Legal
Privacy Policy
Effective: 2026-10-30
DRAFT — pending founder & legal review. Not yet legally binding.
Last updated 2026-10-30.
This Privacy Policy explains what information Vittles collects, how we use it, who we share it with, and the choices you have. Vittles is run by [PLACEHOLDER — founder to confirm: legal entity name] ("we", "us", "our"). This policy covers the Vittles app and website.
1. Information we collect
Account information. Your email address and display name, and your real name if you choose to add it. If you sign in with Google, Google also gives us your Google account ID and profile photo. You sign in with an emailed link or with Google, so we never store a password for you. People on your trips can see your display name, your real name (if you've added it) and your email address, so the group can coordinate.
Session and security information. When you sign in, we save your IP address and browser type with that session. We also use IP addresses to limit how many requests can come from one place, which helps protect the Service. When a request is refused because it hit a limit, we record which limit it was, with your account id or, if you aren't signed in, a salted hash of your IP address instead of the address itself.
Trip and member information. Trip names, dates, locations, roles, notes, recipes, meal plans, packing and shopping lists, and the names of the people you add. If a Vittles admin deletes a trip, we keep a record of that deletion (see Section 7).
Details a host adds about other people. When a host imports a file, Vittles finds the people in it and creates a personal invite for each adult, holding what the file says about them: their name, any children coming with them, their dietary needs, and the days they arrive and leave. Only the trip's hosts can see these invites. When the person opens their invite, they see these details and can change or remove them before joining; the invite then no longer holds them. If the host revokes the invite, they're removed too. A host can also add someone's cell number to their invite, from the file or by typing it. Only the trip's hosts and co-hosts can see it, and it is used only so the host can text that person their invite from the host's own phone; Vittles doesn't send texts. The number is not shown to the person when they open the invite, and it is cleared when the invite is claimed or revoked, the member is removed, a week after the trip ends, or when the trip is archived. Hosts should add only people who expect to be invited.
Dietary and health information. Allergies, dietary needs and related notes for the people on a trip, including dependents. Your account also stores your own dietary profile — your dietary needs, allergens and notes — if you fill it in. Privacy laws treat this as sensitive health information. We collect it only to help you plan food for your group, so please add it only when it's needed for that.
Dependents, including children. You can add dependents — for example, the kids coming on your trip — to a trip. Their details are entered by the adult who manages them. Dependents don't sign in, Vittles has no accounts for children, and it isn't meant for children. If you add a dependent, you are responsible for having the right to share their information.
Your location (optional). When you look for trip ideas, Vittles can ask your browser for your device's location to fill in where you're starting from. Your browser asks your permission first; you can say no and type a place instead. If you allow it, your browser sends the coordinates to Google's geocoding service, which turns them into a city and state (for example, "Bend, OR"). That label fills in your starting point and is sent to our AI provider with your trip-idea search (see Section 3). We don't save the coordinates.
Files you upload. Files you import (for example, a PDF, Word document or spreadsheet) so we can read the trip or recipe details in them. The file itself is never saved: we keep only the trip details you confirm, plus the file's name, type and size in the trip's activity, where only the trip's hosts see the name. Route files (GPX) you add to a backpacking trip: we keep the route (its path, distance, climb and any named points in the file) and the file's name, type and size, which everyone on the trip can see.
Usage information. A small amount of operating data, such as how many imports and trip-idea searches you've run, records of AI use (which feature ran, how much text it processed and what it cost — not the text itself), which planning steps you reached while creating a trip, and which paid map, place, address and email services a trip used (for example, that a map loaded or a place search happened — never what you typed). Each import you run is recorded against your account so we can apply your import allowance. Separately, the minimised import counts and outcomes are kept without your account and with no file contents: what kinds of details a file had and how the import went, not a record of each AI call; an import's planning steps are linked to your account like any other trip planning. We use it for usage limits, to keep costs under control and to spot cost trends over time. Our hosting provider also keeps server logs, such as IP addresses, the pages requested and any errors, so we can fix problems.
