Privacy Policy

Who can see it inside the app

A household shares one set of trips. Every signed-in member can read and edit the trips, bookings, documents, and travelers in it, and there is no per-item privacy. No other household can see any of it and nothing is public. If you add somebody else's passport, birth date, or itinerary, you are handling their information, so ask them first.

Who can see it at our end

While the beta runs, we can read forwarded booking email, conversations with Alyeska, and diagnostics, because that is how a parser that misreads a confirmation or an assistant that answers wrongly gets found. Everything else is reached only when you ask us for help with a specific problem, or when the law requires it. Access is limited to the people running the beta, and it ends when the beta does.

How long it lasts

• Your account, household, trips, and documents: until you delete them or delete your account.
• Documents you open: a copy is kept on that phone or computer so it still opens with no signal. It is protected by the device's own lock rather than by ours. Deleting the document removes the copy on the device you delete it from, and signing out removes every copy on that device.
• Original forwarded email messages: the stored copy of the mail is discarded after 30 days. A short record of what arrived and which trip it was filed to stays, and so does the booking read out of it.
• Conversations with Alyeska: 90 days, then deleted.
• Diagnostics: 90 days, then deleted, and you can turn them off entirely.
• Location: used to answer the question in front of you and not stored.
• The waitlist: until you ask us to take you off it.
• After you delete your account: removed from our systems within 30 days, and from routine backups within 90, other than what the law requires us to keep.

How it is protected

• Encrypted in transit over HTTPS and encrypted at rest by the database and file storage.
• Row-level security in the database itself, so a household's rows are unreachable by another household's session rather than merely unrequested by the app.
• Documents are served through short-lived signed links rather than public URLs.
• The one exception is the artwork on a trip: those pictures are drawn for you rather than uploaded by you, and they sit at an unlisted web address anyone with the link could open, which is what lets them load instantly and work offline. They hold no personal information. They are deleted with your account, although a copy already sitting in a content network's cache can take a while to expire.
• Sign-in is handled by our authentication provider. We never see or store your password.
• When you choose a password we check it against a public list of passwords exposed in known breaches, and refuse the ones that appear there. Your browser turns the password into a one-way hash, and only the first five characters of that hash leave — from our server rather than your device. Those five characters match thousands of unrelated passwords, and the comparison that matters happens on your device, so neither we nor the breach service can tell which password you chose.
• No system is perfect. If a breach affects your information we will tell you and the regulators we are required to tell, without waiting to be asked.

What you can change yourself

• Turn off Alyeska's AI, which stops anything being sent to the AI provider.
• Turn diagnostics off.
• Turn each optional part on or off: forwarded email, reminders, location, reading fields from documents, and the calendar subscription.
• Withdraw your beta consent, which keeps your account and closes the app until you agree again.
• Delete a document, a traveler, a trip, or the whole account.

All of it is in Settings, under Beta consent and privacy. None of it requires emailing us.

Your rights

Depending on where you live, you can ask us to give you a copy of what we hold, correct it, delete it, hand it to somebody else in a portable form, or stop a particular use of it. You can also object to processing and, in the European Economic Area and the United Kingdom, complain to your data protection authority. Under California law you can ask what we collected and why, ask for it to be deleted or corrected, and be told we do not sell or share it for cross-context advertising, which we do not. We will not treat you worse for asking.

Write to admin@alyeska.app and we will answer within 30 days. We may ask you to confirm you control the account before we hand anything over, which is a protection for you rather than an obstacle.

Why we are allowed to hold it

• To provide the app you asked for: performance of our agreement with you.
• For AI processing, forwarded email, notifications, location, and document reading: your consent, given at the gate and withdrawable in Settings.
• For security, fraud prevention, and fixing what is broken: our legitimate interests, weighed against yours.
• For records the law requires us to keep: legal obligation.

Children

Independent sign-in requires you to be 18 or older. A parent may add a child as a traveler so plans and packing fit the family. A parent can also open a temporary, read-only view of that child’s assigned non-draft trips and own packing. The child does not sign in, use Alyeska's AI, send messages, edit lists, upload files, share location, or register for push notifications. This view uses a necessary access cookie and no screen-use analytics or session replay. Parent authorization and security records are scheduled for removal after 30 days; essential hosting and security logs may also be retained under the policies described here. Parent passkey public keys remain until the parent account is deleted. Revoking a login does not itself delete existing traveler information. Parents can contact us for access, correction, or deletion.

If you joined the waitlist

• What we keep: your first and last name, your email address, your household size if you chose one, whether you said you organize trips for a group or an organization, and the date you joined.
• What it is for: inviting you into the beta and, if you said you organize trips for others, inviting you to try group trips when they open. Nothing else, and it is never sold or shared.
• Who can see it: only the people running the beta. Nobody can read the list through the app, signed in or not.
• Your IP address is used to stop repeated tries from one place. It stays in the server's memory and is never saved with your entry.
• Your invitation goes out through the email service listed above, which sees your address and the message.

To be taken off the list, write to admin@alyeska.app. You don't need an account.

Posts from other sites

When you ask for posts about a place, the app shows links to public videos on TikTok, Instagram, Facebook, and YouTube. We keep the link, title, and thumbnail address, not the video. A video's player loads from its platform only when you tap it, and from then on that platform's own privacy policy applies to what it collects.

Where in the world it sits

Our database, file storage, and hosting are in the United States, and so is the AI provider. If you use the app from outside the United States your information is transferred there. Where the law requires a transfer mechanism, we rely on the standard contractual clauses in our agreements with those providers.

What the store labels say

The App Store privacy card and the Google Play data safety section describe the same collection this page does. If you ever find a difference between them, this page is the one we stand behind, and telling us is a bug report worth sending.

Changes to this policy

This version is dated 2026-09-29. If what we collect or who receives it changes, we change the date, and every beta tester is shown the changed screens and asked again before carrying on. We will not treat an old agreement as agreement to something new.

Reaching us

CRM Elite Cohort, Webster Groves, Missouri, United States. Questions, requests, and anything you want on the record: admin@alyeska.app. A person reads it.