Privacy policy

Account data — your name, email address and date of birth. Date of birth is used only to confirm you meet the minimum age and to filter age-restricted activities. It is never shown on your profile.

Trip data — itineraries, packing lists, costs, crew invitations and RSVPs.

Location — only when you grant permission, and only to show activities near you. We do not track your location in the background.

Usage data — pages visited and features used, in aggregate, so we know what to improve.

To provide the service you asked for (contract), to keep accounts secure and prevent abuse (legitimate interest), and — for optional emails such as the weekly digest — on the basis of your consent, which you can withdraw at any time in Profile.

Members of a trip can see the itinerary, the crew list and RSVP statuses for that trip. That is the point of a shared plan.

We use processors for hosting, email delivery and error monitoring. They act on our instructions only. We do not sell personal data or share it with advertisers.

Account data is kept while your account is active. When you delete your account we remove personal data within 30 days, except where we must retain records to meet a legal obligation.

You can access, correct, export or delete your data, object to processing, or withdraw consent. Export and deletion are self-service in Profile. For anything else, email privacy@be-outside.app and we will respond within one month.

Passwords are hashed with bcrypt, sessions use httpOnly cookies over HTTPS only, and access to production data is restricted and logged. No system is perfectly secure, but we take this seriously.

Data may be processed outside your country. Where that happens we rely on Standard Contractual Clauses or an equivalent safeguard.

Questions or complaints: privacy@be-outside.app.