Privacy Policy

Effective date: October 4, 2026

Last updated: November 5, 2026

Controller or business: NUDOOO LLC, a California limited liability company

This Privacy Policy explains how Platix ("Platix," "we," "us," or "our") collects, uses, discloses, and retains personal information when you use the Platix website, trip-planning workspace, maps, public content, blogs, comments, collaboration tools, and related services (collectively, the "Service").

Platix is a travel inspiration, organization, and planning service. It is not a medical, financial, legal, emergency, insurance, immigration, or other professional-advice service. Please do not submit medical records, payment-card numbers, passport numbers, government identifiers, or other highly sensitive information to Platix.

1. Scope

This Policy applies to personal information processed by Platix through the Service, support communications, and related operations.

It does not govern a third party's independent processing, including travel providers, websites you visit through links, Google, OpenAI, Supabase, or other providers acting under their own terms and privacy policies.

2. Information we collect

The information we collect depends on how you use the Service.

Account and profile information

We may collect:

• Email address
• Display name
• Avatar or profile image
• Internal account and authentication identifiers
• Sign-in provider and OAuth-related information
• Authentication session and refresh tokens
• Account settings and account status
• The Terms and Privacy Policy versions presented to you, their content hashes, your acceptance or acknowledgment time, and the acceptance source

If you use Google sign-in, the Service may store Google provider access or refresh tokens when needed for enabled account features. Those tokens are restricted from normal client access.

Anonymous guest identities, temporary trips, and private visitor chat

When supported guest features are available, Platix may let a signed-out visitor create a temporary private trip or start private chat about public content. After the displayed notice and security checks, guest trip creation uses a Supabase anonymous authentication identity. New guest chats instead use a chat-only browser identity, authorized by a protected cookie whose token hash is stored on the server; this does not create a Supabase authentication account. Existing guest authentication sessions may also be reused. Merely visiting a public trip or collection does not create a guest chat identity. These identities have internal identifiers but no email address, password, or third-party sign-in identity for guest access. They are not registered Platix accounts and are separate from the optional analytics identifier described below.

For a guest identity, we collect and process:

• The anonymous authentication or chat-only browser identifier, creation time, expiration time, lifecycle status, and session information, including a token hash for chat-only browser access
• The current Terms and Privacy Policy versions, content hashes, age confirmation, acceptance time, and acceptance source
• Private guest trips or visitor chats, prompts, planning context, AI responses, edits where permitted, and related operational records
• Bounded quota, concurrency, security, and cleanup records used to prevent abuse and operate the temporary service
• Conversion or transfer status if the visitor chooses to create or sign in to an account

Guest authentication cookies are necessary to reopen guest work in the same browser. Clearing cookies or site data, signing out, changing browsers or devices, using private-browsing mode, or losing access to the browser can make the guest identity, trips, and chats inaccessible. Platix does not collect an email address or Google identity for guest access unless the visitor later provides one during account conversion.

Signing in does not automatically move chat-only browser conversations into the account. In the same browser, a verified account can explicitly select which chats to keep. Anyone using that browser's guest cookies may access its temporary chats, so end the temporary session when finished on a shared device. Ending it immediately revokes access and schedules remaining temporary chats for deletion; chats already moved into an account are unaffected.

Travel content

We collect content you create, upload, save, or receive through the Service, including:

• Trip titles, summaries, dates, destinations, routes, days, stays, and activities
• Place names, addresses, map coordinates, Google Place IDs, and place details
• Trip and place notes, tags, avoidances, and planning constraints
• Booking-related fields you choose to enter
• Saved places and collections
• Photos, captions, alt text, file metadata, and media ownership records
• Fork and source relationships between trips and collections
• Visibility and search-publication status

Designated private booking fields may be used for reservation reference numbers and costs. Do not enter access codes, payment-card data, passport data, government identifiers, or other information that is not necessary for planning. Authorized collaborators with editing access may be able to view private booking fields. Platix removes booking details from public and other read-only trip responses, but you should still review and remove private information before making a trip public.