Alpha applications. If you apply to join the Vittles alpha, we collect your name, email, location (if you give it), the kinds of trips you take, and your answer to our question about planning food with a group. If you tick the box that says "You can email me for feedback while I'm testing Vittles.", we record that you agreed and when. We use that agreement only to ask for feedback during the alpha — never for marketing or anything else unless you agree separately.
Trail register feedback. When you send a note, we save its kind, its topic (if one is chosen), title, text, your account identity, whether you participated in the alpha, and the optional page context you include. For bug reports, the page selector starts with the page you came from; you can choose another page, describe one, or select Not sure. A captured location is retained only if it still matches your selection; it omits query strings and fragments and redacts invite credentials. General feedback and feature suggestions do not include page context. Only the Vittles team can read the private feedback inbox. A notification email to our admins includes the kind and title and a link to that inbox, not the note body or page context. Feedback is not sent to an AI provider or issue tracker. Please leave out passwords and private trip details.
2. How we use information
We use your information to:
- run the Service, including trips, sharing and guest links;
- sign you in and keep your account secure;
- create the AI suggestions you ask for, and run the few AI features that work in the background (see "AI and third-party AI processing" below);
- apply usage limits and keep costs under control;
- help you when you contact us, and tell you about the Service.
We don't sell your personal information, and we don't use it for advertising.
3. AI and third-party AI processing
When you use an AI feature — for example, generating a meal plan, importing a file, adding a recipe from a web page, or asking for destination ideas — we send the relevant trip or recipe text to one of our AI providers so it can produce what you asked for.
Some AI features also run on their own, without anyone asking. When someone on a trip opens it, Vittles may write the trip's one-line headline in the background. When you save a recipe you typed into your library, Vittles may fill in its missing details, such as nutrition, from the recipe text.
What we send, and what we don't.
- We never send your account details — your email address, sign-in information or account ID — to an AI provider.
- Meal planning sends trip details (dates, place, group size, cooking setup) and the dietary needs of the group as a whole (for example, "no dairy, vegetarian"). It doesn't send anyone's name or say who has which need.
- Destination and recipe features send place names and recipe text. A trip-idea search also sends your starting point — a place you type, or the city found from your device location if you allowed it (see Section 1) — and that is information about you.
- The trip headline sends trip facts (trip type, season and length, destination, group size, whether kids are coming, cooking setup, food and trip style, weather) plus the host's trip notes and food vision as written. It doesn't send anyone's name.
- Anything you type into an AI feature — trip notes, special requests for the meal planner, or instructions like "make this vegetarian" — is sent exactly as you wrote it. Please leave out personal details you don't want processed, such as names, phone numbers or someone's health information.
- Files you import (spreadsheets, PDFs or documents) are sent to an AI provider as they are, so it can read them and set up your trip. That includes any names, contact details or dietary notes in the file.
Which provider. We use more than one AI provider and pick the model that does each job best — one might plan meals while another suggests destinations. That choice can change as models improve. Section 6 lists the providers we currently use, and we keep that list up to date.
Retention and training. We use AI providers only through their business API services. Their terms for those services don't allow them to train their models on what we send or what they send back, and they keep data only as long as they need to provide and secure their service.
We never send your data to an AI provider for advertising or to train its models.
4. Cookies and local storage
Vittles uses only the cookies it needs to work, plus one that remembers a display preference — the only thing tracking you here is your own meal plan. We don't use advertising cookies or run any analytics in the app. If that ever changes, we'll update this page first and ask for your consent where the law requires it.
| Cookie | What it does |
|---|---|
Sign-in session (better-auth.session_token) | Keeps you signed in. A few short-lived cookies may also be set while you're signing in. |
guest_token | Lets you into a trip that was shared with you through a guest link |
pending_link_guest | Connects your guest access to your account when you sign up or sign in |
vittles_alpha_banner | A preference cookie that remembers whether you left the alpha banner open. It's kept for 1 year, the page's scripts can read it, and like any cookie it's sent with your requests. |
The app also saves a few preferences in your browser's local storage, such as your colour theme, how you like lists and maps shown, and your recent destination searches. Unlike cookies, they stay on your device and aren't sent to us. While you create a trip, the app also keeps a random planning-session id for that browser tab so we can add up what planning cost; it's sent with your planning requests and cleared when the tab closes.
