Privacy

itinerUP has no accounts and no ads, and the app doesn’t track you (the landing page at itinerup.app counts visits without cookies, which you can switch off there). It keeps what a group trip needs, and nothing about who you are beyond the first name you type.

itinerUP is run by its maker, a private person in Switzerland. Questions, requests and complaints: zeus.dev.eng@gmail.com.

What a trip stores

• The trip: its name, the home town (name, country, coordinates), whose public holidays count, the currency, look and colour, the deadline, and the first names on the guest list.
• Each route: its name, one line about it, the start date, the stops (town, coordinates, nights, a note, costs) and how you travel between them.
• Stop photos from Wikimedia Commons are links with their author and licence; the photos themselves stay on Commons.
• The edit link is never stored as it is, only a one-way fingerprint of it (SHA-256), so a database copy can’t be used to edit a trip.

What an answer stores

A trip takes up to 150 answers, and the planner can close the answers at any time.

• The first name you type, the route you pick, which parts of the trip you’re in for, your note, and when you answered.
• To keep one answer per device, your browser gets a random code in a cookie (itin_d, for 400 days, not readable by scripts). The trip keeps only a fingerprint of that code and the trip together, so your answers on different trips can’t be linked. It’s needed for the vote and the ideas to work, so it isn’t optional, and it’s used for nothing else.

What an idea stores

Friends can suggest a place at a stop or a new stop, and back each other’s ideas. A trip takes up to 200 ideas, 30 from one device.

• For an idea: the first name you type, the place or town (with its coordinates), the link and the note you add, the route and stop it’s for, and when you made it. For backing one: your first name and when.
• Both are filed under the same device fingerprint as answers, so only you can take your idea or your backing back.
• When an idea has as many backers as the planner asked for, a place joins the stop as one of its links, with “suggested by” and your first name in its note; from then on it’s part of the trip, and the planner can edit or remove it.

What stays on your device

• The trips you’ve made or opened (their link, name and, for your own trips, the edit link), the look you tried, and the first name you last used, in your browser’s storage, so the home page can list them. To show how many answers each one has and which route leads, the home page sends their share links (never the edit links) to itinerUP, which answers and keeps no record of the request.
• If you switch the theme, a cookie (itin_theme, for 400 days) remembers it. It holds only the word light or dark, goes with each page request so the page arrives in that theme, and isn’t stored by itinerUP.
• Photos you add to a reel are resized and stripped of their location and camera data in your browser and kept there. They are never uploaded. The video is made on your device.

The landing page

The page at itinerup.app counts its visits with Cloudflare Web Analytics: no cookies, nothing stored on your device, and only totals for us (the page, the page you came from, browser and device type, country, how fast it loaded). The app here doesn’t load it. You can switch it off for free on itinerup.app/visits.

Who else handles data

• Cloudflare hosts the app and the database (database location: the EU). It processes your IP address to deliver pages and to limit abuse (too many searches or answers in a minute); we don’t store it. Cloudflare is certified under the Swiss-U.S. Data Privacy Framework.
• Geoapify (Germany) receives what you type into the town search. We keep searches and their answers for a week to answer repeats faster; they aren’t linked to anyone.
• Wikimedia Commons receives photo searches from the editor, and your browser loads stop photos from it.

The town list built into the app comes from GeoNames (CC BY 4.0), the map from Natural Earth (public domain) and the satellite imagery from NASA’s Blue Marble (public domain).

How long, and how to delete

• A trip and everything in it stays until the planner deletes it (Share tab, Delete the trip). Deleting removes the trip, its routes, its answers, and its link preview at once.
• You can remove your own answer on the trip page at any time, and take back your own idea or backing until the idea has joined the trip; the planner can remove any answer and any idea.
• Lost your edit link, or want a trip or an answer gone? Write to us with the trip link and we’ll help.
• The app’s error logs at Cloudflare (no addresses, no links) are deleted after a few days.

Your rights

You can ask what we hold about you, have it corrected or deleted, and object to its use, under the Swiss Federal Act on Data Protection and, if you’re in the EU or UK, the GDPR. Write to the address above. You may also complain to the Swiss FDPIC or your local data protection authority.

itinerUP isn’t meant for children under 16.

Last updated 5 November 2026.