Privacy

Pitstop is a small trip-planning app run by one person on one computer, for a group of friends. It is not a company and there is no business model, so this page can be short and specific instead of long and defensive.

What is stored

• Your account: the username and display name you chose, your password stored only as a bcrypt hash (the real password is never written down anywhere and cannot be read back), and optionally a bio, an avatar emoji or a photo you upload.
• Your trips: everything you put into them: titles, dates, stops, notes, packing lists, budget lines, RSVPs, group chat messages, post-trip reviews, and any photos or files you upload.
• Your connections: who your friends are and which trips you are on.
• A sign-in cookie so the site remembers you between visits, plus a matching session file on the computer running Pitstop.
• Safety records: if you report something, the report (what it was, a copy of it at that moment, your reason, and that it came from you) so it can be reviewed. Your block list, if you block anyone. The date you agreed to the terms, and that you confirmed you're 13 or older.
• If you connect Google or Apple sign-in: the account identifier that provider gives us, and the email address on it. That email is used to tell the accounts apart. Nothing is ever sent to you.

What is not stored

• No analytics, no page-view tracking, no cookies except the sign-in one.
• No advertising, no ad networks, no data sold or shared with anyone.
• No location tracking. Pitstop never asks your device where you are.
• No email address, unless you connect Google or Apple sign-in yourself.

The assistant

The trip assistant is an AI model running on the same computer that serves the site. What you type to it is processed there and is not sent to OpenAI, Anthropic, Google, or anyone else. It is also slow, which is the honest trade for that. Your conversation is not saved once you close the panel.

The phone apps

The Pitstop apps for iPhone and Android show this same website; they aren't a separate service and hold no extra data. They add phone features the website can't reach on its own: proper vibration, the system share sheet, saving files to your phone, and choosing photos to upload. The apps contain no analytics or advertising code, and they ask for no permissions beyond the internet connection. The camera and photo library are used only when you choose a photo to upload, and iOS asks you first.

Who can see your things

• A trip is private to its crew. Other people with Pitstop accounts cannot see it, and it is not listed anywhere they can reach.
• Someone holding a trip's invite link can view and join that trip. Treat that link like a key.
• Your friends can see your reviews of trips you share, and your pets.
• Reports are seen only by the person who runs Pitstop. Whoever you report isn't told it was you, and isn't told they've been blocked.
• The person who runs Pitstop is an administrator and can technically reach the underlying data file, in the same way anyone hosting anything can. They do not read your messages.

Other companies

Two, and only these two:

• Cloudflare carries traffic between your browser and the computer running Pitstop, so the home address of that computer is not exposed. They see the encrypted connection and the usual connection details any network carrier sees.
• Google or Apple, only if you choose to use their sign-in button.

Fonts, scripts and images are all served by Pitstop itself, so opening a page doesn't contact anyone else. (A trip whose cover photo is a link to another website will load that one picture from that website.)

Backups

The database is copied automatically so a mistake or a broken update cannot wipe everyone's trips. Copies are kept for up to about a month and then deleted. This means that for a short period after you delete something it still exists in a backup file, which is the ordinary trade any backup makes.

Getting a copy

Download my data on your account page gives you a file with everything Pitstop holds about your account: your profile, the trips you're on, what you wrote in them, your friends and blocks, and the reports you've made. Other people's messages aren't included, since those are theirs.

Deleting your account

There is a Delete account button on your account page. It removes your login and takes you off every trip immediately, and deletes your reviews and RSVPs. Messages and suggestions you posted in a group's trip stay for the group, but no longer carry your name. Trips you created and shared with others stay, since they belong to the group too. Backups age out as described above. Reports you made stay in the moderation record but no longer say who made them. The most recent 2,000 reports are kept so repeat problems can be spotted.

Children

Pitstop is not aimed at children and there is nothing here for them. It is invite-only in any case.

Changes

If this page changes in a way that matters, the date at the top changes with it.

If something goes wrong

If there is ever a security breach that could put anyone at real risk, the people affected will be told as soon as possible, along with what happened and what they can do, and it will be reported to the Office of the Privacy Commissioner of Canada as Canadian law requires. A record is kept of every breach, however small.

Asking about any of this

The person who runs Pitstop is responsible for your information here. Email [email protected]. If you want everything held about you sent over, corrected, or deleted by hand, just ask; you'll get an answer within 30 days, and usually much sooner.

If you're not happy with the answer, you can complain to the Office of the Privacy Commissioner of Canada.