Privacy Policy

The short version

• We collect the minimum needed to find you a trip.
• We never sell your data to third parties.
• We use httpOnly cookies for auth — your token can't be read by JavaScript.
• Affiliate partners get a tracking ID when you click out, not your identity.
• You can delete your account and your data any time by contacting us.

What we collect

When you use TravelVulture, we may collect:

• Account data — email, name, hashed password (we never store plaintext).
• Search inputs — origin, budget, trip length, traveler counts, interests. Stored anonymously to improve recommendations.
• Saved trips — stored in your browser's local storage by default; in our DB only if you create an account.
• Analytics events — page views, clicks, outbound clicks, with a random session ID. No personal identifiers unless you're logged in.
• IP + user agent — for rate limiting and fraud prevention. Discarded after 30 days.

What we don't collect

• Passport numbers, government IDs, payment card numbers (we never see them — bookings happen on partner sites).
• Precise GPS — we use the city name you type, not your device location.
• Phone numbers, unless you submit a curated-trip inquiry.

How we use it

• To run the search and personalize results.
• To send price alerts you've opted into.
• To detect and block abuse (rate limiting, vote stuffing).
• To measure what works and what doesn't — aggregate analytics, never per-user data sold or shared.

Affiliate partners

When you click through to a partner (Booking.com, Expedia, Viator, etc.), our affiliate tracking ID is appended to the URL so we get credit for the referral. The partner gets the same data they'd get from any other source — no extra information about you is shared. Your booking happens on the partner's site under their privacy policy.

Cookies

We set three cookies:

• tv_access — httpOnly, your login session. Cannot be read by JavaScript.
• tv_refresh — httpOnly, used to renew your session.
• tv_csrf — readable by our frontend to prevent cross-site request forgery.

No advertising cookies. No third-party trackers.

Your rights

You can: export your data, delete your account, opt out of email alerts, or request correction of anything inaccurate. Email us at the address on the contact page and we'll respond within 7 days.

Children

TravelVulture is intended for users aged 16+. We don't knowingly collect data from children under 13. If you believe a child has provided us data, contact us and we'll delete it.

Changes

We'll post any material changes to this policy on this page with an updated date. Substantive changes — anything reducing your rights — will also be emailed to active account holders.