Privacy Policy

In short

• We use account details to run your account and save account-backed trips.
• You can request a temporary itinerary preview without an account. PingWinWin does not save its input or result as a trip. The destination, dates, selected pace and language are sent to Anthropic to generate it; Google Places, Routes and Maps are not used for the preview.
• For saved trips and existing guest sessions, relevant trip details are sent to Anthropic only when you request itinerary generation, use “Improve this day with AI” on a trip saved to your account, or ask the “Trip preference Copilot” for suggestions; a Copilot request also includes the messages you write to it, and a request to improve a day also includes that day’s stops and the places the other days visit. We do not add your name, email address or account identifier to these AI requests.
• For saved-trip place search, transfer estimates and maps, relevant details are sent to Google’s Places and Routes services; Google Maps is loaded in your browser when you open a day’s map.
• Analytics — Google Analytics and our own visit counter — runs only if you separately accept it. Change your choice at any time with “Cookie settings” at the bottom of every page.
• Some providers process data outside the European Economic Area, including in the United States. Their applicable account terms, locations and retention are not all confirmed.
• We do not sell your personal data and do not use it for advertising.
• Guest sessions created before temporary previews remain valid for 30 days. Hourly cleanup deletes their row and trip after the 31-day threshold, normally within about 25 hours after session expiry; downtime can delay deletion.

Who is responsible for your data

PingWinWin is still in development and is run by FOP Kharkivskyi Ivan Oleksandrovych, who is responsible for PingWinWin and for the processing of personal data described in this policy (the controller). Some of its pages contain affiliate links: if you make a qualifying booking or purchase through one, PingWinWin may receive a commission from the affiliate partner. In this policy, “PingWinWin”, “we” and “us” refer to FOP Kharkivskyi Ivan Oleksandrovych.

Contact details for privacy and data protection requests: email ikcomua@gmail.com; postal address Ukraine, Zaporizka oblast, Novomykolayivka, street Sobornosti, budynok 136, 70100.

The service providers described below supply hosting and other services to PingWinWin; they do not run it.

If you have a question about this policy or your personal data, write to the email address above or use the details on our contact page.

Your account

PingWinWin is intended for people aged 18 and over. When you create an account, we process:

• your email address, which identifies your account and is used to sign you in;
• your name, if you choose to give one — it is optional;
• your password, stored only as a salted cryptographic hash — we never store the password itself;
• your default currency for new trips: the one the site is set to when you first sign in, and any you choose later;
• the date your account was created;
• the version of the Terms of Service you accepted when you created your account, and when you accepted it;
• the date your email address was verified, if it has been.

An email address and a password are required to create an account; without them you cannot register. We use this data to create and secure your account, sign you in and keep your trips associated with you.

We send you emails about your account: a link to verify your email address, a link to set a new password if you ask to reset it, and a notice when your password has been changed. These emails are sent through Brevo, an email delivery service, which receives your email address and the full content of each email, including the single-use link in verification and password-reset emails. The emails do not include your name, your account identifier or any details of your trips. Brevo’s open and click tracking is switched off for these emails.

Your trips and itineraries

When you plan a trip, we store the information you enter or select, including:

• the destination, with details about it from Google Places such as its city, country, coordinates and time zone;
• the trip dates;
• your arrival and departure: the places you select, with their coordinates and time zones, and the local dates and times;
• where you are staying, if you add it;
• your plans before you arrive, if you describe them;
• your preferences: pace, interests, budget, currency and daily walking limit;
• who is travelling: the number of adults and the ages of any children — not their names;
• the itinerary generated for the trip, with technical details of how it was generated, such as when and by which AI model.

We use this information to save and show your trips, estimate transfer times, generate your itineraries and, when you ask for them, prepare suggestions from the “Trip preference Copilot”. Please do not enter anything in free-text fields that is not needed to plan the trip, particularly sensitive information about yourself or other people.

Temporary preview: this is not an account-backed trip. Its destination text, start date, number of days, pace and interface language are sent to Anthropic only when you request generation. PingWinWin does not save the preview input or result in its database, browser storage, cookies or local trip records. This preview form does not collect party size, children’s ages, names, or place selections.

