Privacy

Last updated 20 August 2026

The short version: you are not the product. I don't sell your data. I don't advertise to you. Nobody pays me to put anything in front of you, and nothing you tell Penny is used to train anything or build a profile of you. Feral Travels collects what it needs to plan your trip and not much else, and you can delete every bit of it yourself, from Settings, in about ten seconds.

That's the deal. The rest of this page is the detail — partly because the law asks for it, mostly so you can check I'm telling the truth.

Feral Travels is run by one person: me, Samuel Shirley, in Spain. That makes me the data controller for everything below. If any of it bothers you, email samuelashirley@gmail.com — a human reads it. This covers feraltravels.com and the iOS app; they're one service, one account, one database.

What I hold

Your email address. That's your account. There's no password — you sign in with a code I email you, or with Google or Apple.
Your name and profile picture, if you signed in with Google or Apple and they handed them over. The picture itself stays on Google's servers; I only keep the web address of it, and your phone or browser fetches the image from Google when it shows your account icon. Apple never provides a picture, so Apple accounts get a plain grey person icon.
Your trips. Everything you put in: where you're going, when, the stops, the routes, notes, costs, and any GPX files you upload. This is the product.
Your vehicle. Its name, fuel type, and how far it goes on a tank. That last number is what the whole fuel-stop plan is built on.
Where you are — two different things, and they're worth keeping apart:
- Your phone's position, if you allow it, while a trip is open on screen. It's what makes "plan from where I am" work without you typing coordinates. I keep the most recent one and overwrite it with the next. There is no history of where you've been, and nothing is collected when the app is closed or in the background.
- The places in your plan — the coordinates of every start point, destination and stop, and the dates you expect to be there. That's kept for as long as the trip is, because it is the trip.
What you say to Penny, and what she says back, including any photos you attach.
The plumbing: sign-in sessions, the one-time codes, which screens were open and for how long, and errors. This is how I keep the thing working and stop the AI bill getting away from me.

Why

Because you asked me to plan a trip and I can't do it without these things. That's the legal basis for nearly all of it: performing the contract you entered into when you signed up.

The error and usage records are the exception — I keep those on the basis of a legitimate interest in the app not being broken and not bankrupting me. If you want to object to that specifically, you can, and you should say so.

Sign-in codes go out because you asked for one. No advertising, no profiling, nothing sold or rented. Not now — and if that ever changes, it will not change quietly.

Who else sees it

Only the companies needed to run this, each doing exactly one job:

Anthropic — runs Penny. Gets your messages and the trip context she needs to answer, which includes your itinerary and your current position when it's available.
Google — maps, directions and place lookups, which means the coordinates and place names in your plan, and your phone's position when it's turned into a place name. Google sign-in if you use it, and your profile picture if you have one.
Apple — Sign in with Apple, if you use it.
Resend — sends the sign-in emails.
Neon — hosts the database all of this sits in.
Vercel — hosts the website, and counts visits without cookies.
Google Maps — maps, road routing, and the fuel stations along your route. These get coordinates and nothing that identifies you.
OpenStreetMap (Nominatim) — turns a coordinate back into a place name when a driving day is split. Coordinates only.
Expo — builds and delivers updates to the iOS app.

Some of them process data outside the European Economic Area. Where that happens, the transfer relies on that provider's standard contractual clauses or an equivalent safeguard.

How long I keep it

Your account and trips: until you delete them.
Sign-in codes: ten minutes, or the second you use one.
Sign-in sessions: 30 days, or until you sign out.
Errors, usage records, and the log of each request to Penny: right now, indefinitely. There is no automatic clear-out yet, and I'd rather say so than claim one exists. They go when your account goes.

Deleting everything

Settings → Delete account, on the web or in the app. Type the words and it's gone: immediately, no waiting period, no undo. Trips and their locations, routes, stops, fuel plans, vehicles, tasks, conversations with Penny, the address of your picture, and your sign-in details all go at once. You don't have to email anyone, explain yourself, or click through a screen trying to talk you out of it.

Two things outlive the deletion, and I'd rather tell you than have you find out:

A record that the account existed. It holds when the account was created and deleted, whether you signed in by emailed code, Google or Apple, and how many trips, vehicles and Penny messages you had. It also holds your email address twice over: once as a one-way fingerprint that can't be turned back into an address, and once encrypted — and I can decrypt that second one from the admin page. It's there so a deletion can be evidenced if you ever ask me to prove it, and so I can see how many people leave. If you'd rather that record didn't exist either, email me and I'll remove it.
Cost and usage rows, unlinked from you, so I can still see what the service costs to run. Any text in them that could carry something you wrote or somewhere you drove is erased at the same time.

What else you can ask for

Under the GDPR you can ask for a copy of everything I hold about you, have something wrong corrected, take it elsewhere in a portable file, or object to the legitimate-interest parts. Email samuelashirley@gmail.com and you'll have an answer within 30 days.

If I handle that badly, you can complain to the Spanish data protection authority, the Agencia Española de Protección de Datos, or to the equivalent authority where you live. That's your right, and I'd rather you used it than stayed annoyed.

Under 16

Feral Travels isn't built for you, and accounts aren't knowingly created for under-16s.

If this changes

The date at the top changes. Anything that actually affects you, you'll be told in the app before it takes effect — not buried in a commit.