5. How we protect information
Your connection to Vittles is encrypted (HTTPS). Sign-in cookies are set so that scripts on the page can't read them (HttpOnly), and we limit what reaches other companies as this policy describes. No system is perfectly secure, but we work to protect your information, and if a breach affects you we'll tell you where the law requires it.
6. Who we share information with (sub-processors)
We use a small number of service providers ("sub-processors") to run Vittles. They use your data only to provide their service to us.
| Sub-processor | What they do for us |
|---|---|
| AI providers — currently Anthropic, OpenAI and Google | Run the AI features. Which provider handles which feature can change (see Section 3); this list names every provider we may use. |
| Railway | Hosts the app, the database and the server logs |
| Cloudflare | Runs our domain, network security and routing. All traffic to the site passes through Cloudflare, which sees your IP address. |
| Signs you in — only if you choose Google sign-in | |
| Resend | Sends sign-in emails and other account emails |
| Mapbox | Shows maps, terrain and directions on trip maps. Your browser contacts it directly, so it receives the map locations and your IP address when a map loads. Mapbox's map software also sends Mapbox usage data about each map load (telemetry), with your IP address. |
| Google Maps Platform | Place search, address lookup and place photos when you set a destination or campsite, and turning your device location into a city if you allow it. Your browser loads Google Maps directly, so Google receives your IP address. Our server also follows Google Maps short links you paste, to find the place they point to; only the link itself is requested. |
| Open-Meteo | Weather forecasts and elevation for a trip's location. Your browser contacts it directly, so it receives the location and your IP address, but not your account. |
| Wikimedia Commons | Destination photos. Your browser contacts it directly, so it receives the name of the place we're looking up and your IP address. |
| Recreation.gov (RIDB) | Public campground data. Our server sends a campground's name and coordinates to check the site, never who you are. |
We don't use an analytics provider. If we add one, we'll list it here and update the date at the top of this policy. We may also share information if the law requires it, or to protect the rights and safety of the people who use Vittles or of the Service itself.
Several of our providers are based in the United States, so your information may be processed outside your country.
7. Data retention
We keep information only as long as we need it to run the Service, as set out below. This table is the definitive list of how long we keep each kind of data.
| Data | Examples | Why we keep it | Legal basis | How long we keep it |
|---|---|---|---|---|
| Account | email, display name, real name (optional), Google profile photo, your dietary profile (dietary needs, allergens, notes — sensitive health information) | signing you in, helping you, planning food that suits you | contract | until you delete your account; deleted with it |
| Sessions | IP address, browser type | signing you in, security | legitimate interest | until the session expires or you sign out; all deleted with your account |
| Limit records | which limit a refused request hit, with your account id or a salted hash of your IP address | protecting the Service, tuning limits | legitimate interest | 90 days; records linked to your account are deleted sooner, with your account |
| Trips and members | names, roles, dates, dietary and health needs | planning together | contract / legitimate interest | until the trip is deleted. A trip that has other members with accounts and has plans in it can only be archived, not deleted; an archived trip keeps all its data until it is deleted. If a member deletes their account, their details are anonymized (see "Deleting your account"). |
| Dependents (may be children) | name, age group, dietary needs | planning for a group that includes children | entered by the managing adult (parental) | kept with the trip; anonymized when the managing adult deletes their account |
| Pending invites | name, cell number, and for an imported invite also children's names, dietary needs, arrival and departure days | giving each person an invite, with any details from an import ready to check, and letting the host text it | legitimate interest | until the person joins or the host revokes the invite; then removed from the invite. A cell number is also cleared when the member is removed, 7 days after the trip's end date, or when the trip is archived. Database backups keep these until they expire. |
| Guests | name, guest link token | trip access without an account | legitimate interest | until the guest is removed or the trip is deleted |