Using PingWinWin as a guest

A visitor without an account can request a temporary AI itinerary preview. The browser keeps its input and result only in page memory; refreshing or closing the page discards them. PingWinWin does not create a guest user, trip, itinerary row, guest identifier, or guest authentication cookie for a preview. The request uses a plain destination text field and does not call Google Places, Routes, or Maps.

The page's two attempts are a client-side allowance, not a server quota tied to one preview. Separately, each API instance limits requests to two per IP address per hour and shares a cap of 20 valid generation requests per hour and two concurrent generations across that process. Shared IP addresses can share the IP limit; these in-memory limits reset on restart and are not coordinated across instances.

For the requested generation, the API sends only the destination, dates, selected pace, and output language to Anthropic. Do not enter names or sensitive information. Anthropic’s own processing and retention still apply. The API rate-limits preview attempts by IP address in server memory; people sharing an address may share a limit, and the bucket is not shared across API instances or preserved across restarts.

Guest sessions created before this preview mode remain usable under their original session deadline and quota. A legacy session is valid for 30 days from creation; hourly cleanup deletes its guest row and trip after the 31-day threshold, normally within about 25 hours after expiry if cleanup runs. A user who registers or signs in with the existing guest session can link only that session’s trips after authenticated ownership checks. A guest without a current Terms acceptance can accept the current Terms or delete the guest session and its trip.

For a preview, no PingWinWin trip or itinerary is available to retrieve or delete after the page state is discarded. You can contact us about processing by PingWinWin or the providers. The lawful basis for this one-off, non-account preview has not yet been determined; see “Legal bases” below.

Place search, transfer estimates and maps (Google)

Place search, transfer estimates and maps are provided by Google Maps Platform. Apart from loading the map itself (see below), these requests are sent to Google by our servers, not by your browser, and they do not include your name, email address, account identifier or any other identifier PingWinWin uses for you.

• Place search (Google Places API). The text you type into a place search box is sent to Google to get suggestions. When you choose a suggestion, we request that place’s details, such as its name, location, address and time zone.
• Transfer estimates (Google Routes API). To estimate the transfer between your arrival or departure point and where you are staying — or the destination, if you have not added a stay location — we send the coordinates of those places to Google.
• Maps — sent to Google (Google Places API and Maps JavaScript API). When you choose “Show on map” for a day, our servers send the text of the places named in that day’s plan to Google, together with the coordinates of where you are staying — or the destination — to help find them on the map. Your browser also loads Google Maps directly from Google, which receives your IP address, standard browser information and the requests your browser makes to display the map, including the area shown. What Google does with the data it receives is described in the Google Privacy Policy.
• Maps — kept by PingWinWin. For each place looked up, we keep with your trip the place text, whether a place was found, its Google place ID, its coordinates, a rounded copy of the search coordinates and the time of the lookup, so that it does not have to be looked up again. Each record is deleted automatically 29 days after the lookup, or sooner if you delete the trip.

PingWinWin does not store the text you type into place search boxes in its database; only the places you save as part of a trip, and the map lookup records described above, are stored.

AI itinerary generation and trip preference suggestions (Anthropic)

When you ask PingWinWin to generate an itinerary, our server sends the trip details needed to plan it to Anthropic, which provides the Claude AI model that writes the itinerary. The request can include:

• the destination, its time zone and the trip dates;
• your arrival and departure places, their local dates, times and time zones, and the estimated transfer times;
• where you are staying;
• your plans before you arrive;
• your pace, interests, budget, currency and daily walking limit;
• the number of adults and the ages of any children;
• the language the site is shown in, so that the itinerary is written in it.

We do not include your name, email address or account identifier in these requests, and Anthropic’s terms state that it does not train its models on them. The generated itinerary is stored with your trip. Generating a new one replaces the itinerary shown, but earlier versions are still kept with your trip.

Itineraries are produced automatically and are suggestions for you to use as you see fit. We do not use them, or any other automated processing, to make decisions about you.

