Privacy

Information we collect

We collect information you provide directly: your name, email address, trip details, diary entries, expense records, photos, and checklist items.

How we use it

Your data is used solely to provide and improve the service — storing your trips, syncing across devices, enabling sharing between trip mates, and tracking expenses. We do not sell or share your personal data with third parties for advertising.

Where it is kept

On Cloudflare’s infrastructure: the record in D1, the photographs in R2. Everything is transmitted over HTTPS. Sign-in tokens are cryptographically signed. Passwords are hashed with PBKDF2-HMAC-SHA256, a unique random salt per account and one hundred thousand iterations; the password itself is never stored.

What is sent to be read or answered

Three things you ask Boswell for are done by an AI service provider on this app’s behalf, through this app’s server: its answers, reading a booking or a receipt into a journey, and writing up a day. Boswell is sent your question, the conversation so far, and the journey it is about — its name, days, stops and plans. Reading a booking or a receipt sends the words of the PDF you choose, read out on your device, or the picture you choose. Before a PDF’s words are sent, its email addresses and phone numbers are taken out, on your device. Names, booking references and ticket numbers stay in, because they are what the booking is read for, and a picture is sent as it is. Writing up a day sends that day’s plans (their times, names and places), your answers to Boswell’s questions or the lines you wrote, and the date; the photographs you add are not sent. What it is sent is stored in Singapore and may be processed outside it. The provider undertakes not to use it to train its models, and does not say how long it is kept. Nothing is sent unless you ask Boswell something, choose a booking or a receipt to read, or choose how a day’s write-up should read. How much each ask used is counted against your account, as the service measures it, and not what was asked or answered; the count is deleted with the account.

What sharing shares

A trip is shared only with the people you invite onto it, and a friendship needs both sides to agree. Within a shared trip, the expenses and the gallery are shared — that is what the ledger is for. Your diary stays yours: trip mates cannot read it, and neither can anyone else.

Getting it out, and getting rid of it

Export, in Settings, writes every journey you own into one file, at any time. Delete everything, in the same place, removes your own journeys, your diary entries, your saved places, your friendships, your notices and your sign-in. It is immediate, it cannot be undone, and an export is the only way back.

What a deletion keeps, and why

Two things are not only yours, so they stay. On a journey somebody else owns you remain listed as a trip mate, and the photographs you put there stay with it, still recording that you took them — otherwise another traveller’s record of days you were both there would quietly lose half of itself. Your name and your address are kept with them, so that returning to the same address makes you the same person to those trip mates rather than a stranger. Anything you wrote in from the Help sheet is kept too, with the sender unlinked.

Cookies and local storage

Browser storage keeps you signed in and holds the record on the device so it can be read and written without a network. No third-party tracking cookies are used.

Getting in touch

Write in from the Help sheet, or write to [email protected]. Write in reaches the person who makes this, and it carries which build you were on, which is usually the first thing they would have to ask.

5 Oct 2026 — Getting in touch gained an address: [email protected], beside Write in on the Help sheet. Nothing else was changed, and nothing you had agreed to was taken away. Sent as a notice in the app; it applies from 7 Nov 2026.

8 Sept 2026 — Three sentences were corrected because they described the app wrongly: a claim to collect sign-in times and device types, which nothing collects; a claim that expenses are private, when a trip’s ledger is shared with everyone on that trip by design; and a way of getting in touch that did not exist, which now does. Nothing was added, and nothing you had agreed to was taken away.