Travel preferences and memory

Platix may store preferences you provide or facts inferred from your interactions to personalize travel planning, such as:

• Home base
• Travel style and pace
• Budget level
• Preferred transportation
• Interests and avoidances
• Dietary preferences
• Accessibility needs
• Other travel-planning notes
• Memory labels, values, confidence, source, and lifecycle status

Dietary or accessibility information can reveal sensitive health-related information. Provide it only when you want it used for travel planning. Do not provide medical records, diagnoses, medication details, or information requiring a health-care provider.

You can review and remove individual remembered facts through available account controls. You can also delete your account.

Prompts, chats, and AI records

We collect prompts, chat messages, selected trip or collection context, and AI responses when you use AI features.

For reliability, security, cost monitoring, debugging, and quality review, some workflows also store AI-run records that include the following. Private visitor chat has the narrower audit policy described immediately below:

• Input messages
• System and filled prompts
• Context and request data
• Model responses
• Model and provider
• Token usage, latency, cost estimates, and prompt fingerprints
• Guard evaluations, errors, and workflow status
• Related user, trip, collection, session, or surface identifiers

Do not include highly sensitive or regulated information in an AI prompt. Relevant prompt and context data may be sent to an AI service provider as described below.

Private visitor chat about public trips and collections

We process your messages, recent conversation context, selected public day or place, public-content snapshot, AI replies, and bounded tool results to answer your question. AI providers receive the information needed to generate a response. When public web research is enabled, a limited travel query may also be sent to a search provider. Avoid sensitive personal information. The assistant does not retrieve the source creator's private chats, memory, booking references, private cost records, or other visitors' conversations. Information an author places in public text remains public; authors should not put private details there.

Your conversation belongs to your account or temporary identity, not the source trip or collection owner. The owner, collaborators, and other visitors cannot read it through the product. Conversation content and pending choices are stored separately from public itineraries. They are not included in public pages, search indexes, social link previews, source-owner exports, agency exports, routine analytics, or daily admin emails. Operational AI audits for this feature omit raw prompts, replies, and tool arguments; chat content remains in private conversation storage. This does not promise zero processing or retention by AI or search providers.

Authentication, security challenges, short-lived network-derived abuse controls, and usage limits are necessary to provide the requested chat and are separate from optional analytics consent. A transfer to an existing account requires explicit selection and verified authentication. The reusable proof is held in a secure HttpOnly cookie; the transfer record stores its hash. It does not move the source itinerary or unselected guest work.

You may export or delete your own accessible, unexpired conversation, including when new chat is paused or the source is no longer public. This does not delete the original trip or collection. The retention periods in Section 8 apply. Support does not have a routine visitor-transcript browser. You may send chosen excerpts from your own chat to support. Authorized exceptional access for necessary security or legal purposes is subject to restricted access and applicable procedures. Private chat is not end-to-end encrypted.

Temporary lists without an account

If you use Platix without an account, the places you keep and your chat about them are stored for up to 7 days on our servers, linked to a random identifier in your browser, not to your name. Signing in moves them into your account; otherwise they are deleted.

If you save a copy of a public trip without an account, we keep which trip you copied and the name and start date you chose for up to 7 days on our servers, linked to the same random identifier in your browser. Creating an account or signing in within that time makes the copy in your account; otherwise it is deleted.

Source-assisted trip planning

If you use Already have an itinerary?, Platix collects the text or supported text file you provide, its filename and file metadata, an optional source title or description, and private source-derived records such as extracted locations, evidence references, candidate trip shapes, your source-selection edits, and the resulting planning seed. Source text is treated as private, untrusted reference material. It is not published with the trip and is not treated as your personal travel preference unless you expressly select or add that preference.

If PDF import is available to you, you can upload a text-based PDF. Platix checks the file, reads its text in an isolated process without opening links or running anything in it, and stores the text privately as source text. Platix keeps the PDF privately for up to 30 days, or deletes it as soon as it has replaced a card number or ID number found in its text. Deleting the source deletes the PDF and the text read from it.

If you explicitly choose Article link, Platix retrieves the public webpage you submit from its publisher. The publisher may receive Platix's server IP address, user agent, request time, and ordinary connection information. Platix follows bounded redirects, extracts the page's main text with deterministic software, and may collect the final article URL, hostname, title, author, publication date, language, response size, and extraction diagnostics. Platix does not use your browser cookies, credentials, or authenticated session to retrieve the page, does not bypass paywalls, and does not crawl linked pages. An optional free-form source description supplied with pasted or uploaded text is not automatically fetched.