Day suggestions. On a trip saved to your account, you can use “Improve this day with AI” to ask for a new plan for one day of the trip’s itinerary. When you ask for one, our server sends Anthropic:

• the trip as last saved, with the same details as an itinerary request, listed above, other than your plans before you arrive;
• the stops the day has now: the times, the kind and the place of each;
• the places the itinerary’s other days already visit, so that the new plan does not repeat them;
• the change you chose, such as a less busy day;
• the language the site is shown in.

Stops and places are sent as your itinerary shows them, including changes you saved, so they can contain text you typed yourself. To prepare these trip details, our server may request the transfer estimates described under “Place search, transfer estimates and maps”, which sends Google the coordinates of your arrival or departure point and of where you are staying, or of the destination. PingWinWin does not add your name, email address or account identifier to a day suggestion request.

The suggestion is shown on the open page and is not saved by PingWinWin. Your itinerary changes only if you apply it: it is then saved like any change you make to the itinerary yourself, and the plan it replaced is kept with the trip as an earlier version of the itinerary. Day suggestion requests are sent to Anthropic through the same API account as itinerary requests, so what “How long we keep data” says about requests sent to Anthropic applies to them too.

Trip preference Copilot. On the page where you edit a saved trip, the “Trip preference Copilot” suggests values for the trip’s preferences — pace, interests, budget, currency, daily walking limit and who is travelling — based on what you write to it. When you send it a message, our server sends Anthropic:

• the messages you have written in the current conversation, with a short summary of each earlier Copilot answer in it: the preferences it asked about, the values it suggested and the notes it showed;
• the trip as last saved, with the same details as an itinerary request, listed above;
• the language the site is shown in.

To prepare these trip details, our server may request the transfer estimates described under “Place search, transfer estimates and maps”, which sends Google the coordinates of your arrival or departure point and of where you are staying, or of the destination. PingWinWin does not add your name, email address or account identifier to a Copilot request, but your messages are sent as you write them, so please do not include names or sensitive information about yourself or other people.

The Copilot’s answers are shown on the open page and are not saved by PingWinWin. A suggestion changes your trip only if you apply it to the form and then save the trip. PingWinWin does not keep a conversation history: the page holds the conversation in memory until you start a new conversation, reload or leave the page. For each Copilot request, we keep a record with the trip of when it was made and when it ended, without its content, to limit the number of Copilot requests for each trip and to run only one at a time. Copilot requests are sent to Anthropic through the same API account as itinerary requests.

A temporary preview uses a smaller request: destination text, dates, selected pace and output language. It does not include an account or guest identifier and does not call Google Maps services. PingWinWin returns the result to the open page but does not save it as a trip or itinerary. Anthropic still processes the request under the terms and retention settings applicable to PingWinWin’s API account, which the operator must verify. Standard API inputs and outputs are publicly described as deleted within 30 days, subject to exceptions; account-specific settings and applicability are unconfirmed.

Analytics — only with your consent

To understand how the site is used, we ask for your permission to use analytics. On your first visit, a banner asks you to accept or reject analytics, and both choices are equally easy to make. Until you accept, neither Google Analytics nor our own visit counter runs, and no analytics cookies are set. Your choice is stored in your browser, as described in our Cookie Policy.

If you accept, we use:

• Google Analytics, a service provided by Google. It receives the address and title of each page you view. Page addresses can include the identifier of a trip you are viewing and, on the sign-in and registration pages, the address of the page you will return to afterwards. For the home page, whose content depends on whether you are signed in, it also receives whether you are signed in (yes or no). It also records scrolling, clicks on links to other websites (including the link’s address), site searches, video engagement, file downloads and form interactions. In addition, PingWinWin tells it when an account is created (including the sign-up method, which is always email), when an email verification link is opened, when an email address is verified, when a trip is created, when an itinerary is requested and when a generated itinerary is shown on a trip page (including whether the Tiqets link to attractions and tickets was shown with it, and whether it finished generating while the page was open). As with any web service, Google also receives your IP address and standard information from your browser, such as its type, language and screen size. Google uses this to estimate details such as your approximate location (for example, your city) and the type of device you use. It also stores cookies containing a random identifier for your browser. PingWinWin does not send Google Analytics your name, email address, account identifier or any other contact details. Google signals, which would associate visits with signed-in Google accounts, and the collection of user-provided data, such as email addresses, are switched off, and we do not use Google Analytics for advertising.
• Our own visit counter. Our server gives your browser a random identifier in a cookie that lasts 24 hours, so that your visits are counted at most once in that period. Each record holds only random identifiers and the time of the visit — no IP address, browser details, page address, name, email address or account identifier — and is deleted automatically after 30 days.

