Skip to content

Privacy Policy

Draft for review. This document has not yet been reviewed by a lawyer and will be finalized before public launch. Last updated: October 12, 2026.

This policy explains what Carribou collects, why, who we share it with, and the choices you have. We collect as little as we can.

What we collect

  • Account: your email address, and optionally a display name and travel interests.
  • What you save: trips (place identifiers, times, notes), saved places and road trips. Guest trips stay in your browser until you save them to an account.
  • Usage and security: a salted, one-way hash of your IP address (never the raw address) to enforce fair-use limits and prevent abuse; counts of the map and AI features used; clicks on affiliate links (partner, page context, place identifier).
  • Location: only if you tap “Use my location”, and only to plan that route. We don't store it unless you save the road trip.
  • Analytics and errors: if enabled, anonymous product analytics without tracking cookies, and error reports to fix bugs.

Cookies

We use essential cookies to keep you signed in. We don't use advertising or cross-site tracking cookies, and we don't sell or share personal information for targeted advertising.

Service providers

  • Google Maps Platform (maps, places, routes). Google's handling of data is covered by the Google Privacy Policy.
  • Supabase (accounts and database), Vercel (hosting) and Upstash (rate limiting).
  • Anthropic (AI summaries and itineraries). We send place names, types and public encyclopedia text, plus your trip preferences, never your email or account details.
  • PostHog and Sentry (analytics and error reports), when enabled.
  • Affiliate partners receive only what's in the link you click (for example a destination name), never your name or email.

Your choices and rights

  • Delete your account any time from Account → Delete my account. This deletes your profile, trips, saved places and road trips right away.
  • Edit your profile, make shared trips private, or clear guest trips from your browser.
  • California residents have the right to know, access, correct and delete personal information, and to not be discriminated against for using these rights. We don't sell personal information. To make a request, contact us below.

Children

Carribou isn't directed to children under 13, and we don't knowingly collect their data.

Contact

Privacy questions or requests: via the contact on our project page, github.com/OmniCurator/waypoint. A dedicated email address will be listed here before launch.