Privacy Policy

Last updated: July 12, 2026

NostosRoute ("we," "us," or "our") respects your privacy. This policy explains what we collect, why, and what choices you have. By using nostosroute.com, you agree to this policy.

1. What we collect

We try to collect as little as possible. Specifically:

Trip details you enter (cities, dates, budget, preferences). These are saved in your own browser's local storage so you can revisit them. They are not uploaded to our servers unless you explicitly ask us to.
Trip analysis requests. When you click "Analyze," we send your trip details to Anthropic's Claude API to generate scoring and recommendations. Anthropic has its own privacy policy at anthropic.com/legal/privacy.
Standard server logs. Our hosting provider (Vercel) logs basic request info (timestamp, IP address, user agent) for security and debugging.
Cookies. See section 6.

2. Optional cloud accounts (Sign in with Google)

Default today: NostosRoute works without an account, and always will. Trips stay on your device unless you choose to sign in and save them to your account.

If you choose to sign in and save trips to your account, here is what happens:

Sign-in is handled by your provider. Google authenticates you. We never see or store your password.
We receive basic profile info from the provider, typically your email address, name, and a provider user ID — only what is needed to create and secure your account.
We store saved trips on our servers (for example via Supabase) so you can access them across devices. This includes trip details you entered and analysis results you chose to save.
We do not sell your account data or use Google user data for advertising. Our use of Google sign-in follows Google's API Services User Data Policy.

You must agree to this policy and our Terms before your first cloud save. You can delete saved trips and request account deletion at any time by emailing privacy@nostosroute.com.

3. What we don't collect (unless you choose a cloud account)

In device-only mode, we don't collect or store names, emails, phone numbers, or payment information on our servers.
We don't sell or rent any of your information to anyone.
We don't fingerprint your device or track you across other websites.
We don't store payment card numbers (we don't process payments today).

4. Security and data incidents

We use reasonable technical and organizational measures to protect data we store, including HTTPS, access controls, and reputable hosting and database providers. No method of transmission or storage is 100% secure.

If a security incident affects personal data we hold about you, we will investigate, take steps to reduce harm, and notify you (and regulators where required by law) in line with applicable rules such as GDPR or state breach-notification laws. This does not limit your legal rights where the law does not allow them to be limited.

5. Affiliate links

Some links on our site (especially booking links to hotels, flights, and tours) are affiliate links. If you click one and make a purchase, we may earn a small commission at no additional cost to you. We only recommend services we believe will be useful for your trip — affiliate status does not affect our recommendations.

6. Cookies and advertising

We use a small number of cookies and similar technologies:

Essential cookies — required for the site to function (e.g. remembering your trip drafts). You cannot opt out of these without breaking the site.
Advertising cookies (Google AdSense) — when our advertising is live, Google may set cookies to show relevant ads. Google's use of advertising cookies is governed by Google's privacy & terms. You can opt out of personalized advertising at google.com/settings/ads.

On your first visit, you will see a cookie consent banner. You can accept all cookies, reject non-essential cookies, or close the banner.

7. Your rights

Depending on where you live, you may have rights regarding your personal data:

EU/UK (GDPR): right to access, correct, delete, or export your data; right to object to processing; right to withdraw consent.
California (CCPA/CPRA): right to know what we collect, delete it, and opt out of any "sale" of personal information (we do not sell data).

To exercise any of these rights, contact us at privacy@nostosroute.com. Because most of your data lives in your own browser, you can also clear it yourself by clearing localStorage / cookies for nostosroute.com in your browser settings.

8. Children

NostosRoute is not directed to children under 13. We do not knowingly collect personal information from children. If you believe a child has provided us information, please contact us and we will delete it.

9. Changes

We may update this policy as the site grows. The "Last updated" date at the top will reflect any changes. Material changes will be announced on the site for at least 30 days.

10. Contact

Questions? Email privacy@nostosroute.com.