You can withdraw your consent at any time with “Cookie settings” at the bottom of every page. Once you reject analytics, Google Analytics stops sending data and our visit counter is no longer used, and neither starts again unless you accept analytics later. Withdrawing consent does not affect analytics collected before you withdrew it. Google Analytics cookies already in your browser are not deleted automatically; our Cookie Policy explains what happens to them.

Cookies and browser storage

We use a small number of cookies and browser storage entries. Some are necessary, for example to keep you signed in; others remember your theme and currency. Analytics cookies are used only if you accept analytics. Our Cookie Policy lists each of them, what it is for and how long it lasts.

Technical data

When your browser loads the website or connects to our server, our systems and hosting providers receive technical information such as your IP address, the requested address, request time and browser details to deliver and maintain the service. The API uses an IP address briefly in its in-memory rate limiter: at most two preview-generation requests per IP address per hour. The limiter bucket is not stored in our database; people sharing an IP may share the limit, and limits can vary across API instances or after restarts. Hosting and network providers may separately process request metadata; their logging and retention are not all confirmed. Sentry error-monitoring integrations exist in our code. If a deployment has a Sentry DSN configured, it may send limited error and trace metadata. Our code excludes request and response bodies, cookies and credentials, AI inputs and outputs, and client-IP trace fields; preview provider failures are returned as a generic error. Whether Sentry is enabled for the current production deployment, and which account terms, region and retention apply, has not been confirmed. The API also has a separate in-memory process cap of 20 valid preview-generation requests per hour and two concurrent generations. It counts valid generation requests, including provider failures and requests rejected because both slots are occupied. This cap resets on process restart and is independent across API instances.

Legal bases

Where the EU General Data Protection Regulation (GDPR) applies, each use of personal data needs a legal basis. We describe our basis for each purpose below. The temporary preview is separate from the account-backed trip service, and its legal basis has not yet been determined. The legal basis for the “Trip preference Copilot” has not yet been determined either.

