Privacy

Effective 21 September 2026

The short version: Deodapper never sees your card and never stores your name. The only account is an optional sign-in by email, and even then we keep a one-way hash of the address rather than the address itself, plus the routes you choose to keep in it. It keeps rough usage statistics for 90 days and a reference number for each payment. Your location while driving stays on your phone.

What we keep

Usage statistics. For each page view and action: the time, your IP address, the approximate city derived from it, your device type and browser family, and what you did (planned, prepared, published, searched). Nothing you type into forms. Kept for 90 days, then deleted.
Payment references. When you pay for a route: a Stripe payment id, the price tier, the amount, its status (held, charged, released), timestamps, the start and end area of the route (rounded to about a kilometre), the IP address that paid, and a random id your browser generated. This lets us honour your purchase. It is kept for 30 days after the credit expires, and longer only in Stripe's own records.
Your route while it's being made. The start, end, times and interests you enter are processed on our server to plan and narrate the route, then returned to your phone. We don't store your route on the server unless you publish it.
Your account, if you sign in. Signing in is optional and works by email link, no password. We store a one-way hash of your email address (enough to recognise the address when you type it again, not enough to read it back), sign-in links for 20 minutes, sessions for up to 180 days with the random device id, and the routes you keep in the account: start, end, stops, times, narration, and whether the route was paid for. Deleting a route removes it from the server within 30 days. Email support to delete the account itself.
Published routes. If you choose to publish, the route (title, description, stops, narration, start and end places) is stored and shown to other users. Don't include personal details; we screen for street addresses.
Your Claude and payment usage in aggregate, for our own costs and accounting, without anything that identifies you.

What we don't keep

Card numbers, expiry dates or security codes. They go from your browser straight to Stripe.
Names or phone numbers. Email addresses are not stored either: sign-in keeps only the one-way hash described above. The optional receipt email on the payment form goes to Stripe; we pass it straight through, and use it once to send you a sign-in link so your paid route stays yours, without keeping the address.
Your GPS position while driving. Drive mode runs on your phone and works offline; your location is never sent to us.
Cookies. We use your browser's local storage for settings, your saved routes, your route credit, your sign-in session and the random device id, and nothing follows you across sites.

Services we rely on

Building a route involves other companies, each seeing only what it needs:

Stripe processes payments and holds whatever you enter on the payment form. See Stripe's privacy policy.
Anthropic (Claude) receives your start, end, times and interests, and the names and Wikipedia summaries of candidate stops, to propose stops and write narration. For stops with little written about them it may also run a web search for the place's name. It receives no payment or contact details.
The places' own websites are fetched by our server (not your browser) to gather facts for narration; those sites see our server, not you.
Wikipedia / Wikimedia and OpenStreetMap's Nominatim are queried by our server for place information. Photon (komoot) and OpenStreetMap map tiles are fetched by your browser directly for the search box and the map, so those services see your IP address.
Valhalla (FOSSGIS) and OSRM compute the driving route from the coordinates involved.
ipwho.is turns IP addresses into an approximate city for our statistics.
Google Places, when the operator has enabled it, is asked about a place name and a route area only after Wikipedia and OpenStreetMap have nothing; it learns the search text, not who you are.
Open-Meteo supplies the weather shown at each stop in drive mode; your browser asks it directly for the stops' coordinates, so it sees your IP address but not who you are.
Resend delivers the sign-in emails, so it sees the address an email is sent to. See Resend's privacy policy.
Render hosts the server and Cloudflare serves the domain. Data is stored in the United States.

Your choices

Email support@deodapper.com to ask what we hold about an IP address or a payment, or to have it deleted; give us the approximate date and, for payments, the last four digits of the card so we can find it in Stripe. Unpublishing a route you published is also a matter of asking. Deodapper is not directed at children under 13.

Changes

If this page changes, the date at the top changes with it. Our terms and refunds page covers the paid features.