Platix does not retain raw article HTML after deterministic extraction. It stores normalized extracted article text in private Cloudflare R2 storage and processes relevant source content through the AI providers described in Section 4. Raw uploaded or extracted source text is ordinarily deleted within 30 days. Private derived source records and article provenance are ordinarily deleted within 90 days. You can delete a source sooner through the source workspace. A trip already created from your confirmed selection remains separate trip content until you delete it, but deleting the source does not publish or copy the original source into that trip.

Do not submit confidential or authenticated pages, access credentials, booking codes, payment-card data, passport or government identifiers, medical records, or content you do not have the right to use. Submit an article link only when you are entitled to have its public content processed for your private travel planning.

AI response feedback

If you choose to rate an AI response or an AI-created trip draft, Platix stores your thumbs-up or thumbs-down rating, any structured reasons you select, the identifier of the response or creation session, and related model or workflow metadata used to evaluate service quality. Platix does not copy the prompt or AI response into the feedback record.

After a downvote, you may optionally choose "Tell us more" and write a short comment. This comment contains only text you deliberately enter. Do not include booking references, access codes, payment-card data, passport or government identifiers, medical information, or other sensitive personal information in feedback.

Submitting feedback is an explicit product action and does not depend on your optional analytics or advertising-measurement choices. Platix uses this information to evaluate response quality, investigate recurring problems, compare workflows and models in aggregate, and improve the Service. A rating or comment does not by itself authorize Platix or an AI provider to use your conversation for model training.

Collaboration and sharing information

We collect information needed to provide collaboration and access controls, including:

• Invitee email address
• Invitation token and status
• Viewer or editor role
• Inviter and accepting-user identifiers
• Invitation delivery status
• Access grants and removal history
• Share and change events

If you invite someone, you represent that you have a legitimate reason to use their email address for the invitation.

Public and community information

Depending on your choices, we collect and display:

• Public trips and collections
• Public profile display name and avatar
• Comments and replies
• Reactions, saves, bookmarks, and fork activity
• Blog-comment name, body, status, and timestamps
• Public-content source links and attribution

Public content can be viewed, copied, linked, indexed where separately approved, or retained by others. Unlisted or link-accessible content may be viewed by anyone who obtains the link.

Purchase, sales, and payout information

If you buy a premium trip or a Human Itinerary Review, we record the purchase: what you bought, your account, the amount and currency, the payment status, and an identifier from our payment provider. We do not receive or store your full card number. Card details are entered with Stripe, which processes them as an independent controller for fraud prevention and legal compliance, and as our processor for the payment itself.

If you sell trips or review trips as a creator, we record your sales and reviews, your earnings, and the payouts we make to you.

Payout setup. Stripe collects your identity, tax, and bank information directly when you set up payouts. From Stripe we receive:

• your Stripe account reference and country;
• whether your payout setup is complete or needs attention, with a general reason;
• the status of the payouts we send you.

We do not store your bank account details, identity documents, or full taxpayer identification number in Platix systems. When you provide personal data to set up payouts, Stripe receives it and processes it as described in the Stripe Privacy Policy.

Tax forms. To file the tax forms the law requires, we use Stripe's tax reporting service. Stripe prepares the forms from your tax information and the payouts we made to you, and files them with tax authorities on our behalf. Authorized Platix staff can view tax form information in Stripe when needed to file or correct a form, or to answer your questions about it.

Sharing with the creator you buy from. When you buy a premium trip, we share your name and email address with the creator who sells it, unless you choose not to at checkout. The creator may use them to contact you about the trip, its updates, and their other travel content, and must give you a way to unsubscribe. You can stop sharing later in Purchases. That removes you from the list we show the creator, but a creator may already have saved a copy, which they hold under their own responsibility. Creators never receive your payment details, your private copy of a purchased trip, or what you do in it. A creator who reviews your trip sees the content you chose to share for that order, but never your identity or contact details.