• Analytics (Google Analytics and our visit counter). PingWinWin asks for your consent first, runs analytics only if you give it and stops when you withdraw it. Legal basis we rely on: your consent (Art. 6(1)(a) GDPR).
• Your account, trips, place search, transfer estimates and itinerary generation. This processing is what makes these features work: without it, PingWinWin cannot create your account, sign you in, save your trips or plan them. Planning them includes the day suggestions you ask for with “Improve this day with AI”. It includes the emails you need to use your account (the link to verify your email address and the link to set a new password) and the record of which version of the Terms of Service you accepted. Legal basis we rely on: performance of a contract with you (Art. 6(1)(b) GDPR).
• The people travelling with you. The number of adults in your party and the ages of any children travelling with you also concern people other than you. We use them only to plan the trip you ask for, and we never ask for their names. Legal basis we rely on: legitimate interests in planning the trip you request (Art. 6(1)(f) GDPR).
• Security and technical operation. PingWinWin briefly uses IP addresses to limit request rates, stores passwords only as hashes, emails you when your password has been changed and receives the technical request data needed to deliver the site. Legal basis we rely on: legitimate interests in keeping PingWinWin and your account secure and working (Art. 6(1)(f) GDPR). The IP addresses used to limit request rates are held only briefly in our server’s memory and are not stored in our database; this is processing you would expect from any web service, it is not used to build a profile of you, and its impact on you is limited.
• Remembering your preferences. The site keeps your theme and currency in your browser, and saves the currency to your account while you are signed in. These are settings you choose, so storing them in your browser does not depend on your analytics choice. Legal basis we rely on: for the currency saved to your account, performance of a contract (Art. 6(1)(b) GDPR); for settings kept only in your browser, legitimate interests in remembering the settings you chose (Art. 6(1)(f) GDPR).
• Messages you send us. When you write to us, we use your email address and your message to reply and to deal with your request. Legal basis we rely on: legitimate interests in answering the people who contact us (Art. 6(1)(f) GDPR).
• Requests to exercise your rights. When you ask to exercise your data protection rights, we process what we need to handle your request and to keep a record of how we handled it. Legal basis: compliance with our legal obligations under the GDPR (Art. 6(1)(c) GDPR).
• Existing guest sessions. For guest sessions created before temporary previews, after the visitor has accepted the applicable Guest Terms, we process only what is objectively needed to maintain the session, save and retrieve its trip, handle requested edits, and generate an itinerary when requested. Counters administer the stated one-trip, one-initial-generation, one-regeneration offer. Our working position for that saved guest service is Art. 6(1)(b) GDPR. This basis does not cover the temporary preview. Terms acceptance is not consent to personal-data processing.
• Temporary AI itinerary preview. The destination, dates, selected pace and language are sent to Anthropic only when you request generation; PingWinWin keeps the input and result in page memory and creates no trip or itinerary record. We have not yet determined the lawful basis for this one-off preview and do not claim that Terms acceptance or the service wording itself establishes one. The operator must resolve and document this before treating the basis as settled.
• Preview abuse prevention and API security. The API uses the request IP in an in-memory limiter for at most two preview-generation attempts per IP address per hour. This is intended to slow repeated billable requests and protect availability. The application does not persist the limiter bucket in its database; buckets are per API process and are lost on restart, so limits can vary across instances. People sharing an IP address may share the limit. Our working position is legitimate interests in proportionate abuse prevention and security (Art. 6(1)(f) GDPR); the right to object is described below. Hosting providers may separately receive request metadata as described under recipients and retention.
• Trip preference Copilot. When you ask it for suggestions, your messages and the saved trip’s details, including those about the people travelling with you, are sent to Anthropic, and PingWinWin keeps a record of each request without its content, as described under “AI itinerary generation and trip preference suggestions”. Using the Copilot is optional: you can plan a trip and generate its itinerary without it. We have not yet determined the lawful basis for this processing.

Service providers and other recipients

We use the following service providers to run PingWinWin:

• Vercel hosts the website.
• Render hosts our server (the API), which handles your account and trips. Render uses subprocessors to provide its service, including Cloudflare: requests from your browser to our server pass through Cloudflare’s network, which receives them, including your IP address, and forwards them to Render.
• Neon hosts our database. The production database is located in Frankfurt, Germany (Amazon Web Services region eu-central-1).
• Google provides place search, transfer estimates and maps (Google Maps Platform: Places API, Routes API and Maps JavaScript API) and, only if you accept analytics, Google Analytics.
• Anthropic provides the AI model that generates itineraries and the suggestions of the “Trip preference Copilot”.
• Brevo sends the emails about your account: email verification, password reset and password-change notices.
• Google / Gmail receives messages sent to our published contact mailbox, which is a consumer Gmail account. This is for handling contact and privacy messages, separately from Google Maps Platform and Google Analytics.
• Conditional error monitoring (Sentry): Sentry integrations are present in the application. If a deployment has a Sentry DSN configured, Sentry may receive error details and limited request/trace metadata. The current code excludes request and response bodies, cookies and credentials, AI inputs and outputs, and client-IP trace fields; the preview service does not send the itinerary input or result to monitoring. We have not confirmed whether a DSN is configured for the current production deployment or which Sentry account terms, region and retention apply.

