The short version. We collect what we need to plan and save your trips, and not much else. We do not sell your personal information. We do not run third-party ad trackers. Our product analytics are anonymous by construction: no advertising cookies, no fingerprinting, no IP addresses stored. You can delete your account and everything in it yourself, at any time, from your profile settings.
Palcation ("Palcation", "we", "us") operates palcation.com, an AI-assisted travel planning service based in Utah, United States. For anything in this policy, contact [email protected].
Account information. When you sign in with Google, Facebook or X, we receive your name, email address and profile picture from that provider. If you create an email account, we store your email and a salted, hashed form of your password (we never store the password itself).
Trips and content you create. Itineraries, budgets, saved plans, trip photos, posts to Discover, messages to other users, and rewards program numbers you choose to save.
Forwarded booking confirmations. If you forward a confirmation email to your trip's address at trips.palcation.com, we process that email to extract the booking's vendor, reference, amount and dates, and store those details with your trip. Only forward emails you want attached to the trip; everyone who is a member of that trip can see the extracted details.
Launch list. If you give us your email on the coming-soon notice, we store it to send you one launch announcement.
Anonymous product analytics. We record events like "a search happened" or "the budget tab was opened" against a random session identifier that resets when you close your browser. We do not store your IP address, user agent, or any advertising identifier with these events.
Cookies and local storage. We use one essential session cookie to keep you signed in, and browser storage for preferences like "has seen the welcome notice". We use no advertising or cross-site tracking cookies, so there is no cookie banner because there is nothing to opt out of.
We do not sell your personal information, and we do not share it for cross-context behavioral advertising as those terms are defined in the California Consumer Privacy Act.
We share data only with the service providers that make the product work: Cloudflare (hosting and database), Anthropic (AI planning), Duffel and Nuitée (live travel pricing and, when enabled, bookings), Twilio SendGrid (inbound trip email), Amazon SES and Resend (outbound email), and Wikipedia (destination imagery). Each receives only what its function requires.
Some links on Palcation are affiliate links (for example rental cars via DiscoverCars and tours via Viator). When you click one, you leave Palcation and that company's own privacy policy applies. We pass them no personal information; they know only that a visitor arrived from Palcation.
We may disclose information if required by law, or as part of a merger or acquisition, in which case this policy continues to apply to your data until you are told otherwise.
You can access and correct your profile in settings, and delete your account and all of its data yourself from Profile, Settings, Delete account. Deletion is immediate and permanent: profile, trips, bookings records, messages, and everything Pal remembers.
Depending on where you live (including California, Colorado, Connecticut, Utah and Virginia, or the EU and UK), you may have legal rights to access, correct, delete or port your personal information, and to not be discriminated against for exercising them. Email [email protected] and we will honor these requests regardless of where you live. We respond within 30 days.
Marketing email from us always includes an unsubscribe link, and unsubscribing never affects your account.
We keep your data while your account exists and delete it when you delete your account. Anonymous analytics are kept in aggregate. Passwords are hashed with PBKDF2-SHA256 and per-user salts; sessions use httpOnly cookies; all traffic is encrypted in transit; data is stored with Cloudflare in the United States. No system is perfectly secure, and we will notify affected users of any breach as required by law.
Palcation is not directed to children under 13, and we do not knowingly collect their information. If you believe a child has created an account, contact us and we will delete it.
If we change this policy in a way that matters, we will post the new version here with a new effective date, and for significant changes we will tell you in the product or by email. Continued use after the effective date means the new version applies.