Privacy policy

The short version

Hatchlore is a travel-preparation app. You can use it without an account. If you sign in with Google, we store the account details below and the items you choose to sync. We do not sell personal information. The app does not show ads, does not run analytics, and does not send your saved trips to an AI service.

Google sign-in

Sign-in is optional. The button is Google’s own sign-in button, loaded from accounts.google.com. Google returns an ID token. From that token Hatchlore keeps:

• your Google account id (the sub claim),
• your email address, and whether Google says that email is verified,
• your name, if Google sends one,
• a profile-picture link, and only if it is an https address on googleusercontent.com.

We do not receive your Google password. We do not ask Google for your contacts, mail, files, or calendar. The server checks the token against Google’s public signing keys at www.googleapis.com. If Google sends a profile picture, the browser may later request that image from Google.

What is stored in our database

Signed-in data is kept in Cloudflare D1, in a database used only for this app. The tables hold:

• the Google account id, email, name, profile-picture link, and the time the account was created,
• a hash of each sign-in session, not the session value itself, plus when it was created and when it expires,
• the four synced items: watchlist, trips, checklists, and settings. Trips can include the names, dates, budget lines, itinerary notes, and transport segments you type. Settings can include theme, map or list view, the day/night map choice, display currency, and pet-travel notes. Checklists are the boxes you tick for a destination,
• rate-limit counters. Those rows are keyed by a hash of a server salt plus the IP address, not by the IP address itself. Rows older than a day are deleted.

Each synced item is limited to 128 KB. All of them together are limited to 256 KB per account. The app refuses a save that would pass those limits. It does not upload photos you take. It does not store card numbers, passport numbers, or booking passwords.

Session cookies

After sign-in the browser stores two cookies, __Host-tp_sess and, briefly, __Host-tp_nonce. They are host-only: no Domain attribute, Secure, HttpOnly, SameSite=Strict, and Path=/. They are sent only to the Hatchlore host you signed in on. A session on travelprep.pages.dev is not a session on hatchlore.com. The session cookie lets the server recognize you. It lasts up to 30 days from last use, and no more than 180 days from when that sign-in started. The nonce cookie lasts about 10 minutes and is used so a Google token cannot be replayed. Signing out clears the session. “Sign out everywhere” ends every session for that account.

On this device

Without an account, the watchlist, trips, checklists, and settings stay in this browser’s local storage. We do not receive them. With an account, this device remains the working copy and is synced to D1. The service worker also caches the app shell, advisory responses, weather, photos you open, and similar public files so pages can open offline. It does not cache /api/auth, /api/me, or /api/data. Those responses are sent with Cache-Control: no-store.

Information the app requests

These requests are made so the app can show travel information. They are not used to build an advertising profile.

• U.S. Department of State travel advisories and country information, through Hatchlore’s own /api proxy (and, if that fails, a fallback proxy on workers.dev). The public feed is cadataapi.state.gov.
• U.S. CDC travel health notices, from the CDC RSS feed, converted to JSON by that same proxy.
• Open-Meteo for the weather forecast and, when a place is not already in the bundled list, a geocoding lookup. Historical climate charts use averages that were stored in the app from Open-Meteo’s historical API (ERA5).
• Nager.Date (date.nager.at) for public-holiday lists.
• Frankfurter (api.frankfurter.dev) for European Central Bank reference exchange rates.
• Wikimedia Commons (upload.wikimedia.org) for photographs shown on country and place pages. Author and license are shown with the photo.

The world map, country facts, Wikipedia summaries, UNESCO site list, and flag images are files shipped with the app. Opening a map, Wikipedia, Wikivoyage, UNESCO, or Booking.com link leaves Hatchlore and is covered by that site’s own policy. Hatchlore does not load map tiles from a tile server.

Selling, ads, analytics, and AI

We do not sell or rent personal information. The app does not include an advertising or analytics script. It does not send your trips or notes to an AI model.

How long we keep it, and how to delete it

Account data stays until you delete the account or delete a synced item. Rate-limit rows older than a day are removed. Session rows are removed when they expire or when you sign out.

While signed in, open Profile, choose Delete my account, type DELETE, and confirm. That deletes the account, its sessions, and the synced items from our database. Copies still in this browser stay until you clear the site’s data. Signing out does not delete the account. You can also remove Hatchlore in your Google account.

Children

Hatchlore is not directed at children under 13, and we do not knowingly collect their information.

Changes

If this policy changes, this page and the effective date will be updated.

Contact

Questions about this policy or your information: [email protected].