your email address and where you signed up. If you arrive through one of our short links (quietroute.io/go/…), we record the click with the rough location (country and city), the browser and the referring page, but not your IP address.

How we use it

We use your data to:

• Build, save and show your trips
• Run your account and subscription, including the yearly limit on plans
• Send you emails about your account: sign-in links, payment and renewal notices, a short series of emails after you join, a note before a trip and a request for feedback after it. You can turn off those trip emails from the Unsubscribe link in any of them or from your Account page. Emails about your account and billing are still sent.
• Answer your messages and fix problems
• Understand how Quiet Route is used, and whether our adverts on Facebook and Instagram lead to sign-ups

We do not sell your data. We share it only with the services listed below, and only what each one needs.

Who else receives your data

These services receive some of your data so that Quiet Route can run. Each one gets only what its job needs.

• Supabase hosts our database, sign-in and file storage. Everything listed above is stored there.
• Vercel hosts the website and runs our servers, so every request passes through it. We also use Vercel Web Analytics and Speed Insights, which record page views, the referring site, rough location, device and browser type, and how quickly pages load. Neither uses cookies.
• Stripe takes payments on the web. Stripe receives your email address and account reference, and handles your card details directly: they never reach our servers.
• Apple takes payments in the iPhone app. Apple tells us about your purchase so we can switch your subscription on, and keeps your payment details itself.
• Anthropic provides the AI model that drafts each trip. It receives the details of the trip: where and when you are going, who is travelling, your vehicle, interests and budget, and any stops already booked. It does not receive your name or email address.
• Google Maps Platform draws the maps, suggests places as you type, checks every place in a trip against Google's records and measures the drives between them. Google receives the places and search text involved, and your browser connects to Google when a map loads. If you choose to sign in with Google, Google shares your name, email address and profile photo with us.
• Resend delivers our emails, so it receives your email address and the content of each email we send you.
• Meta measures our adverts on Facebook and Instagram. The Meta pixel runs on the public pages of quietroute.io and on the sign-up and payment pages, not in the signed-in app, and tells Meta which of those pages you view and when you sign up, start a payment or subscribe. When you create an account or subscribe, our server also sends Meta your email address in hashed form, your IP address, your browser type, Meta's cookie identifiers and, for a subscription, the price. Meta does not receive the contents of your trips.
• Sentry collects error reports when something breaks: the page, the error and technical details about your browser. It is set not to collect personal data such as IP addresses by default.
• Upstash holds short-lived counters that stop a form or feature being used too often. They are keyed by your IP address or account reference.
• Discord carries alerts to Quiet Route's own staff channel when something happens that needs attention: a new or cancelled subscription, a failed payment, a trip that failed to build, feedback, a support message or an account deletion. An alert can include your email address, a trip's title and destination, and what you wrote. Nothing is posted publicly.

Some of these services process data outside the UK, including in the United States.

How long we keep it

We keep your account and your trips for as long as your account is open. A trip you delete moves to Recently deleted, where you can restore it for 14 days. After that it no longer appears in your account, but we keep the trip itself.

If you have never subscribed and you don't sign in for 24 months, we treat the account as closed and remove it the same way as if you had deleted it yourself, as set out below.

When you delete your account from the account page:

• Your account and personal details are deleted, and you are signed out. That covers your email address, password, name, profile photo, vehicle details and preferences
• Your trips are kept without your name on them, and a shared link to any of them stops working
• Emails from Quiet Route stop. If you were on the newsletter, your address stays on that list marked as unsubscribed, as the record that you asked to stop
• Your trip feedback, messages to us and the record of what happened in your account are kept, no longer linked to you
• If you ever paid, we keep a record of that payment, including the email address you paid with, in our business accounts
• Alerts already posted to our staff channel on Discord stay there unless you ask us to remove them

This can't be undone. Stripe and Apple keep their own billing records as financial regulations require, which is outside our control. Deleting your account does not delete what Meta, Google or the other services above already hold under their own policies.

Your rights

Under UK GDPR you have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Have your personal data deleted
• Receive a copy of your data in a portable format
• Object to how we process your data

To exercise any of these rights, email david@quietroute.io. You can delete your account yourself from the account page. If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office (ico.org.uk).

Cookies and trackers

These are the cookies and trackers Quiet Route uses:

• Sign-in cookies from Supabase keep you signed in. Quiet Route cannot work without them.
• A link cookie (qr_ref) is set when you arrive through one of our short links, so we know which link brought you if you sign up. It lasts 30 days.
• Stripe's cookies are set on the payment page to help prevent fraud.
• The Meta pixel sets Meta's own cookie (_fbp) on quietroute.io and uses it to match your visits to our adverts.
• Browser storage keeps an unfinished trip brief and how you sort your trips, on your device only.

Vercel Web Analytics and Speed Insights do not use cookies. The Meta pixel loads on the public pages of quietroute.io, on the sign-up, sign-in, password reset and payment pages, and on a shared or example trip when you are not signed in. It does not load in the signed-in app: your trips, planning a new trip, your account and the feedback page. There is no cookie banner on Quiet Route at the moment. You can block the pixel with your browser's tracking protection or a content blocker, and Quiet Route keeps working.

Changes to this policy

If we make significant changes to this policy, we'll notify you by email. The date at the top of this page reflects when it was last updated.

Contact

David O'Sullivan
Quiet Route
david@quietroute.io