Privacy Policy

Account information. When you sign up we collect your email address and a password (stored hashed by our authentication provider). If you sign in with Google, we receive your name, email, and profile picture from Google — nothing else.

Content you create. The trips, itineraries, saved places, and notes or screenshots you import so we can build and keep your plans. Imported photos you upload are stored privately and are visible only to you.

Technical information. A secure session cookie to keep you signed in, and limited request data (such as IP address) used to keep the service secure, enforce rate limits, and prevent abuse.

To create and save your itineraries, personalize recommendations to your stated tastes, operate and secure the service, and communicate with you about your account (for example, confirmation and security emails). We rely on your consent and on our legitimate interest in providing and protecting the service.

To turn your free-text trip descriptions, questions, and imported notes/screenshots into itineraries, the relevant text and images are sent to a third-party AI provider (DeepSeek (and, for image imports, an OpenAI-compatible vision provider)) for processing and returned to you. We send only what is needed for the feature you invoked. Do not include sensitive personal information in these inputs.

We share personal data only with service providers who process it on our behalf:

Supabase — hosting, database, file storage, and authentication. Cloudflare — bot protection (the sign-in captcha). The AI provider above — itinerary generation. We may also disclose information if required by law. We do not sell your personal data or share it for advertising.

We use only essential cookies — chiefly the session cookie that keeps you signed in. We do not use advertising or cross-site tracking cookies.

We keep your account and content until you delete them or ask us to. You can access, correct, export, or delete your data — including deleting your account — by contacting us at [contact@your-domain.com]. Depending on where you live, you may have additional rights under laws such as the GDPR or CCPA; we honor those requests.

Data is protected in transit (HTTPS) and access is restricted per-user by row-level security so one account can never read another’s data. No system is perfectly secure, but we work to protect your information and to fix issues promptly.

Our providers may process and store data on servers located outside your country. Where required, we rely on appropriate safeguards for such transfers.

Silk & Soul is not directed to children under 16, and we do not knowingly collect their data. If you believe a child has provided us information, contact us and we will delete it.

We may update this policy as the service evolves. We will revise the “last updated” date above and, for material changes, provide a more prominent notice.

Questions or requests? Email [contact@your-domain.com].