We keep purchase, earnings, payout, and tax records for as long as accounting, tax, audit, and dispute rules require, which is generally longer than we keep other account data.

Human Itinerary Review orders

If you request or buy a Human Itinerary Review, we collect:

• Your request. The trip, the reviewer you chose, your main question, the brief you wrote, the travel month, and the sharing choices you made, including whether to share trip notes and any sensitive details.
• A review snapshot. A frozen copy of the trip's review-relevant content as it was when you ordered: destinations, dates or travel month, days, stops, routes and transfers, fixed-versus-flexible booking constraints, and the automated Planning health findings. Trip notes are included only if you choose. Booking references, receipts, costs, attachments, chats, memories, prompts, other trips, and collaborators are never included.
• The service record. Messages exchanged with the reviewer (one clarification and one follow-up), the report and any corrections, your decisions on each finding, your feedback, and any problem you report.
• Payment information. As described under "Purchase, sales, and payout information." Your card is authorized at checkout and charged only when the reviewer accepts.

Who sees it.

• Before accepting, the reviewer sees a generalized summary: the main destination, the season, the number of days and stops, your focus areas, and your main question.
• After accepting, the reviewer sees the snapshot and the brief you approved. The reviewer never sees your name, email address, or contact details.
• A small number of Platix staff may read an order to support you, to audit review quality, or to investigate a problem. Each such read is logged.

What we do not do. We do not use review snapshots, briefs, or reports for testimonials, marketing, research, or training AI models without your separate, specific consent. Reviewers must not copy your trip into outside AI tools or reuse it for any other purpose.

Email subscriptions and announcements

Platix sends two kinds of email that are not required to operate your account.

Product announcements. If you turn on Product announcements in Account settings under Email notifications, we may occasionally email the address on your account about new or changed Platix features. This setting is off by default. You can turn it off at any time in Account settings or by using the unsubscribe link in the email. Turning it off does not affect account, password, invitation, security, or other operational emails, which you continue to receive because they are necessary to provide the Service.

Newsletters. Platix offers a traveler newsletter with trip ideas and product news, and a creator newsletter with the requested creator guide and occasional creator news. You may subscribe to either or both. For each newsletter membership, we collect and store:

• Email address
• The newsletter membership you requested
• Subscription status
• The page or surface you subscribed from
• The consent wording shown to you, the time you confirmed, and the IP address used to request the subscription
• A single-use confirmation token and an unsubscribe token

Newsletter memberships are separate from having an account and from each other, and each uses confirmed opt-in: we send a confirmation link and only activate that membership after you follow it. Every newsletter email contains an unsubscribe link for that newsletter. Unsubscribing from one does not unsubscribe you from another newsletter you separately requested. We retain each consent record after you unsubscribe so we can show what was agreed and when.

Trip plan, review and copy emails. If you ask us to email you a trip plan, a trip review or a copy of a trip, we store your email address with it for up to 7 days to send it and one reminder. We do not add you to our newsletter. You can unsubscribe at any time, from the email or with your email app's unsubscribe button; we then send no more reminders to that address, and keep only a one-way hash of the address to honor that. The address itself is deleted with the plan, review or copy unless you create an account.

Contact and support information

When you contact us, we may collect:

• Name
• Email address
• Account identifier if signed in
• Message contents
• Message status and metadata
• Related email-delivery records

Contact messages are stored in our database and may also be sent to support@platix.io so a team member can respond.

Bug reports and diagnostics

When you report a problem from inside Platix, we collect what you write, the email address on your account or the one you give us, and a set of technical details that let us reproduce the problem:

• The page you were on, the part of the Service it belongs to, and the trip or collection identifier when the page relates to one
• The release version of Platix you were using
• Your browser's user-agent string, window size, language, and time zone
• A short list of recent in-app actions, recorded as action names only, such as "opened a trip" or "added a day". The content of those actions is not included.
• Recent error messages from your browser. These are filtered to remove access tokens, API keys, and email addresses before they are recorded.

A screenshot is optional and never automatic. If you choose to add one, your browser asks you which window or tab to share, we capture a single image, and we show it to you before anything is sent so you can remove it. A screenshot can show whatever was on your screen, including private trip details, so review it before sending. If you are not signed in, screenshots are not available.

