Privacy policy

Offdays is run by the operator of Offdays. This page explains what we collect when you use Offdays, why, who else handles it, and the controls you have. Questions: hello@off-days.app.

What we collect

• Account: your name, email address and a one-way hash of your password (we never store the password itself), and whether you’ve confirmed your email.
• Planning data: the settings you choose (country, PTO budget, holidays, travel origin, passport), saved PTO plans, trips, itineraries, trip preferences and any notes you write for the planner.
• AI usage: for each AI request, the time, model, token counts and whether it succeeded. We use this to enforce plan limits and to monitor quality.
• Your own API key, if you add one: stored encrypted (AES-256-GCM) and only decrypted on our server to make requests you ask for. We show only its last four characters.
• Plan and billing status: which plan you’re on and when it renews. Payments aren’t live yet; when they are, card details will be handled by the payment provider and never stored by us. If you join the waitlist, we keep your email and the plan you were interested in.
• Security data: your IP address is used briefly to rate-limit sign-in and similar actions; those counters expire within hours. Our hosting provider keeps standard request logs.

Cookies and local storage

We set one cookie, offdays_session, to keep you signed in. It’s essential, so there’s no consent banner. Your browser’s local storage keeps small preferences such as dark mode and your last filters. We don’t use advertising or cross-site tracking cookies. Page-view statistics, if enabled, use Vercel Web Analytics, which doesn’t use cookies.

Who else processes your data

• Hosting and database: Vercel (application hosting) and our Postgres provider (for example Neon) store and serve the app and your data.
• AI providers: when you create, regenerate or replan a trip with AI, the destination’s place list, your trip dates, preferences and notes are sent to the AI provider that runs the request: our configured provider (such as Anthropic or OpenAI), or the provider of your own key if you added one. Your name, email and other trips are not sent.
• Email: our email provider (for example Resend) delivers account emails such as confirmations and password resets.
• Weather: our server asks Open-Meteo for forecasts using only the destination’s coordinates.
• Fonts: pages load typefaces from Google Fonts, which receives your IP address when your browser fetches them.

We don’t sell your personal information or use it for advertising.

How long we keep it

• Account and planning data: until you delete them or your account.
• AI usage records: 90 days.
• Sign-in sessions: up to 30 days, or until you sign out.
• Email links: confirmation links expire after 48 hours, password-reset links after 1 hour.

Your controls

• Export: download everything we hold about you from Settings → Security & account.
• Delete: delete your account from the same place. It removes your account, plans, trips, saved API key and usage history immediately. Backups held by our database provider roll over within their retention window.
• Correct: change your name, email, password and preferences in Settings.
• Depending on where you live (for example under the GDPR or CCPA) you may have further rights, such as objecting to processing or complaining to a regulator. Contact hello@off-days.app and we’ll respond within 30 days.

Security

Passwords are hashed with scrypt, session tokens are stored only as hashes, personal API keys are encrypted, all traffic uses HTTPS, and sign-in and similar actions are rate-limited. No system is perfectly secure; if we learn of a breach affecting you, we’ll tell you.

Children

Offdays isn’t meant for children under 16, and we don’t knowingly collect their data.

Changes

If we change this policy in a way that matters, we’ll update the date above and, for significant changes, email account holders before they take effect.