Privacy

Everything you enter — trips, stays, transport, costs, travelers, passport numbers, airline and hotel membership numbers, booking references, documents and checklists — is written to your browser’s own storage (IndexedDB) on the device you entered it on.

No account is needed to use any of it, and unless you turn on sync there is no copy anywhere else and nothing identifying you attached to it. Clearing your browsing data for this site deletes those trips from that browser permanently. We cannot restore them, because we never had them.

Sync is optional and off until you create an account for it. When it is on, a copy of each trip is stored on our server so your other devices can fetch it — encrypted in your browser before it is sent, with a key derived from your password. What we hold is a block of bytes we cannot open. There is no decryption key on the server, because one was never sent.

Your email address is not stored either. It is turned into a one-way hash and only the hash is sent. The hash cannot be turned back into your address, though anyone who already knows your address can compute the same hash. What the server does hold, per trip, is the encrypted block, a random identifier, a revision number, its size, whether it was deleted and when it last changed — not a trip name, not dates, not places. For the account, it holds the hashed address, what it needs to check your password (never the password itself), and the public half of your booking-email key.

The honest limit of this, stated plainly. The encryption happens in JavaScript that we serve you. That means the guarantee rests on us continuing to ship code that behaves this way — as it does for every service that encrypts in a browser rather than in an app you installed. It protects you against our server being breached, against us being compelled to hand over what we store, and against anyone reading it in transit. It is not a defence against the page itself being changed, and nobody offering browser-based encryption can honestly claim otherwise.

There is no password reset, and this is not an oversight. Your password is the key. If you forget it, the copy on our server can never be opened again, by you or by us. Trips already on your device are unaffected — sync is a second home for a trip, never the only one.

Deleting. Deleting a synced trip removes it, and its earlier versions, from our server; we keep only a note that it was deleted, so your other devices find out. Our backups keep a copy for a while. Delete account, beside Sign out, removes your account and everything we hold for it, including share links and waiting booking emails. Shared trips you own are deleted for everyone in them. In shared trips someone else owns, you are removed and the changes you made stay, because they are part of that trip. This browser’s copy of your account’s trips is removed too, so download a backup first if you want to keep them.

A share link is encrypted in your browser with a key that lives only in the link itself, after the #, which browsers never send to us. We store the encrypted copy, which trip it came from, when it expires (at most 90 days), and the link’s name. The name is readable by us, and it is the trip’s name unless you type another.

The link leaves out passport numbers and expiry dates, saved travelers and their membership numbers, documents, booking and ticket links, and your notes on the trip as a whole. It keeps booking references and your notes on individual hotels, flights and activities. Anyone with the link can open it. Expiring or deleting it stops new visits; it cannot take back a copy someone already saved.

When you share a trip with other members, its contents are encrypted so that only members can open them. We cannot read the itinerary. We can see who is in it: which accounts (as hashes) are members, their roles, invitations and join requests, and when each change happened. A member can keep what they have seen; removing someone stops new changes reaching them, not what they already had.

To forward bookings, you first send one email from your address to trips@manr.ai, which proves the address is yours. After that, a booking you forward passes through our email service (Cloudflare) and our mail handler, which read it once, in passing, to check who sent it and lock it to your account. From then on it is stored sealed and we cannot open it. Mail from any other address is refused.

A sealed email is deleted from our server once you add it to a trip, or after 10 days if you don’t. At most 50 wait at once; if more arrive, the oldest is removed and the app tells you.

Apart from sync, share links, shared trips and booking emails — each described above, and each only if you use it — four things leave your browser.

A city name, to OpenStreetMap. To place a pin on the map, the name of a stay’s city — “Kandy”, “Colombo” — is sent to OpenStreetMap’s public geocoding service, and the map itself loads map images from OpenStreetMap. Nothing else about the trip goes with it: no dates, no names, no passport numbers, no amounts. Results are cached in your browser so the same city is not looked up twice.

A place, to a weather service. To show the forecast beside a stay, that city’s coordinates — rounded, so they point at the city and not at your hotel — are sent to MET Norway, the Norwegian Meteorological Institute. Your dates are never sent with it. We ask only for that place’s ordinary nine-day forecast and match it against your itinerary here in your browser, so nobody on the other end learns when you are going, or that anyone is going anywhere at all. Forecasts are cached in your browser and refreshed about once a day.

A message, if you send one. If you use the contact form, your name, your email address and your message are sent to us by email so we can reply. Nothing about your trips is attached. The same form is used if you report a booking email that could not be read; that message says only the date it arrived and anything you add.

Ordinary requests for the site itself. Loading any website means your device asks a server for it, and that request carries your IP address. Our server keeps standard web-server logs. Fonts, images and code are served from this site rather than from a third-party network, so loading a page does not tell anyone else that you were here.

We use Google Analytics to count visits — how many people arrive and which pages they read. It is on unless you turn it off. For now we are counting visits without asking first, to see how much the site is used. If you had already said no when we used to ask, that answer still stands and nothing was switched on for you.

To turn it off, use this: Turn analytics off or on. It takes effect immediately: Google Analytics’ cookies are removed from this browser, none are set again, and no profile is built. Being straight about what turning it off does not do: the analytics script still loads, and Google receives an anonymous, cookieless signal that a page was viewed, which it uses only for aggregate counts. It cannot recognise you, link two visits, or follow you to another site. You can turn it back on from the same place.

While it is on, Google receives the ordinary things a web analytics tag receives: the page you are on, roughly where you are in the world, and what kind of device and browser you are using. Your IP address is anonymised before it is stored.

Nothing from your trips is ever included. No names, dates, hotels, costs, passport numbers or booking references. And the address of a trip page carries an identifier, so that identifier is stripped before the page view is sent — Google is told that someone opened a trip page, never which one.

There is no advertising on this site. No ads are served, no advertising cookies are set, and the advertising signals sent to Google are refused for everyone regardless of what you choose above.

We may add advertising later. If we do, you will be asked about it separately and plainly before anything runs — this page will say so first, and consenting to analytics today is not consent to advertising tomorrow.

Advertising will not run on your trip pages. Ads, when they appear, will be on the public pages only — never on the screens where your itinerary, travelers and documents are shown.

The site stores three things on your device: your trips, your choice of light or dark theme, and your analytics choice, once you have made one — and, if you sign in to sync, what keeps you signed in and the keys that open your trips. Signing out removes those. They stay on the device.

Unless you have turned analytics off, Google Analytics also sets its own cookies to recognise a returning visit. Turn it off, and they are removed and none are set.

You can export a trip as a file, and you can pick a file for the app to keep in sync automatically. Those files are written by your browser to a location you choose. They are never uploaded.

An exported file is plain and unencrypted, and contains passport and membership numbers. If you put it in a synced folder, it goes wherever that folder goes. Keep it somewhere you would keep the passports themselves. The separate “share a copy” export strips passport numbers, expiry dates, documents, saved travelers and their membership numbers, and booking and ticket links, and keeps booking references and your notes on individual bookings — use that one for sending an itinerary to the people travelling with you.

Data protection law gives you rights to access, correct, export and delete the personal data an organisation holds about you. Without sync, there is nothing to exercise them against: your data is on your device, where you can see, change, export and delete it. With sync, sharing or booking emails, we hold the encrypted copies and account details described above. We cannot read their contents, and you can delete all of them yourself with Delete account.

A message you send through the contact form arrives as an ordinary email. If you would like that deleted, reply to it and ask.

This is a trip planner and is not directed at children. It asks for nothing about anyone, and the visit counting described above is the same for every visitor.

If what the app does with data changes, this page changes with it. It describes the current behaviour, not an intention.