travel2jp

Privacy

Privacy Policy

We try to collect as little as possible. This page describes what we collect, why, who processes it, and your rights. Questions: okatech0311@gmail.com.

Last updated: 2026-10-07

1. Data we collect

  • Account data: email address and display name when you sign in (Supabase Auth, email or Google sign-in).
  • Content you create: saved trip plans, comments, reactions and any images you upload with a comment.
  • Profile and usage: your plan-generation counter and subscription status.
  • Payments: handled by Stripe. We store only your Stripe customer ID and the end date of your subscription, never card details.
  • Affiliate click records: when you follow a booking link we store the partner name, the full destination URL, your browser user-agent, your country (from a CDN header) and the related plan ID if any.
  • Anonymous rate limiting: for visitors who are not signed in we store a SHA-256 hash of the IP address to limit free plan generation. A hash of an IP address can still be personal data.

2. Analytics and cookies

  • Essential cookies: Supabase session cookies keep you signed in.
  • Analytics: with your consent we load Plausible, a cookieless service that reports aggregate page views. If you decline, the analytics script is not loaded.
  • Your cookie choice is stored in your browser's local storage.

3. Why we use your data

To provide the trip planner and your account, to prevent abuse, to operate subscriptions, to attribute affiliate bookings, and to improve the site. Our legal bases are performing our service to you, our legitimate interest in security and basic analytics, and your consent where we ask for it.

4. Who processes your data

  • Supabase — authentication and database.
  • Vercel — hosting and edge delivery.
  • Stripe — payment processing and subscriptions.
  • Resend — transactional email (welcome, plan-ready, contact form).
  • Cloudflare R2 — storage of images you upload.
  • Google Gemini — AI plan generation. Only the structured form choices you submit are sent; we never include your name or email in the prompt.
  • Plausible — analytics, only after consent.
  • These providers may process data outside Japan and your home country, including in the United States and the EU. We rely on their contractual safeguards for such transfers.

5. Your rights

  • Access and portability: download your data as JSON from the Account page.
  • Deletion: delete your account from the Account page. This removes your profile, saved plans, comments, reactions and uploaded images, cancels any subscription and removes your login. Affiliate click records are kept without any link to you.
  • Correction and objection: email us and we will respond within a reasonable time.
  • We handle personal data in line with Japan's Act on the Protection of Personal Information and, for visitors in the EEA and UK, the GDPR.

6. Retention

We keep account data until you delete your account. Data required for tax or accounting records held by Stripe is retained by Stripe as required by law.

7. Security

We use TLS in transit, encrypted-at-rest databases via Supabase, row-level security and least-privilege service credentials. No system is perfect; if you suspect a vulnerability, please email okatech0311@gmail.com.

8. Contact for privacy requests

Email okatech0311@gmail.com. We respond within a reasonable timeframe.

9. Amendments

We may update this Policy. The 'Last updated' date above tracks material changes. We'll post a banner on the site for any significant change.

Plan your Japan trip →