Bug reports create no advertising or analytics identifiers. The diagnostics above are gathered for the report only. They do not use, set, or read the analytics identifiers described in Section 7, and reporting a problem does not depend on your analytics choice.

Usage, analytics, and technical information

We may collect:

• IP address and request timing
• Browser or device user-agent information
• Request IDs, server logs, error logs, and security events
• Anonymous analytics identifier stored in local storage
• Analytics session and page-view identifiers
• Application version
• Account identifier when signed in
• Event type, product surface, and source
• Trip, collection, place, or scope identifiers associated with an event
• Search query text
• Place name, address, provider ID, and map coordinates
• Map viewport and interaction metadata
• Tutorial status and dismissed or completed steps
• Authentication redirect path stored locally in your browser

Current first-party interaction events include map searches, map place selections, marker interactions, and product-starter interactions.

Platix asks for your consent before analytics or advertising measurement runs. You can choose analytics only, accept both optional purposes, or reject both. Until you choose, no Google measurement script is loaded, no analytics or advertising-measurement cookie is set, and no first-party analytics identifier or event is created. Declining is recorded and respected; you can change either choice at any time, and withdrawing consent is as easy as giving it. The analytics choice covers both Google Analytics and the first-party product analytics described above, because both store identifiers on your device. Advertising measurement is a separate choice and is not required to use analytics or the Service. If you consent to analytics and later sign in, Platix may associate the consenting browser's anonymous analytics identifier with your account so product activity can be understood across the sign-in boundary. Neither choice covers the authentication cookies needed to sign in and stay signed in, which are strictly necessary for the Service you requested and are not optional.

To evidence those choices, Platix records a consent receipt containing only the analytics decision, the advertising-measurement decision, the consent version they were given against, the time, how they were given, the application version, and a randomly generated receipt identifier used solely to link a later change of mind to the same device. The receipt deliberately does not include your IP address, browser user agent, referring page, page address, or location, and the receipt identifier is separate from any analytics identifier.

With your consent, Platix may retain sanitized text from searches of public content and your My Trips library to understand travel demand and improve search quality. Search-demand records are stored separately from general interaction analytics and do not include an account ID, email address, browser or analytics identifier, session ID, request ID, trip ID, IP address, or browser user agent. Before storage, Platix attempts to redact obvious email addresses, phone numbers, web addresses, UUIDs, tokens, and secret-like text. Search text can still identify someone through what they type, so Platix treats these records as restricted analytics data. Raw sanitized searches are ordinarily retained for up to 90 days. Only query groups that meet a minimum frequency threshold are included in monthly demand aggregates, which are ordinarily retained for up to 24 months. Search continues to work when analytics consent is declined; in that case, Platix does not create these search-demand records.

With your consent, Platix uses Google Analytics 4 to understand how visitors find and navigate the Service, including which referrers, search results, and articles bring people to the site. Google Analytics sets its own identifiers and processes IP address, page address, referrer, and general device and approximate location information under Google's terms. Google Analytics is loaded directly through the gtag.js measurement library; Platix does not use Google Tag Manager.

Platix limits what is sent to Google Analytics. Page addresses may include only allowlisted utm_* campaign parameters when analytics consent is granted. URL fragments, authentication parameters, product search text, and other query parameters are removed, and invitation links are reported in a redacted form, so authentication and invitation tokens are not shared.

With analytics consent, Platix may also record bounded campaign codes and coarse on-site funnel actions to understand whether a paid campaign led visitors to a product page or application. Current agency-pilot campaign records accept only predefined source, campaign, creative, audience, placement, and event codes. They do not include email addresses, business names, application answers, website URLs, or other free text. The agency application remains a separate operational record; submitting it does not depend on analytics consent.

Platix may purchase advertisements on Reddit without installing the Reddit Pixel or sending server-side conversion events to Reddit. Reddit independently reports activity that occurs on its service, such as ad impressions and outbound clicks, under Reddit's own terms and privacy policy. Platix does not currently send agency-page views, application activity, account identifiers, or application content to Reddit.

