Privacy policy
Last updated: August 28, 2026
1. Who we are
Grasstile is a travel planning and outdoor activity app operated by CaptainCTO (the “Service”). Questions about this policy can be sent to spikethegreenyboy@gmail.com.
2. Closed beta and launch list
If you create a beta account, we collect your email address and optional preferences, including interests, frequency, and whether you want beta access, to provide the app, prioritize feedback, and share product updates.
If you use a “notify me” form without creating a full account, we collect only your email address and store it in our launch subscriber list. We use it solely to notify you of important launch or beta updates.
You can unsubscribe from launch emails or request deletion of your email at any time by contacting spikethegreenyboy@gmail.com.
3. What we collect
- Account data: your email address and the password hash stored by Supabase Auth when you sign up.
- Profile and preferences: travel style, pace, interests, and the theme you choose in the app.
- Trip data: trips, itineraries, places, activities, photos, budgets, and notes you create.
- Usage data: coarse product analytics, planning-use counts used to enforce plan limits, and optional error telemetry. We do not sell analytics profiles.
- Payment data: processed entirely by Stripe. We store only your Stripe customer ID and subscription tier; we never see your card number.
- Device data: browser type, operating system, and IP address collected automatically by our hosting provider, Vercel.
4. How we use your data
- Provide, operate, and improve the Service.
- Generate editable itineraries and suggestions using your trip context, which is sent to recommendation providers as described in Section 6.
- Send transactional emails, including invitation links, subscription receipts, and applicable Stripe billing notices.
- Enforce plan limits for trips, planning uses, and storage.
- Detect and prevent fraud or abuse.
We do not sell your data. We do not serve ads.
5. Data storage and security
Your data is stored in a Supabase PostgreSQL database hosted in the United States, in AWS us-west-2 (Oregon), with row-level security enabled on every exposed public table. Photos are stored in Supabase Storage. Data is encrypted at rest and in transit using TLS 1.2 or later.
6. Third-party services
- Supabase: database, authentication, and file storage. Privacy policy.
- Stripe: payment processing. Privacy policy.
- Recommendation providers: editable itinerary generation and Touch Grass suggestions. Trip context, preferences, or free text you submit may be sent to generate output. We do not send your password and avoid sending your email where technically feasible.
- Mapbox: interactive maps. Privacy policy.
- Google Places: place search and details through a server-side proxy; the API key is not exposed to browsers.
- OpenStreetMap Nominatim: fallback geocoding for addresses in place files you choose to import. Browser geolocation used by Explore stays on your device for local distance sorting.
- Resend: transactional email delivery.
- Vercel: hosting and edge network. Privacy policy.
- Upstash (Redis): short-lived caching and rate-limit counters. It may store hashed IP prefixes or opaque keys, not a history of everywhere you go.
- PostHog: optional, privacy-oriented product analytics when enabled, configured without advertising cookies. See PostHog's policy.
- Sentry: optional error monitoring when enabled, used to diagnose crashes without browsing your trip content.
7. Feedback and communications
You may voluntarily email feedback, bug reports, suggestions, inconsistencies, or testimonials to spikethegreenyboy@gmail.com. In-app feedback forms may store your text, coarse context such as a page path or preferences already chosen in the app, browser type, and a one-way hash of your IP address to prevent spam, not a precise location trail.
We may use these messages to improve Grasstile. We may not respond to every message. Submitting feedback does not obligate us to implement a suggestion.
8. Cookies and local storage
Grasstile's current browser client stores Supabase Auth sessions in localStorage on your device rather than in Supabase Auth cookies. We do not run third-party advertising networks.
Before optional consent, Grasstile may set only necessary preferences, including the NEXT_LOCALE language cookie and the grasstile-analytics-consent choice cookie. The consent cookie stores only granted or denied, not an identifier.
If you enable Analytics, PostHog may use first-party cookies and localStorage to distinguish sessions. You can change your choice at any time in Settings → Privacy & data. Withdrawing consent stops capture and clears PostHog identity and session persistence. Session replay and console-log capture are disabled.
If you enable Error monitoring, Sentry may receive scrubbed crash and performance diagnostics. Browser replay is disabled.
Your theme and font preferences are stored in localStorage on your device. Your browser handles geolocation prompts. A coarse city or coordinates you approve may be sent to our servers only to generate nearby ideas for that request, consistent with the in-app copy.
9. Your rights (GDPR and CCPA)
You have the right to:
- Access: request a copy of the personal data we hold about you.
- Correction: update your email or profile through Settings.
- Deletion: delete your account and associated data through Settings → Delete account. Deletion is permanent and processed within 30 days.
- Portability: export your trips from the trip view in JSON, CSV, Markdown, plain text, GPX, GeoJSON, calendar, and ICS formats.
- Objection: opt out of marketing emails at any time. Transactional billing and security emails cannot be disabled.
To exercise a right, email spikethegreenyboy@gmail.com. We respond within 30 days.
10. Data retention
We keep your data while your account is active. Cached generated itineraries are purged after 30 days. After account deletion, backups are purged within 30 days.
11. Children
Grasstile is not directed at children under 16. If you believe a child has created an account, email us and we will delete it promptly.
12. Changes to this policy
We may update this policy. We will notify you by email or an in-app banner at least 14 days before material changes take effect.