Privacy Policy

Who we are

kfrax holidays is a travel planning service operated by kfrax (kfrax.com). The service is accessible at hc.kfrax.com. For questions about this policy, contact us at hello@kfrax.com.

What data we collect

• Account data: email address, optional display name, hashed password.
• Trip data: destinations, dates, itineraries, budget entries, flight details, journal entries, packing lists, and check-in notes you create.
• Photos: images you upload, including any location metadata (GPS coordinates) embedded in the photo file.
• Usage data: we do not run analytics or track page views. We collect no behavioral data beyond what you explicitly enter.
• Session data: a session cookie is set when you log in to keep you authenticated. No tracking cookies.

How we use your data

• To provide and operate the service — showing you your trips, splits, photos, and stats.
• To enable shared trips — members you invite can see trip data you share with them.
• To power AI features — trip descriptions and itinerary requests are sent to Anthropic's API to generate suggestions. No personally identifying information is included beyond what you type.

Third-party services

• Anthropic — AI suggestions (itinerary, POIs). Data sent: trip destination and your free-text input. Privacy policy
• AviationStack — flight data lookup by flight number. Data sent: flight number only.
• Google Places — hotel and point-of-interest search. Data sent: your search query.
• Open-Meteo — weather forecasts. Data sent: destination coordinates.
• Unsplash — cover images for trips and onboarding. No personal data is sent.

We do not sell your data to any third party.

Data storage

All data is stored on our own server infrastructure hosted in the EU. Photos are stored on the same server. We do not use third-party cloud storage for your personal content.

Cookies

We use one session cookie (next-auth.session-token) strictly for keeping you logged in. No advertising, tracking, or analytics cookies are set. Because this cookie is strictly necessary for the service to function, no consent is required under GDPR recital 47.

Your rights (GDPR)

If you are located in the EU or EEA, you have the following rights:

• Access: request a copy of the personal data we hold about you.
• Rectification: correct inaccurate data in your account settings.
• Erasure: delete your account and all associated data via Settings → Delete account.
• Portability: request an export of your data in a structured format.
• Restriction / Objection: contact us to restrict processing or object to specific uses.

To exercise any of these rights, email hello@kfrax.com.

Data retention

Your data is retained for as long as your account is active. When you delete your account, all your personal data, trips, photos, and associated records are permanently deleted from our systems within 24 hours.

Changes to this policy

We may update this policy occasionally. Material changes will be communicated via the email address on your account. Continued use of the service after changes constitutes acceptance.