Mappitt

Legal

Privacy Policy

Last updated: September 9, 2026

This Privacy Policy explains what information Mappitt collects, how we use it, and the choices you have. Mappitt is operated by Mappitt, LLC (“Mappitt”, “we”, “us”). By using Mappitt you agree to the practices described here.

Information we collect

Account information

When you create an account we collect your email address and, optionally, a display name. Passwords are never stored in plain text — we keep only a salted bcrypt hash that cannot be reversed into your password.

Trip content

We store your saved itineraries, including dates, places and booking links. Your trips are private unless you create a share link. Anyone with that link can read the shared itinerary and follow its booking links. Stop sharing or delete the itinerary to disable the link. This cannot remove copies someone already saved. When you open a booking link we record that a link of that kind was opened from that itinerary and which partner it went to — no IP address, device details or account is stored with it.

Itinerary requests and drafts

Each time you ask Mappitt to plan or draft a trip, we keep a record of the request (your description or the guided fields you filled in), the itinerary the planner produced, and technical details such as the model used and any errors. We use this to check itineraries for accuracy, investigate problems you report, and improve the planner. Our team may review these records. We do not use them to train AI models. The request and itinerary text is deleted after 90 days, or sooner if you delete your account; only anonymous statistics are kept longer.

Issue reports

When you report an issue, we store your description, the page address, the itinerary title when available, and any reply email you provide. We send the report to our support inbox through Resend. A hashed network identifier helps limit spam.

Technical information

To keep you signed in we set a session cookie. As part of normal server operation we also process basic technical data such as your IP address, browser type and the pages you request, which is kept in short-lived server logs for security and debugging.

Usage analytics and session replay (optional)

If you accept optional cookies, we use Google Analytics and Microsoft Clarity to understand how Mappitt is used. These tools collect device and browser information, approximate location derived from your IP address, the pages you visit, and how you interact with them — including clicks, scrolling and mouse movement, which Clarity uses to build heatmaps and session replays. Text you type into forms is masked in replays. When you are signed in we attach your internal account ID (never your email address) so we can see how signed-in use differs from anonymous use. We may also use Google Ads conversion measurement to understand which advertising brings people to Mappitt.

We partner with Microsoft Clarity and Microsoft Advertising to capture how you use and interact with our website through behavioral metrics, heatmaps and session replay to improve and market our products and services. Website usage data is captured using first- and third-party cookies and other tracking technologies to determine the popularity of features and online activity. We also use this information for site optimization, fraud and security purposes, and advertising. For more information about how Microsoft collects and uses your data, visit the Microsoft Privacy Statement. For Google, see How Google uses information from sites that use its services.

How we use your information

We use your information to:

  • operate, secure, and support your account;
  • store and display your trips and itineraries;
  • review generated itineraries for accuracy and quality;
  • provide maps and read-only itinerary sharing; and
  • send transactional email such as verification codes and password resets;
  • measure usage and, if you accept optional cookies, the effectiveness of our advertising; and
  • respond to your questions and support requests.

We do not sell your personal information, and we do not use your trip content for advertising. Optional advertising cookies may be treated as “sharing” for cross-context behavioral advertising under some U.S. state laws. Declining optional cookies opts you out, and we honor the Global Privacy Control browser signal as an opt-out.

Service providers

To run Mappitt we share limited data with service providers that help provide the service. Booking providers also process data under their own policies when you follow a booking link:

  • Railway — application hosting and the managed PostgreSQL database that stores your account and trip data, located in the United States.
  • Google — venue information, routes and time zones when those features are enabled.
  • Travel search providers — SerpAPI, RapidAPI providers, Travelpayouts and ScrapingBee may receive destinations, travel dates, occupancy and venue queries to find prices and booking links.
  • Booking partners — Expedia Group, Stay22 and linked booking sites receive the search parameters carried in links you open and may set their own affiliate attribution cookies.
  • Cloudflare Turnstile — browser and network signals used to prevent automated abuse.
  • Optional analytics and advertising — when you accept optional cookies, Google Analytics, Google Ads and Microsoft Clarity measure usage, conversions and browser interactions as described above. Avoid putting sensitive information in trip notes.
  • Mapbox — when you search for a place or view a map, the search text and coordinates are sent to Mapbox for geocoding and map rendering.
  • Resend — delivers our email: verification codes, password resets, issue reports and, when you email an itinerary, the recipient addresses and itinerary content.
  • OpenAI — when you generate, edit or adjust an itinerary or use the AI companion, your messages and the relevant trip content are sent to OpenAI’s API to generate a response. OpenAI may retain API data for up to 30 days for abuse monitoring and does not train on it. When a request needs something looked up (for example, this year’s festival dates, or whether a restaurant is still open), the search query is run through OpenAI’s hosted web search.
  • TypeSafe AI — after an itinerary is generated, the relevant trip request and itinerary content may be sent to Jev for quality evaluation, routed through Vercel’s AI Gateway. TypeSafe states that it does not train or fine-tune models on customer input. TypeSafe retains personal data as reasonably necessary to provide its services and support its business purposes, as described in its privacy policy.

Cookies and local storage

We use essential cookies for sign-in, security and free-draft limits, and browser storage for preferences, your cookie choice and an unsaved draft. Optional analytics and advertising scripts (Google Analytics, Google Ads, Microsoft Clarity) load only after you accept optional cookies; they set cookies such as _ga, _gcl, _clck and _clsk. You can decline and continue planning, or change your choice at any time with the link in the footer of any page — declining removes those cookies. If your browser sends the Global Privacy Control signal we treat it as a decline. Booking sites control cookies on their own domains after you follow a link.

International transfers

Mappitt is operated from the United States and our service providers process data there. If you use Mappitt from outside the U.S., your information will be transferred to and processed in the U.S., where privacy laws may differ from those in your country.

Data retention

We keep your account and trip content for as long as your account is active. If you delete your account, we delete the associated trip content; residual copies may persist in backups and logs for a limited period afterward.

Your choices and rights

You can review, edit and delete your trips at any time while signed in, and delete your account from the Account page, which removes your trips and account data. Depending on where you live, you may also have the right to access, correct, export or delete your personal information, to object to or restrict certain processing, and to opt out of the sale or sharing of personal information. To exercise any of these rights, or to request a copy of your data, email [email protected]. We will not treat you differently for exercising them. If you are in the EU, UK or Switzerland, you may also lodge a complaint with your local data protection authority.

Security

We protect your account with hashed passwords, encrypted session tokens, and access controls that ensure a trip is only ever visible to the account that owns it. No online service can promise perfect security, but we take reasonable measures to safeguard your information.

Children

Mappitt is not directed to children under 13, and we do not knowingly collect personal information from them.

Changes to this policy

We may update this policy as Mappitt evolves. When we do, we will revise the “last updated” date above, and significant changes will be communicated where appropriate.

Contact

Questions about privacy? Email [email protected].