What the providers’ own documents say about their role and terms:

• Anthropic’s data processing addendum describes Anthropic as its customer’s processor.
• Google’s terms for the Maps APIs describe Google and its customer as independent controllers.
• Vercel’s data processing addendum is stated to apply to customers on its Pro and Enterprise plans. PingWinWin uses Vercel’s Hobby plan.
• Render publishes a data processing addendum that describes Render as a processor. Whether and how it applies to PingWinWin’s account, which is on Render’s Hobby plan, has not been established.
• Neon is part of Databricks. Whether Databricks’ data protection terms apply to PingWinWin’s account, which is on Neon’s Free plan, has not been established.
• Render lists Cloudflare among the subprocessors it uses to provide its service. PingWinWin has no account or contract of its own with Cloudflare.

These are the providers’ own descriptions, not a legal assessment by PingWinWin.

Some pages may show images hosted on other websites, such as photos of local guides; when your browser loads them, those websites receive your IP address and browser information. Links to other websites — for example to Google Maps or to our social media profiles — take you to services that have their own privacy policies. The same applies to affiliate links, which lead through the affiliate network Travelpayouts to partners such as Tiqets; PingWinWin adds nothing about you or your trip to them.

We do not sell your personal data. We may disclose it where the law requires us to.

Where data is processed

Some of the services PingWinWin uses process personal data outside the European Economic Area (EEA), in particular in the United States:

• Our server (the API), which handles your account and trips, runs on Render in Oregon, USA.
• Requests to our server pass through the network of Cloudflare, a subprocessor of Render, which may handle them at a Cloudflare location inside or outside the EEA.
• Our database is hosted by Neon in Frankfurt, Germany. Because our server runs in the USA, data it reads from or writes to the database is also processed there.
• The website runs on Vercel. Pre-built pages may be served from the Vercel location nearest to you, which may be inside or outside the EEA. Pages generated on request run on Vercel’s servers; when we checked, such a request ran in Vercel’s Washington, D.C., USA region.
• Anthropic states that data sent to its API is stored in the USA and that, unless routing is restricted, requests may be processed in the USA, Europe, Asia or Australia. PingWinWin does not restrict this routing in its requests.

Render states that it is certified under the EU-U.S. Data Privacy Framework, including its UK Extension and the Swiss-U.S. Data Privacy Framework. Anthropic’s data processing addendum refers to the EU Standard Contractual Clauses of 2021, with UK and Swiss addenda, for relevant transfers. Google’s terms refer to Standard Contractual Clauses or other data transfer solutions for relevant services. Whether any of these safeguards applies to PingWinWin’s transfers has not yet been confirmed.