| Usage | import and trip-idea search counts, AI usage records, map, place and email cost records, planning sessions, trip cost summaries | usage limits, cost control, spotting cost trends | legitimate interest | for as long as we run the Service. Search counts are deleted with your account. Usage and cost records, and planning sessions, stay linked to your account until you delete it. Usage and cost records stay linked to a trip while it exists; after a trip is deleted they keep only the trip's id. Trip cost summaries hold the trip's type, its length and group size (including how many people joined), when and how it was created, how complete our records of its costs are, whether it finished or was deleted, and what it cost us, by service. They stay linked to the trip while it exists, which links them to its members; after a trip is deleted they keep only the trip's id, for cost reporting. Import allowance records (one per import, linked to your account) are kept until you delete your account. Import metrics hold no account or file contents and are deleted after 12 months. |
| Admin trip deletions | the trip's name, the host's email, the admin's email, the reason, and counts of the trip's members, meals and list items | an audit record of trips our admins delete | legitimate interest | kept indefinitely; deleting your account doesn't remove it |
| Alpha applications | name, email, location, trip types, your answer, feedback consent | reviewing applications | consent (for feedback emails) / legitimate interest | deleted or anonymized when the alpha ends, or sooner if you ask. Applications still waiting after 90 days are removed, and turned-down ones 180 days after the decision. |
| Trail register feedback | note kind, topic, title, text, account identity, alpha-participation snapshot, optional page context | improving Vittles and investigating feedback | legitimate interest | until an admin deletes the note or you delete your account; included in your data export. Delivered admin notifications cannot be recalled, and database backups retain deleted data until they expire. |
| Uploaded files | imported PDFs, documents, spreadsheets; GPX route files | reading your trip details; showing a trip's route | contract | an imported file is read in memory and never saved (only the trip details you confirm are kept); its name, type and size stay in the trip's activity (the name visible to the trip's hosts) until the trip is deleted. A route keeps its path, distance, climb and any named points from the file until it's removed or the trip is deleted, and the route file's name, type and size stay in the trip's activity (visible to everyone on the trip) until the trip is deleted |
8. Your rights and choices
Depending on where you live, you may have the right to see, correct, delete or get a copy of your personal information, to object to or limit how we use it, and to withdraw your consent. To use any of these rights, email [PLACEHOLDER — founder to confirm: privacy/contact email]. Using them won't change how we treat you. You may also be able to complain to your local data-protection authority.
Getting a copy of your data. Email [PLACEHOLDER — founder to confirm: privacy/contact email] to ask for a copy of your profile, your trip memberships, your personal recipe library and your trail register feedback. We aim to reply within [PLACEHOLDER — founder to confirm: export response SLA, e.g. 30 days].
9. Deleting your account
You can delete your account yourself in your account settings. Trips are shared, and the other people on them still need their plans, so deleting your account removes you but leaves shared trips in place:
- Your account, dietary profile, sign-in records, sessions, personal recipe library, trail register feedback, import allowance records and limit records linked to your account are deleted. Any alpha application is removed by our daily clean-up, within a day.
- Your usage and cost records and planning sessions are unlinked from you: they stay, without your account, for cost reporting. Cost summaries of trips that were deleted stay, without your account.
- On shared trips you belong to, you are anonymized: your name is replaced and your dietary and personal details are cleared, so the trip still works for everyone else. Any dependents you manage on those trips are anonymized the same way.
- Content you added to shared trips — such as meal and shopping notes and recipes you added — stays on those trips for the group, without your name.
- Trips you created are handed to another member who has an account. If nobody else on the trip has an account, the trip and everything in it is deleted.
- Database backups keep deleted data until they expire.
Need help deleting your account? Email [PLACEHOLDER — founder to confirm: privacy/contact email].
10. Children
Vittles isn't meant for children and has no accounts for them. Details about children come from the adult who adds them to a trip, as described above. If you think a child has created an account, contact us and we'll deal with it.
11. Changes to this policy
We may update this Privacy Policy from time to time. When we do, we'll change the date at the top and, for significant changes, let you know by email or in the app.
12. Contact
Questions about this policy or your data? Email [PLACEHOLDER — founder to confirm: privacy/contact email] or write to [PLACEHOLDER — founder to confirm: business mailing address].