If you separately consent to advertising measurement, Platix configures the Google tag for Google Ads and may send allowlisted Google click identifiers (gclid, gbraid, wbraid, or dclid) and bounded conversion events. Those events may report that a new account was confirmed, a guest Trip Review completed, or a reviewed itinerary was securely attached to an account. A conversion includes an opaque transaction identifier for deduplication and a bounded method or stage, but not your email address, display name, Platix user ID, itinerary, review, trip content, or search text. Platix uses these events only to measure whether advertising led to those product outcomes. It does not enable Google Signals, enhanced conversions, remarketing, personalized advertising, or cross-context behavioral advertising. The ad_personalization consent signal remains denied.

Location information

Platix processes travel locations you enter, search, save, select, or include in a trip. This can include precise map coordinates for a place or route.

Platix does not currently collect continuous device GPS location as part of the implemented web product. If we add device-location collection, we will provide a contextual notice and request any consent required by law before collection.

Information from other sources

We may receive information from:

• A collaborator who invites or mentions you
• An authentication provider
• Google Maps and Places
• Public place and travel-information sources
• A support or email-delivery provider
• Security, fraud-prevention, or infrastructure providers

3. How we use information

We use personal information to:

• Create and manage registered accounts, anonymous guest identities, authentication, and account conversion
• Provide trips, collections, maps, saved places, media, collaboration, comments, and sharing
• Generate, edit, review, and explain travel plans with AI
• Personalize travel planning using saved preferences and memory
• Respond to contact, support, bug, and partnership messages
• Deliver account, password, invitation, and operational emails
• Send occasional product announcement emails about new or changed Platix features if you opt in
• Enforce visibility, access, moderation, and search-publication controls
• Measure product usage and improve workflows
• Debug errors and maintain AI and system audit records
• Protect users, investigate abuse, and secure the Service
• Prevent fraud, spam, unauthorized access, and excessive automated use
• Comply with law and valid legal requests
• Establish, exercise, or defend legal claims
• Perform de-identified or aggregated analysis

Platix does not use the Service to make decisions that produce legal or similarly significant effects concerning employment, credit, insurance, housing, health care, or eligibility for government benefits.

4. AI processing

When you use an AI feature, Platix may send your prompt and relevant travel context to OpenAI or another disclosed AI provider so it can generate a response.

We attempt to limit context to what is relevant to the requested travel-planning task. Some workflows store prompts, context, responses, and audit information in Platix systems as described above.

Platix currently uses OpenAI's API rather than a consumer ChatGPT account. Platix requests that Responses API output not be retained as stored response state where that control is supported. OpenAI states that API inputs and outputs are not used to train its models by default unless the API customer opts in, and that default abuse-monitoring logs may be retained for up to 30 days unless different approved controls apply. OpenAI's practices and available retention controls may change. Review the current OpenAI API data controls and OpenAI business data privacy information.

Platix does not currently use your private trips, private collections, or private chats to train a Platix general-purpose foundation model. If we propose materially different training or model-improvement use of identifiable User Content, we will update this Policy and obtain consent where required.

AI-generated editorial blog drafts use a sanitized source packet from a selected public trip or collection. A human review is required before publication. A separately published editorial article should be created only with the source owner's opt-in or other clearly disclosed permission.

5. How we disclose information

We may disclose personal information as follows.

At your direction

We disclose information when you:

• Make a trip or collection public or link-accessible
• Invite a collaborator
• Post a public comment or reaction
• Fork or share eligible content
• Ask us to send information to a third party
• With the creator of a premium trip you buy: your name and email address, unless you choose not to share them.
• With the Human Itinerary Review reviewer you choose, limited to the snapshot and brief you approve at checkout.

Service providers

We use service providers to operate the Service. Depending on configuration and use, these may include:

Providers process information under their contracts and policies. We may replace or add providers as the Service changes.

Google Maps

The Service includes Google Maps features and content. Google may process requests, device or server IP address, API or project identifiers, place searches, map interactions, and related information under its terms and policies.

Use of Google Maps features is subject to the current Google Maps/Google Earth Additional Terms of Service and Google Privacy Policy. Google Maps Platform information may also be subject to Google's own collection and retention practices.