How long we keep data

• Account data is kept for as long as your account exists.
• Trips, with their arrival and departure details and itinerary, are kept until you delete the trip or your account. Generating a new itinerary replaces the one shown for your trip, and resetting the itinerary returns it to the plan as generated. Earlier versions of the itinerary, including changes you saved, are still kept with the trip. Deleting a trip also deletes its itinerary and these earlier versions.
• Guest sessions are valid for 30 days from creation. The server cleanup runs hourly and deletes the guest row and its trip after the 31-day threshold from creation, normally at the next hourly run (within about 25 hours after the session ends); downtime can delay cleanup. You can delete a trip sooner. If you register or sign in with the authenticated guest session, its trip moves to your account and the guest row ends.
• Visit counter records are deleted automatically after 30 days.
• Cookies and browser storage last as described in our Cookie Policy.
• Google Analytics data: under the current settings of our Google Analytics property, event data is kept for 2 months and user data for 14 months, and the user-data period starts again whenever the same browser is active again. These settings may change.
• Itinerary and Copilot requests sent to Anthropic: according to Anthropic’s documentation, it deletes API inputs and outputs within 30 days, but may keep some data longer — for example, content flagged by its safety systems.
• Trip preference Copilot: PingWinWin does not save Copilot messages or answers; the open page holds the conversation in memory until you start a new conversation, reload or leave the page. The record of each Copilot request — when it was made and when it ended, without its content — is kept with the trip and deleted with it.
• Place search, transfer and map requests (Google): Google keeps these requests under its own terms and policies; PingWinWin has not established how long.
• Map lookup records: deleted automatically 29 days after the lookup, or with the trip if that comes first.
• Database history: Neon keeps a history of database changes that allows the database to be restored to an earlier point in time. On PingWinWin’s current plan this history window is 6 hours, according to Neon’s documentation, so deleted data can remain recoverable from it for up to 6 hours. This is not a general backup-retention period.
• Hosting logs: according to their documentation, on the Hobby plans that PingWinWin uses, Vercel keeps runtime logs for 1 hour and Render keeps logs for 7 days.
• Cloudflare, Render’s subprocessor: how long Cloudflare keeps data about requests to our server has not been established.
• Account emails (Brevo): Brevo keeps delivery records and the content of the emails it sends according to its own terms and settings; PingWinWin has not established how long.
• Messages sent to our contact address are kept for as long as needed to deal with the request and are then reviewed for deletion within 12 months, unless a longer period is needed for an ongoing matter or a legal obligation.
• Temporary previews: PingWinWin keeps preview inputs and results only in the open page’s memory; refresh or close discards them. We create no PingWinWin trip or itinerary record and do not put the preview in browser storage. Anthropic states that standard API inputs and outputs are deleted within 30 days, subject to exceptions; the terms and settings that apply to PingWinWin’s account have not been confirmed. Hosting and network providers may process request metadata under their own retention settings.
• Conditional error monitoring (Sentry): if Sentry reporting is enabled for a deployment, event and trace retention follows the account settings that apply to that Sentry project. PingWinWin has not confirmed whether reporting is enabled in the current production deployment or the applicable retention period.
• Not yet established: whether Vercel or Render keep request or log data beyond the periods above, and how long Neon keeps backup and deletion-recovery data beyond that history window.

Security

Passwords are stored only as salted hashes. The cookie that keeps you signed in cannot be read by scripts on the page and is sent only over encrypted connections. Signing out ends every sign-in to your account, on all devices. Each trip can be accessed only through the account that created it or, for a guest, through the guest session in the browser that created it. No service can promise perfect security, but we aim to keep the amount of information we hold small.

Your rights

Where the GDPR applies, you have the right to:

• access the personal data we hold about you and receive a copy of it;
• have inaccurate data corrected;
• have your data erased;
• have the processing of your data restricted;
• receive the data you have given us in a structured, commonly used and machine-readable format (data portability);
• object to processing based on legitimate interests;
• withdraw your consent at any time, without affecting processing carried out before you withdrew it;
• lodge a complaint with a data protection supervisory authority, in particular in the EU country where you live or work or where you believe an infringement took place.

These rights apply within the conditions and limits set by law. Depending on where you live, you may have additional rights under local law.

You can view, edit and delete your trips at any time in the app, delete your account on your profile page, and change your analytics choice with “Cookie settings” at the bottom of every page. The app does not yet let you change your email address or name or download a copy of your data: for these and any other request, contact us through our contact page. We may ask you to confirm that a request comes from the account holder. When your account is deleted, your trips and itineraries are deleted with it.

If you are using a guest session, you can delete a trip in the app. A guest who has not accepted the current Guest Terms can delete the whole guest session and trip on the acceptance screen. If you cannot access that browser session, contact us; we may need information that lets us identify the guest data safely.

Your right to object

Where we rely on legitimate interests (Art. 6(1)(f) GDPR) — for security and technical operation, for settings kept only in your browser, for the details of the people travelling with you and for answering messages you send us — you have the right to object to that processing at any time, on grounds relating to your particular situation. We will then stop it, unless we can demonstrate compelling legitimate grounds for it that override your interests, rights and freedoms, or we need it to establish, exercise or defend legal claims. This also covers temporary limits on repeated guest-session creation; a visitor using a shared IP address can explain that circumstance when objecting.

To object, write to us using the details on our contact page. You can also remove the settings kept in your browser at any time by clearing this site’s data in your browser settings.

Changes to this policy

PingWinWin is under active development, so this policy will change as the product does. Any update will be reflected in the “last updated” date above.

Contact

If you have a question about this policy or want to exercise your rights, please use the details on our contact page.