Privacy Policy
The short version. We collect what we need to plan and save your trips, and not much else. We do not sell your personal information. We do not run third-party ad trackers. Our product analytics are anonymous by construction: no advertising cookies, no fingerprinting, no IP addresses stored. You can delete your account and everything in it yourself, at any time, from your profile settings.
Who we are
Palcation ("Palcation", "we", "us") operates palcation.com, an AI-assisted travel planning service based in Utah, United States. For anything in this policy, contact [email protected].
What we collect
Account information. When you sign in with Google, Facebook or X, we receive your name, email address and profile picture from that provider. If you create an email account, we store your email and a salted, hashed form of your password (we never store the password itself).
Trips and content you create. Itineraries, budgets, saved plans, trip photos, posts to Discover, messages to other users, and rewards program numbers you choose to save.
Reports. If you report a person, a message or a shared trip, we keep your report, your note and a copy of what you reported, so we can review it and act on it. The person you report is not told who reported them.
Forwarded booking confirmations. If you forward a confirmation email to your trip's address at trips.palcation.com, we process that email to extract the booking's vendor, reference, amount and dates, and store those details with your trip. Only forward emails you want attached to the trip; everyone who is a member of that trip can see the extracted details.
Launch list. If you give us your email on the coming-soon notice, we store it to send you one launch announcement.
Anonymous product analytics. We record events like "a search happened" or "the budget tab was opened" against a random session identifier that resets when you close your browser. We do not store your IP address, user agent, or any advertising identifier with these events.
Cookies and local storage. We use one essential session cookie to keep you signed in, and browser storage for preferences like "has seen the welcome notice". We use no advertising or cross-site tracking cookies, so there is no cookie banner because there is nothing to opt out of.
Content your browser loads from other services. To show airline logos and our fonts, your browser loads images from Brandfetch and fonts from Google Fonts directly. Like any website your browser contacts, those services receive your IP address, your browser type, and the fact that the request came from palcation.com. We send them nothing else about you. When you look at or book tours, Holibob's booking tools also run in your browser and may send Holibob technical and diagnostic information about how they are working.
How we use it
- To plan trips: your destination, dates, party size and what you ask for are sent to our AI provider (Anthropic) to generate itineraries. Pal, our chat assistant, is powered by generative artificial intelligence, and your conversations with Pal are sent to Anthropic to produce its replies.
- To show live prices and options: your route, dates, destination and party size (not your name or contact details) are sent to travel providers: Sabre (flights and rental cars), Nuitée, operator of LiteAPI (hotels), Holibob and Viator (tours and activities), Ticketmaster (events), and Google Places (restaurants and places).
- To book, when you choose to: the traveler details a booking needs (names, contact details, and for flights dates of birth) go to the provider making that booking, either Sabre, Nuitée or Holibob. Card details are entered in the provider's own secure payment form (Nuitée's for hotels; Stripe's, on Holibob's behalf, for tours) and go straight to that provider. Palcation never sees or stores your card number.
- To add useful detail to a trip: locations are sent to Open-Meteo (weather) and OSRM (driving distances), and destination and team names to Wikipedia (photos) and ESPN (game schedules). These receive no information about you.
- To run your account: sign-in through Google, Facebook or X when you choose one; authentication, saved trips, sharing, notifications and the emails you ask for, sent through Resend; and trip confirmation emails you forward, received through Twilio SendGrid.
- To improve the product, using the anonymous analytics described above.
What we share, and with whom
We do not sell your personal information, and we do not share it for cross-context behavioral advertising as those terms are defined in the California Consumer Privacy Act.
We share data only with the service providers that make the product work, and each receives only what its function requires:
- Hosting and database: Cloudflare.
- AI planning and Pal: Anthropic.
- Travel pricing and bookings: Sabre (flights and rental cars), Nuitée / LiteAPI (hotels), Holibob and Viator (tours and activities), Ticketmaster (events).
- Maps, places and trip details: Google (Places and sign-in), Open-Meteo, OSRM, Wikipedia, ESPN.
- Sign-in: Google, Facebook and X, only if you choose to sign in with them.
- Payments: Nuitée (hotels) and Stripe for Holibob (tours), directly from your browser.
- Email: Resend (outgoing) and Twilio SendGrid (incoming trip emails).
- Images and fonts loaded by your browser: Brandfetch (airline logos) and Google Fonts.
Some links on Palcation are affiliate links, for example rental cars through DiscoverCars, tours through Viator or GetYourGuide, and tickets through Ticketmaster, StubHub, Vivid Seats or SeatGeek. When you click one, you leave Palcation and that company's own privacy policy applies. We pass them no personal information; they know only that a visitor arrived from Palcation.
We may disclose information if required by law, or as part of a merger or acquisition, in which case this policy continues to apply to your data until you are told otherwise.
Your rights and choices
You can access and correct your profile in settings, and delete your account and all of its data yourself from Profile, Settings, Delete account. Deletion is immediate and permanent: profile, trips, bookings records, messages, and everything Pal remembers.
Depending on where you live (including California, Colorado, Connecticut, Utah and Virginia, or the EU and UK), you may have legal rights to access, correct, delete or port your personal information, and to not be discriminated against for exercising them. Email [email protected] and we will honor these requests regardless of where you live. We respond within 30 days.
Marketing email from us always includes an unsubscribe link, and unsubscribing never affects your account.
Data retention and security
We keep your data while your account exists and delete it when you delete your account. Reports of abuse, and what was reported, may be kept after an account is deleted where we need them to protect other users. Anonymous analytics are kept in aggregate. Passwords are hashed with PBKDF2-SHA256 and per-user salts; sessions use httpOnly cookies; all traffic is encrypted in transit; data is stored with Cloudflare in the United States. No system is perfectly secure, and we will notify affected users of any breach as required by law.
Children
Palcation is not directed to children under 13, and we do not knowingly collect their information. If you believe a child has created an account, contact us and we will delete it.
Changes
If we change this policy in a way that matters, we will post the new version here with a new effective date, and for significant changes we will tell you in the product or by email. Continued use after the effective date means the new version applies.