Privacy Policy
How Sagabond collects, uses and stores your information.
Who is responsible
Sagabond is operated by Pritish Joshi, who is the data controller for the personal data described here. For any privacy question, or to exercise any of the rights below, write to hello@sagabond.site.
What we collect, and why
Your account
When you sign up we store your email address, an optional display name, and a one-way bcrypt hash of your password. We never store your password itself and cannot recover it — a reset replaces it. We also record whether and when you confirmed your email address. If you sign in with Google instead, we receive your email address, name and Google account identifier from Google.
Legal basis: performance of our contract with you. Without this data there is no account.
Your trips
The itineraries you create — destinations, dates, stops, transport, accommodation, plans and any notes you write — are stored so we can show them back to you and to the people you invite. Anything you type into a trip is content you chose to put there, so please do not put information in a trip that you would not want a collaborator to read.
Booking details are encrypted in our database: booking references, seat numbers, carriers and flight numbers, the names, addresses and links of places you stay, transport passes and their labels, plan titles, addresses and map positions, photo captions and Google Drive file ids, and every note. The key is held by our server, separately from the database, so these details stay protected if the database or a backup copy is ever exposed.
This is not end-to-end encryption: our server decrypts them to show the trip to you and to the people you invite. Your trip's name, destinations, dates and costs, and who you share a trip with, are not encrypted this way, because the app needs them to list, order and share your trips.
Legal basis: performance of our contract with you.
Photos you add to a trip
Photos are held in your browser (IndexedDB) on the device you added them from. They are not uploaded to our servers, and we never hold a copy.
Two things can move a photo off that device, and both are worth understanding:
- Google Drive. If you have Drive sync switched on, each photo is copied to your own Drive and then marked readable by anyone with the file link — that is what lets a collaborator load it. Treat a synced photo as public: anyone who obtains that link can view it, whether or not you invited them, including any location saved in the photo. Travel documents in the vault are not given this permission; they stay private to your Drive.
- Straight to a collaborator. When you and someone sharing the trip have it open at the same time, photos transfer browser to browser, described under Live collaboration below.
Photos and documents are the two places private material tends to end up. A passport page or a ticket belongs in the document vault, which is not shared with collaborators and not made public.
Live collaboration
When two people have the same trip open, edits travel through Pusher, and photos travel directly between the two browsers using WebRTC. Setting up that direct connection means the two devices exchange their network addresses, so a collaborator's browser can see your IP address, as yours can see theirs. This is how WebRTC works everywhere, not something specific to us, but you should know it before sharing a trip with someone you would rather not reveal that to.
To make the connection we use Google's public STUN servers, and, when a direct connection cannot be established, a TURN relay operated by Open Relay (metered.ca) forwards the encrypted photo data between the two browsers. Legal basis: performance of our contract with you, for a feature you use by sharing a trip.
Travel documents stay on your device
Boarding passes, tickets and confirmations added to the document vault are stored in your browser (IndexedDB) on the device you added them to. They are not uploaded to us, and collaborators on a shared trip cannot see them.
If you switch on Google Drive sync yourself, those files are copied to your own Google Drive using a permission scope limited to files this app creates. That copy is governed by Google's privacy policy, and you can turn the sync off or revoke our access in your Google account at any time. Legal basis: your consent, given by enabling the sync.
Security and abuse prevention
We record your IP address briefly when you sign in, sign up, or request a password reset, purely to count attempts and block brute-force attacks. These counters delete themselves automatically once their time window has passed. Email confirmation and password-reset links are stored only as hashes, are single-use, and expire after 24 hours and 1 hour respectively.
Legal basis: our legitimate interest in keeping accounts secure.
Usage statistics
We use Vercel Web Analytics to count page views. It sets no cookies, stores nothing on your device, and builds no profile of you across sites or over time. We see aggregate counts — which pages are visited, from roughly which country — not individuals.
Legal basis: our legitimate interest in understanding whether the app works.
Who we share it with
We do not sell your data, and we do not use it for advertising. We rely on the following providers to run the service, each processing data only on our instructions:
- Vercel — hosting and cookieless analytics.
- MongoDB Atlas — the database holding accounts and trips.
- Resend — sending confirmation and password-reset emails.
- Pusher — live updates, and setting up direct photo transfers.
- Google — sign-in, Drive sync if you enable it, and the public STUN servers used to open a direct connection.
- Open Relay (metered.ca) — relays photo data between two collaborators only when a direct browser-to-browser connection fails.
To show place suggestions and destination information our server also requests data from Foursquare, Wikivoyage, Wikipedia, Wikidata and GeoNames. These are lookups about places, made by our server, and carry nothing that identifies you.
One lookup is made by the app itself. To show a photo of a city, your browser asks Wikidata, Wikipedia and Wikimedia Commons for it directly. Those requests carry the city’s name, its country and its GeoNames number, and, like any request from your browser, its IP address. They carry nothing that names you or your account.
We may also disclose data where the law requires it, or where it is necessary to establish or defend a legal claim.
Where your data is processed
Some providers above operate outside the European Economic Area. Where data is transferred out of the EEA, that transfer relies on the European Commission's Standard Contractual Clauses or an adequacy decision, as set out in each provider's own data-processing terms.
Cookies and local storage
Sagabond uses no advertising or tracking cookies. Everything we store on your device is either required for the app to function or a preference you set yourself, which is why you are not asked to consent to it:
| What | Where | Why | How long |
|---|---|---|---|
| Session & security token | Cookie | Keeps you signed in and blocks cross-site request forgery | Until you sign out or it expires |
| Light / dark choice | Session storage | Remembers the theme you picked | Until you close the tab |
| Unfinished trip draft | Session storage | Stops you losing a half-built trip on a refresh | Until you close the tab |
| Offline cache & its owner | Local storage, Cache API | Lets the app open offline, and clears the cache when a different person signs in | Until you sign out or clear site data |
| Documents & photos | IndexedDB | Holds the travel documents and trip photos you added, on this device | Until you delete them or clear site data |
Clearing your browser's site data removes all of the above, including any travel documents in the vault that you have not synced to Drive.
How long we keep it
Your account and trips are kept until you delete them or ask us to close your account, after which they are removed from the live database. Login rate counters and email links expire automatically as described above. Backups may retain copies for a short period before rotating out.
Two kinds of copy outlive a deletion here, and we would rather say so than let you assume otherwise. A photo synced to your Google Drive is deleted from Drive by you, not by us. And trips made before we moved photo storage onto your own device may still show photos hosted on ImgBB, an external image host we no longer upload to; removing such a photo from a trip drops our link to it but does not delete ImgBB's copy, which stays reachable by anyone holding the URL.
Your rights
Under the GDPR you may:
- ask for a copy of the personal data we hold about you;
- have inaccurate data corrected;
- have your data deleted;
- ask us to restrict or stop processing it;
- object to processing based on our legitimate interests;
- receive your data in a portable, machine-readable format;
- withdraw consent — such as for Drive sync — at any time, without affecting what was done before you withdrew it.
Write to hello@sagabond.site and we will respond within one month. If you are not satisfied, you may complain to your local data protection authority — in Sweden that is Integritetsskyddsmyndigheten (IMY).
Children
Sagabond is not intended for children under 16. We do not knowingly collect their data; if you believe a child has created an account, contact us and we will remove it.
Changes to this policy
If we change how we handle data we will update this page and the date at the top. Significant changes will be notified by email before they take effect.