Privacy · Updated September 27, 2026

Privacy policy

Anomal Labs LLC operates the ItinerarMe website and mobile trip planner. Contact us at team@itinerarme.com. We collect the information needed to run your account and the planning features you choose; external travel merchants handle their own bookings and payment information.

Information we handle

Account data includes your email address, account identifier, sign-in and consent records. Trip data can include departure and destination, dates, traveler counts and child ages supplied by an adult, preferences, budget, accommodation options, itinerary items, edits, notes, self-reported booking marks and costs you enter. We also process support messages, subscription entitlement and transaction identifiers (not your card number), request/security logs and optional approximate location if you grant permission for a nearby-airport suggestion. Avoid placing passports, payment cards, medical details or reservation references in free-text notes.

How and why we use it

We use account and trip data to provide your requested planning, save and restore trips, authenticate you, honor subscription allowances, answer support requests, protect the service and comply with legal duties. Where applicable under European privacy law, those uses rely on performance of the service contract, our legitimate interests in security and support, or a legal obligation. Optional device location requires your permission. Personalized AI planning is optional: turn it off before creating a trip if you do not want planning details sent for that purpose.

AI, places and travel partners

When personalization is on, our server sends OpenRouter and its selected model your trip destination, origin airport, dates, party counts and child ages, flight and stay needs, budget and selected preferences, plus fixed itinerary dates and times. We do not include your account email, traveler names, payment details, booking references or private notes in that planning request. The model may generate incomplete or inaccurate suggestions. Place discovery may use Foursquare or public sources. On a deliberate partner handoff, the partner and merchant may receive the relevant route or destination, dates, party details and search preferences; their own privacy and cookie policies then apply. Images may load from external photo sources when displayed. We do not send child ages or personal identifiers in affiliate tracking sub-IDs.

Service providers and international processing

Cloudflare hosts the website; Supabase provides account and saved-trip services; OpenRouter and selected model providers support optional planning; RevenueCat and the applicable app store may handle digital subscription status. Search, map, photo and approved travel partners receive the information needed for the feature you use. These providers may process information outside your country, including in the United States. We review applicable contractual and transfer safeguards as part of release readiness. A merchant's booking and payment records are controlled by that merchant.

Storage, retention and protection

Guest drafts may remain in browser or device storage until cleared there. Web sign-in state is scoped to the browser tab; mobile credentials use device secure storage. Account and saved-trip records remain while your account is active or until removed through a verified request, subject to necessary security, dispute, backup and legal retention. Security logs and provider records may follow separate limited retention. We use access controls and encrypted transport, but no online service can guarantee absolute security. See Cookies and device storage and Security.

Your choices and rights

You may edit trips, disable optional AI planning, decline location permission, clear local data in Account, and request access, correction, a portable copy or deletion of account data. Depending on where you live, you may also object to or restrict processing and complain to your local data-protection authority. California residents may ask about applicable access, deletion, correction and opt-out rights; we do not intentionally sell personal information or use cross-context behavioral advertising in the current service. We do not discriminate for exercising applicable privacy rights. Contact team@itinerarme.com; we will verify account control before releasing or deleting data. See account-deletion instructions. Account deletion does not cancel an external travel booking.

Children and changes

Accounts are for adults. An adult may enter a child's age to plan age-appropriate travel; children should not create accounts or submit personal details. We will update the date on this page when practices change materially and request fresh consent where required.