Public Beta Privacy Notice

9. What's collected and why

Account: your name, email address and sign-in details (email, Google or Apple sign-in on the web), and that you confirmed you're 18 or older (and when).
Trips: the trips, ideas, votes, lists and checklists you and your group add, plus the names and email addresses of people invited to your trips. Other members of a trip can see what you add to it. If you delete your account, your messages on other people's trips are deleted, and trips you planned are deleted for everyone, including other members' messages and ideas on them. If you're on a trip someone else planned, keep your own copy of anything important.
Emails: sign-in, invite and trip emails are sent through Resend. Trip emails (mentions, polls, invites and updates) say who did what and in which trip, with a link. They never include anyone's message text, poll question or invite note. You can turn trip emails off under You → Account → Email. Sign-in emails still send.
Notifications: if you turn on browser notifications, they tell you who did something (for example, "Sam mentioned you"). They never include message text. You can turn them off in your browser or device settings at any time.
Reports and blocks you make or that involve you, kept to keep users safe.
No product analytics. The beta doesn't use a product analytics service.
Service providers that process data for the beta: Render (hosting and database), Anthropic (AI suggestions, only when you turn them on, and on a trip only when everyone on it, including guests, has), Geoapify (map tiles, loaded in your browser, and place lookups) and the OpenStreetMap Foundation (backup place lookups from our server), Resend (email), Cloudflare (website delivery), Google and Apple (sign-in) and Ticketmaster (event data; nothing about you is sent), and Apple (music previews: when you tap play, the clip streams from Apple to your browser, so Apple receives your IP address and browser details).
Not done: no selling or sharing of your information, no advertising or ad trackers, no product analytics, no affiliate tracking, no payments.

10. AI suggestions (Anthropic)

AI suggestions are off until you turn them on, and they only run on a trip when everyone who has joined it, including guests, has turned them on. If anyone turns them off, they stop for the whole trip. When they run, Touray sends Anthropic, PBC, our outside AI provider, the trip details, what anyone on the trip, including guests, pastes or writes there (including trip history), their names and notes, the tastes and profile details of people who have turned AI on (such as home city, interests and saved notes) and basic activity (such as how long they've used Touray and how many trips they have), and the names a planner types for people they invite or for guest seats no one has claimed yet, so it can suggest ideas. If you use Touray without an account (for example the quiz, paste or ideas), AI is also off until you turn it on, and Touray sends Anthropic what you enter or paste there, such as your quiz answers and cities. We never send the email addresses or phone numbers from accounts or invites, passwords, invite links or reports, and we try to remove contact details that people type or paste. AI answers can be wrong. Check important details with the seller or an official source. You can turn AI suggestions off at any time under You, in the trip if you're a guest, or on the same screen if you don't have an account; they then stop on every trip you're on.

11. Location and maps

Map tiles load straight from Geoapify (KEPTAGO LTD, Cyprus) to your browser, through its delivery network Cloudflare, so they receive your IP address and browser details when the map loads, like any website. Place lookups use Geoapify, with the OpenStreetMap Foundation's Nominatim service as a backup, called from our server, so those lookups don't carry your IP address or account details.

12. Deletion and your choices

Deletion on request: you can delete your account in the web app under You → Delete account, or email support@appattacklabs.com and ask. Email requests are completed within 30 days after I confirm the request comes from your account email. Some records may be kept where the law requires it (for example, child-safety reports) or to keep users safe. If I remove a user from the beta, I keep a scrambled (hashed) copy of their email address for up to 3 years, even after their account is deleted, so it can't be used to sign up or accept an invite again.
Download: ask for a copy of your data at the same email.
AI: you can turn AI suggestions off under You, in the trip if you're a guest, or on the same screen if you don't have an account.
State privacy rights: depending on where you live, you may have rights to know, delete, correct and opt out. I honour these requests for all users, whether or not a law requires it. I'll verify your request by confirming control of your account email, and respond within 30 days (or the shorter period the law requires). I won't discriminate against you for exercising your rights. I don't sell or share personal information as those laws define it.

13. Contact

Matt Hope, operator of the Touray beta · support@appattacklabs.com · 2307 Mount Vernon St, Orlando, FL 32803

Operated by Matt Hope.

Beta Terms

Need help? Email support@appattacklabs.com

If a child is in danger, call 911. To report child sexual exploitation, go to report.cybertip.org.