Privacy

Last updated 20 October 2026

The short version: you are not the product. I don't sell your data. I don't advertise to you. Nobody pays me to put anything in front of you, and nothing you tell Penny is used to train anything or build a profile of you. Feral Travels collects what it needs to plan your trip and not much else, and you can delete every bit of it yourself, from Settings, in about ten seconds.

That's the deal. The rest of this page is the detail — partly because the law asks for it, mostly so you can check I'm telling the truth.

Feral Travels is run by one person: me, Samuel Shirley, in Spain. That makes me the data controller for everything below. If any of it bothers you, email sam@feraltravels.com — a human reads it. This covers feraltravels.com and the iOS app; they're one service, one account, one database.

What I hold

Your email address. That's your account. There's no password — you sign in with a code I email you, or with Google or Apple.
Your name and profile picture, if you signed in with Google or Apple and they handed them over. The picture itself stays on Google's servers; I only keep the web address of it, and your phone or browser fetches the image from Google when it shows your account icon. Apple never provides a picture, so Apple accounts get a plain grey person icon.
Your trips. Everything you put in: where you're going, when, the stops, the routes, notes and costs. This is the product.
Your vehicle. Its name, fuel type, and how far it goes on a tank. That last number is what the whole fuel-stop plan is built on.
Where you are — two different things, and they're worth keeping apart:
- Your phone's position, if you allow it, while a trip is open on screen. It's what makes "plan from where I am" work without you typing coordinates. I keep the most recent one and overwrite it with the next. There is no history of where you've been, and nothing is collected when the app is closed or in the background.
- The places in your plan — the coordinates of every start point, destination and stop, and the dates you expect to be there. That's kept for as long as the trip is, because it is the trip.
What you say to Penny, and what she says back, including any photos you attach.
Your plan, if you subscribe: which one, when it renews or ends, and Apple's transaction numbers for it. Never your card — Apple takes the payment and I don't see how you paid.
The plumbing: sign-in sessions, the one-time codes, which screens were open and for how long, and errors. This is how I keep the thing working and stop the AI bill getting away from me.

Why

Because you asked me to plan a trip and I can't do it without these things. That's the legal basis for nearly all of it: performing the contract you entered into when you signed up.

The error and usage records are the exception — I keep those on the basis of a legitimate interest in the app not being broken and not bankrupting me. If you want to object to that specifically, you can, and you should say so.

Sign-in codes go out because you asked for one. No advertising, no profiling, nothing sold or rented. Not now — and if that ever changes, it will not change quietly.

Who else sees it

Only the companies needed to run this, each for the job named here:

Anthropic (Claude) — the AI that runs Penny. To write her replies it gets your messages, the photos you attach, and the trip context she needs to answer: your itinerary, your vehicle, and your phone's current position when you've shared it. It also reads your answers to the trip set-up questions when they're typed in your own words, like a start date or how far your vehicle goes. It does not get your email address or your name. The app asks your permission before anything is sent to Anthropic, and nothing goes until you say yes.
Apple — takes the payment when you subscribe, through the App Store, and handles renewals, cancellations and refunds. Sign in with Apple, if you use it: Apple gives me your email address, or a private relay address if you chose one, and your name if you let it. When you delete your account I tell Apple to revoke that sign-in. In the iOS app, Apple also draws the map and turns your phone's position into a place name.
RevenueCat — keeps track of App Store subscriptions for me. It gets your account's ID, a random number rather than your email or name, and your purchase events from Apple: which plan, the price, the dates, and Apple's transaction numbers. It tells my server when you subscribe, renew, cancel or get a refund.
Google — routes, road distances, and place and fuel-station searches, done from my server. Those get the coordinates and place names in your plan, including your phone's position when a route starts from where you are, and nothing that identifies you. On the website, Google also draws the map and turns your position into a place name. Google sign-in, if you use it: Google gives me your email address, your name and the web address of your profile picture.
OpenStreetMap (Nominatim) — turns a coordinate back into a town name when a long driving day is split. Coordinates only.
Resend — sends email. It gets your address to send your sign-in codes. It also carries anything you send from the support form to me, with your name and email address so I can reply, and a note to me if an account's AI costs pass a limit, which names that account's email address.
Neon — hosts the database all of this sits in.
Vercel — hosts the website and the server the app talks to, so every request passes through it. On the website it also counts visits, without cookies.
Expo — builds the iOS app and delivers its updates. It sees which version of the app your phone is running, not who you are.

Some of them process data outside the European Economic Area. Where that happens, the transfer relies on that provider's standard contractual clauses or an equivalent safeguard.

How long I keep it

Your account and trips: until you delete them.
Sign-in codes: ten minutes, or the second you use one.
Sign-in sessions: 30 days, or until you sign out.
Your plan: until you delete your account. The purchase notices behind it are kept after that — see below.
Errors, usage records, and the log of each request to Penny: right now, indefinitely. There is no automatic clear-out yet, and I'd rather say so than claim one exists. They go when your account goes.

Deleting everything

Settings → Delete account, on the web or in the app. Type the words and it's gone: immediately, no waiting period, no undo. Trips and their locations, routes, stops, fuel plans, vehicles, tasks, conversations with Penny, the address of your picture, and your sign-in details all go at once. You don't have to email anyone, explain yourself, or click through a screen trying to talk you out of it.

Deleting your account does not cancel an App Store subscription. Apple bills it, so cancel it in your Apple Account settings as well.

Three things outlive the deletion, and I'd rather tell you than have you find out:

A record that the account existed. It holds when the account was created and deleted, whether you signed in by emailed code, Google or Apple, and how many trips, vehicles and Penny messages you had. It also holds your email address twice over: once as a one-way fingerprint that can't be turned back into an address, and once encrypted — and I can decrypt that second one from the admin page. It's there so a deletion can be evidenced if you ever ask me to prove it, and so I can see how many people leave. If you'd rather that record didn't exist either, email me and I'll remove it.
Cost and usage rows, unlinked from you, so I can still see what the service costs to run. Any text in them that could carry something you wrote or somewhere you drove is erased at the same time.
Purchase notices, if you ever subscribed: the messages Apple and RevenueCat sent about your plan — which plan, the price, the dates and the transaction numbers. They carry your old account's ID number but not your email address or name, and they're kept so a payment can still be traced if there's ever a question about it.

What else you can ask for

Under the GDPR you can ask for a copy of everything I hold about you, have something wrong corrected, take it elsewhere in a portable file, or object to the legitimate-interest parts. Email sam@feraltravels.com and you'll have an answer within 30 days.

If I handle that badly, you can complain to the Spanish data protection authority, the Agencia Española de Protección de Datos, or to the equivalent authority where you live. That's your right, and I'd rather you used it than stayed annoyed.

Under 16

Feral Travels isn't built for you, and accounts aren't knowingly created for under-16s.

If this changes

The date at the top changes. Anything that actually affects you, you'll be told in the app before it takes effect — not buried in a commit.