Privacy Policy

Last Updated: 20 May 2026GDPR Compliant

We are committed to protecting your privacy. This policy explains what data we collect, why we collect it, how long we keep it, and your rights under GDPR.

Introduction

Welcome to Interrail Planner. We operate at https://interrail-planner-yeof.vercel.app. This Privacy Policy explains how we collect, use, disclose, and protect your personal data. We are committed to full transparency under the General Data Protection Regulation (GDPR) (EU) 2016/679.

Interrail Planner is an independent tool and is not affiliated with Interrail, Eurail Group, or any European Union entity.

Data Controller

For GDPR purposes, Interrail Planner is the Data Controller of your personal data. We are based in the Netherlands, subject to Dutch and European data protection laws.

hectoragofi@gmail.com →

Personal Data We Collect

Account Information: When you sign in via Google OAuth, we receive your name and email address to create and manage your user profile.

Route Planning Data: Destinations, travel dates, preferred routes, notes, and budget data you enter. This is core to the app's functionality.

Usage Data: IP address, browser type, operating system, and diagnostic data collected automatically when you use the service.

Session Cookies: Essential session cookies required for login and authentication. We do not use advertising or tracking cookies.

Communications: If you contact us by email, we collect the content of your message and contact details.

Legal Basis for Processing

Contract Performance: We process your account and trip data to provide the services you request.

Legitimate Interests: We process usage data to improve functionality, detect fraud, and ensure security.

Consent: When you sign in with Google, you consent to our processing of the profile data Google shares with us.

Legal Obligation: We may process data when required by applicable law.

How We Use Your Data

—Provide, operate, and maintain the service
—Manage your account and saved plans
—Enable real-time collaboration with invited users
—Improve and personalise the service
—Respond to your enquiries and support requests
—Detect and prevent fraud and security issues
—Comply with legal obligations

Data Sharing

We do not sell your personal data. We may share it only in limited circumstances:

Service Providers: Supabase (database and hosting), Vercel (infrastructure). These providers are bound by data processing agreements.

Collaborators: Trip data shared only with collaborators you explicitly invite.

Legal Requirements: When required by law or valid public authority requests.

Business Transfers: In the event of a merger or acquisition, with prior notice to you.

International Transfers

Some service providers may operate outside the EEA. Where we transfer personal data outside the EEA, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) approved by the European Commission.

Data Retention

We retain your personal data only as long as necessary to fulfil the purposes described in this policy, or as required by law. Account and trip data is kept for as long as your account is active. You may request deletion at any time through Settings → Delete Account.

Your GDPR Rights

Right to Access: Request copies of your personal data.

Right to Rectification: Request correction of inaccurate or incomplete data.

Right to Erasure: Request deletion of your personal data. Available directly in Settings → Delete Account.

Right to Restrict Processing: Request restriction of processing.

Right to Object: Object to processing based on legitimate interests.

Right to Data Portability: Request transfer of your data. Available directly in Settings → Export My Data.

Right to Withdraw Consent: Withdraw consent at any time without affecting prior lawful processing.

To exercise these rights, email hectoragofi@gmail.com. We will respond within one month.

You also have the right to lodge a complaint with the Autoriteit Persoonsgegevens (Dutch Data Protection Authority) at autoriteitpersoonsgegevens.nl.

autoriteitpersoonsgegevens.nl →

Cookies

We use essential cookies strictly necessary for the operation of the service, including user login and session management via Supabase. We do not use advertising or tracking cookies.

You can instruct your browser to refuse cookies, but this will prevent you from logging in. You may accept or decline cookies via the consent banner shown on your first visit.

Security

We implement appropriate technical and organisational measures to protect your data, including encrypted database storage and secure OAuth authentication flows. No method of internet transmission is 100% secure and we cannot guarantee absolute security.

Children's Privacy

The service is not intended for anyone under 16. We do not knowingly collect data from children. If you believe a child has provided us data, contact us immediately.

Changes to This Policy

We may update this policy from time to time. Changes are effective when posted on this page with an updated "Last Updated" date. Continued use of the service after changes indicates acceptance.

Interrail Planner — Independent travel planning tool