Privacy.

We store a session cookie to remember your language choice and to log anonymous walk events (city, vibe, distance, success or error). No IP address, no identifier across sessions, and any coordinate in those events is rounded to about 10 km. Building a route is the exception: the starting point you type or hand over is sent precisely to our geocoding and routing providers, and a walk you save keeps its own starting point until you delete it. This helps us spot bugs, plan capacity, and see which vibes work in which cities.

If you accept all, we also link those events to your account when you're logged in. That powers your personal stats (cities explored, total km walked) and lets us improve the AI recommendations for you specifically.

Sharing is something you choose to do. When you create a share link we copy that walk — its stops, their descriptions, the city and the vibe — into a separate table called shared_walks, and publish that copy at a public URL. Anyone with the link can open it and search engines are allowed to index it, so treat a link as permanent once you post it. Your starting point, your session, your account and the walk's original Google Maps link are never copied there. You can stop sharing from the walk's page at any time: the link stops working immediately, though a search engine may take a while to drop its copy. If someone opens your link and asks for a route from where they are, their position is sent to OpenRouteService for that one route and is not stored by us.

You can export everything we know about you as a JSON file, or delete your account permanently, anytime in Settings. We respond within 30 days to any request sent to privacy@vibepath.app.

User data is stored in Supabase (Frankfurt, EU). Cache lives in Upstash. AI requests go to Google Gemini and POIs to OpenStreetMap. Geocoding uses Nominatim, routing uses OpenRouteService.