01This website
This website introduces OffBeatHoliday. It has no sign-in and no forms that send your details to us.
- We do not use cookies, analytics, advertising pixels or cross-site tracking on this website.
- The trip form, season filter and pace picker run in your browser only. They show example routes and send nothing to us.
- One small value is kept in your browser's session storage so the intro animation plays once per visit. It is cleared when you close the tab.
- Fonts, images, video and the optional ambient sound are served from this website itself. The sound loads only if you turn it on.
- Our hosting provider may keep standard server logs, such as IP address, browser type and the page requested, for security and to keep the site running.
When you follow a link to the trip planner or download the app, the rest of this policy applies.
02What the planner and apps collect
| Data | Why |
|---|---|
| Account: email address, name (if you give one), sign-in method (email, Google or Apple) and an account ID | To sign you in and keep your trips in your account |
| Trips you create: destinations, dates, itinerary stops, hotel or base location, budgets, expenses, packing lists and saved places | To provide the planner and sync it across your devices |
| Sharing: email addresses you invite and their access level | To let invited travellers view or edit a trip |
| Purchases (web and Android only): plan, amount, date and the payment provider's order and payment IDs | To activate your plan and keep accounting records. We never see or store your card, UPI or bank details. |
| Usage and security: sign-in times, device sessions, counts of features used, and records of changes to accounts, trips and payments | To keep the service secure, prevent abuse and fix problems |
| Emails we send: the type of email, the recipient and whether it was delivered (not the message text) | To send welcome and receipt emails and check that they arrive |
We do not request your device location in the app. We do not sell your data, show ads, or track you across other companies' apps and websites.
03On your device
Offline trip drafts, saved places, your profile name and preferences are stored on your phone. They stay on the device until you erase them (Profile → More account actions → Erase data on this phone) or uninstall the app. Sign-in tokens are kept in the device's secure storage (Keychain on iPhone, Keystore on Android).
04Service providers
We share only what each provider needs to do its job:
- Google Firebase Authentication: sign-in with email and password, Google or Apple. Passwords are handled by Firebase; we never receive them.
- Apple: Sign in with Apple. If you choose “Hide My Email”, we only receive Apple's relay address.
- Cloudflare: hosting and delivery of the planner and API.
- Our database host: stores account, trip and sharing data, encrypted in transit and at rest.
- Google Maps Platform: places, routes and maps. When you request a route or nearby places, Google receives the locations and travel mode involved. The Google Maps Terms and Google Privacy Policy apply.
- Razorpay (web and Android purchases only): processes payments under its own privacy policy.
- Our email provider: delivers welcome and receipt emails.
- OpenStreetMap (map tiles and address lookup in some views) and Google Fonts (planner fonts). Destination photos in the app are bundled from Unsplash and load without contacting Unsplash.
05How long we keep data
Account, trip and sharing data are kept until you delete your account. Database backups are kept for up to 14 days and then replaced. Payment records are kept as long as accounting law requires, with your email removed once your account is deleted. Security change records may be kept after deletion where needed to prevent fraud or meet legal obligations.
06Deleting your account
You can permanently delete your account at any time:
- In the app: Profile → More account actions → Delete account.
- In the planner: Account → Delete account, or open /account/delete.
- By email: write to offfbeatholiday@gmail.com from the account's email address.
Deletion removes your profile, trips, sharing and every signed-in device, and deletes your sign-in record with our authentication provider. If you used Sign in with Apple, we also revoke the app's access with Apple.
07Your choices and rights
You can view and edit your trips and profile, export a trip as a PDF, and ask us for a copy or correction of your data by email. Depending on where you live (for example under the GDPR or India's Digital Personal Data Protection Act) you may have further rights, such as objecting to processing or complaining to a regulator.
08Security
All connections use HTTPS. Sign-in tokens are stored only as one-way hashes, access is limited by role, and changes to accounts, trips and payments are logged. No system is perfectly secure; tell us at offfbeatholiday@gmail.com if you find a problem.
09Children
OffBeatHoliday is not directed at children under 13, and we do not knowingly collect their data.
10Changes
We'll update this page when our practices change and change the date at the top. Significant changes will also be announced in the app. See also our Terms & Conditions and Refund Policy.
Questions about this policy? Write to offfbeatholiday@gmail.com.