Where We Are (“Where We Are,” “we,” “us”) is a private, shared travel calendar for family and close friends. This policy explains what information we collect, how we use it, and the choices you have. We keep it deliberately small: we collect only what the app needs to work, and we don’t sell your data or use it for advertising.
Information we collect
- Account information. When you sign in with Google, we receive your name, email address, and profile picture from your Google account. We use Google solely to authenticate you.
- Content you add. Trips (destinations, dates, notes, and whether a trip is confirmed or tentative), optional flight details (flight number, arrival airport, time, and terminal), your home base, your public username, and an optional phone number for pickup coordination.
- Your connections.The people you connect with, requests you send or receive, and which contacts you mark as “close.”
- Technical data. Standard server logs (such as IP address and request information) generated by our hosting provider, and an essential cookie used to keep you signed in.
How we use your information
- To provide the service — showing your calendar, your circle’s plans, and where your paths overlap.
- To look up flight arrival details you request, so you can coordinate pickups.
- To keep your account secure and enforce who can see what.
- To respond to you and to fix problems or abuse.
How your information is shared
Your plans are private by default. They are shared only in the ways you choose:
- With people you connect with. Connections see the places and dates of trips you share with all contacts. Contacts you mark as close can additionally see your flight details and trip descriptions. These rules are enforced in our database, not just in the app.
- Publicly, only if you choose. If you make your calendar public, anyone with your
/u/<username>link can see your shared places and dates. You can switch back to private at any time.
We never sell your personal information, and we don’t use it for advertising.
Service providers
We rely on a small number of trusted providers to run the app:
- Google — sign-in.
- Supabase — database and authentication.
- Vercel — application hosting.
- AeroDataBox (via RapidAPI) — flight lookups. When you look up a flight, we send the flight number and date you entered to retrieve arrival information.
These providers process data on our behalf and may store it in countries other than yours.
Data retention
We keep your information for as long as your account is active. You can delete individual trips at any time, and you can ask us to delete your account and associated data by emailing us (see below).
Your choices and rights
- Access and update your details, trips, and home base directly in the app.
- Control who sees what — per-trip audience, close contacts, and public/private toggle.
- Delete trips yourself, or request full account deletion.
- Depending on where you live, you may have rights to access, correct, export, or delete your personal data. Contact us to exercise them.
Security
Access to your data is enforced at the database level with row-level security, and data is encrypted in transit. No online service can be perfectly secure, but we work to protect your information and limit what others can see to what you’ve chosen to share.
Children
Where We Are isn’t directed to children under 13 (or the minimum age required in your country), and we don’t knowingly collect their information.
Changes to this policy
We may update this policy from time to time. When we do, we’ll change the “last updated” date above, and significant changes will be reflected here.
Contact
Questions or requests? Email us at hello@whereweare.app.