Privacy policy

AndAway (andaway.app) is a private, invite-only travel-preparation app run by an individual for personal use by their household. It is not a commercial service. Questions or requests: dennytedrow@gmail.com.

Account: your name, email address, and profile photo if you sign in with Google; a password hash if you use a password. Session cookies keep you signed in.

Trips you enter or import: trips, reservations (flights, lodging, parking, transport), prep tasks, packing items, reusable defaults, and who a shared trip's items are assigned to.

Google Calendar (only if you connect it): read-only access to the calendars you choose, used to find upcoming travel and keep trip dates current. We store event identifiers, times, titles and locations needed to match events to trips, plus the access credentials Google issues for your connection. We never create, change or delete calendar events.

Only to provide AndAway's features to you and the people you explicitly share a trip with. We do not sell data, show ads, or use your data for advertising, profiling or training AI models.

Trips are private unless you share one. A shared trip's details and lists are visible to its members; your other trips and your Google connection stay private to you.

AndAway's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google Calendar data is used only for the trip features described above, is not shared with third parties, is not sent to AI providers, and is not read by people except where you ask for help with your own account or the law requires it.

Data is stored on Railway (United States), which hosts the app and its database. Weather forecasts are requested from Open-Meteo using a trip's destination, without your identity. If you use the Scout assistant, the text of your request and the relevant trip and checklist details are sent to the AI provider configured for AndAway (currently Google Gemini, on its paid tier: Google states it does not use these requests to improve its products and keeps them only for a limited time to detect abuse and meet legal requirements) so it can propose changes; nothing is applied until you confirm. Calendar events and reservations are not included, and neither are the name, destination or dates of a trip created from a Calendar suggestion. Voice input uses your browser's built-in speech recognition (provided by Apple, Google or your browser's maker); AndAway receives only the resulting text, never audio.

Your data is kept while your account exists. You can delete trips and items at any time. Disconnecting Google Calendar in AndAway deletes the stored credentials; you can also revoke access from your Google Account's third-party connections page. To delete your account and all associated data, email dennytedrow@gmail.com; it will be removed within 30 days, including from backups as they expire.

Connections use HTTPS. Access to every trip is enforced in the database for each signed-in user, and account credentials are stored only on the server, never in the browser.

If this policy changes, the effective date above will be updated.