Legal, safety, and corporate events

We may disclose information when reasonably necessary to:

• Comply with law, court order, subpoena, or valid legal process
• Protect rights, safety, and security
• Investigate fraud, abuse, or a violation of our Terms
• Respond to an emergency where disclosure is permitted by law
• Complete a merger, financing, acquisition, reorganization, bankruptcy, or sale of assets, subject to applicable safeguards

Aggregated or de-identified information

We may disclose aggregated or de-identified information that cannot reasonably identify you. We will not attempt to re-identify it except to test de-identification or as permitted by law.

6. Public, link-accessible, and collaborative content

Your visibility choice determines who can access content.

Private content

Private content is limited to authorized users, service operations, providers acting for Platix, and disclosures described in this Policy.

Link-accessible content

Anyone who obtains a valid link may be able to view link-accessible content. A recipient can forward the link. Do not treat link-accessible content as private.

Public content

Public content can be viewed by anyone. Approved public pages may be added to sitemaps and indexed by search engines. Search engines, archives, recipients, and other users may retain copies after you change visibility or delete the original.

Collaborators

Viewers and editors can access shared content according to their role. Editors may change content. Platix records access, invitation, and change information to operate and protect collaboration.

7. Cookies and local storage

Platix uses HTTP-only authentication cookies for registered-account and anonymous guest access and refresh sessions. In production, these cookies are intended to use secure transport and SameSite=Lax controls. Guest session cookies are strictly necessary for the temporary service and are used even when optional analytics and advertising measurement are declined.

The browser may also use local or session storage for:

• Your analytics and advertising-measurement consent decisions and a consent receipt identifier
• A first-party anonymous analytics identifier, created only after you consent to analytics
• Tutorial progress and dismissal state
• Temporary authentication redirect paths
• Temporary application state

Google Analytics and Google Ads measurement may set Google cookies or read campaign identifiers to distinguish visits and attribute conversions. The relevant storage is enabled only for the purpose you consent to. Platix implements Google Consent Mode with analytics and advertising signals defaulting to denied, keeps personalized-advertising consent denied, and does not load the Google measurement script until at least one optional measurement purpose is granted.

Platix stores your consent decision in local storage under platix_consent, and a randomly generated consent receipt identifier under platix_consent_id. Clearing your browser storage clears the decision, and Platix will ask again.

Google Maps or other third-party features may use cookies or similar technologies under their policies.

Platix does not use cookies for third-party cross-context behavioral advertising. Google Signals, enhanced conversions, remarketing, and personalized advertising are not enabled by this implementation.

Reporting a bug does not create, read, or store any of the identifiers described in this section. Bug-report diagnostics are gathered in memory for the report you are sending and are not retained on your device.

8. Retention

We retain information only for as long as reasonably necessary for the purposes described in this Policy, including providing the Service, maintaining security and auditability, resolving disputes, and complying with law.

Retention depends on:

• Whether your account remains active
• Whether content is private, shared, or public
• Whether a record is needed to provide a requested feature
• Security, fraud, and abuse-prevention needs
• Backup and disaster-recovery cycles
• Legal, tax, accounting, contractual, and dispute requirements
• The need to preserve a minimal deletion or operational audit record

Examples:

• A guest identity and its guest trips expire 30 days after the anonymous identity is created. Guest activity does not restart that period. At expiration, access ends and the identity, private trips, temporary planning sessions, and related guest-owned data become eligible for deletion. Cleanup may occur after a short operational grace period and may require retries. Converted accounts and trips successfully transferred before expiration are excluded from guest cleanup.
• Guest quota records use keyed or hashed network information rather than storing raw IP addresses in the guest quota tables. Related security and operational records are retained only for bounded abuse-prevention, reliability, and cleanup periods. Hosting and security providers may process IP addresses separately in their ordinary infrastructure logs.
• When a guest creates a new account, Platix may link a verified email or Google identity to the existing anonymous identity so its eligible private trips remain attached to the resulting account. When a guest signs in to an existing account, Platix uses a separate explicit transfer process to move eligible private trips to that account and retire the anonymous session. Conversion and transfer records may be retained for security, auditability, conflict prevention, and support; aggregate operational records may remain without a guest identifier.
• Private visitor chats have a separate schedule: temporary chats expire at the earlier of 30 days after the conversation starts or the guest identity's expiry. Verifying a new account does not automatically extend this expiry; an explicit keep-chat choice changes it to the registered policy. Transfers move only explicitly selected chats and preserve temporary expiry unless you choose to keep them. Registered visitor chats expire after 90 days without a new accepted message. Reading, polling, and retrying the same turn do not extend retention. Expired records are removed by scheduled cleanup; failures or backlog can delay physical deletion. Deleting a chat removes its active transcript and associated turn and pending state, but does not promise immediate deletion from backups or provider records.
• Content-free hourly operational counts for private visitor chat are retained for up to 180 days and do not contain user, source, or conversation identifiers or free text. Short-lived security and transfer records are removed through bounded scheduled cleanup; a transfer proof normally expires after 15 minutes or sooner if the guest identity expires.
• Trips, collections, other chats, preferences, and media are generally retained while your account or the content remains active, subject to feature-specific schedules described in this Policy.
• Public content and comments may remain until removed, moderated, or deleted.
• Contact messages may be retained to respond, track resolution, and maintain support records.
• Bug reports follow two schedules. A screenshot attached to a report is deleted within 90 days. The technical diagnostics — recent error messages, the action-name list, and your user-agent, URL, language, and time zone — are removed within 180 days. The description you wrote is kept like other support correspondence.
• AI audit records may be retained for quality, debugging, security, and cost accountability.
• Guest Trip Check submissions, optional questions, extracted previews, and AI review responses may be retained in restricted quality and debugging records for up to 180 days. Reviewing alone does not create a traveler-facing trip or chat history. If you choose Save and build this trip and the private trip is successfully created, Platix keeps a separate copy of the original review with that trip so its owner can revisit the initial notes in Planning health. Editing the trip does not rewrite this historical review. The trip-owned copy is deleted with the trip or account and is not included in public or shared trip views. Trip Check content is not added to public analytics or used to train a Platix general-purpose foundation model.
• AI response ratings, structured reasons, and optional feedback comments are ordinarily retained for up to 365 days, unless you remove the rating or the associated response, trip-creation session, or account is deleted sooner. Privacy-safe aggregate counts may be retained longer without user, response, or trip identifiers.
• Raw transcript sources used for transcript-assisted trip planning are ordinarily deleted within 30 days; private derived source records are ordinarily deleted within 90 days or when you delete the source sooner. A minimal content fingerprint and privacy-safe operational counts may be retained briefly to enforce quotas and maintain aggregate reliability metrics without retaining transcript text.
• Legal acceptance records are retained with your account so Platix can demonstrate which document versions you accepted. The current account-deletion process deletes those user-linked records.
• Human Itinerary Review snapshots and the messages exchanged with the reviewer are deleted 90 days after the order completes or is cancelled. Reports, corrections, and your finding decisions stay with your account until you delete it. The reviewer loses access when the order closes.
• If a checkout is abandoned, its snapshot and brief are deleted within 24 hours of the checkout expiring.
• Order events are kept with the financial record, with free text removed after 90 days. Financial and tax records follow the purchase-record rule above.
• A request to be told when reviewers are available is kept for up to 180 days after the waitlist closes, or until you delete your account.
• An open dispute or legal hold pauses these deletions.
• Infrastructure logs may be retained for a limited operational period.
• Backups may persist temporarily after active-system deletion until overwritten through normal cycles.

Platix is documenting specific retention periods for contact messages, analytics events, AI audit records, security logs, deleted-account audit events, and backups, and will publish them in this Policy. Until then, Platix retains this information only for as long as needed for the purposes described above and deletes or de-identifies it when that need ends.

9. Account and guest deletion

You may request account deletion through available account controls or by contacting us.

Before conversion, a guest may delete an eligible temporary trip or private visitor chat through available controls. Guest identities and remaining guest-owned data are handled through the expiration and cleanup process described in Section 8. Because guest access is browser-bound and has no independent sign-in method, support may be unable to verify control of or restore an inaccessible guest identity.

The implemented account-deletion process is designed to:

• Delete owned trips, collections, saved places, chats, memories, preferences, reactions, bookmarks, tutorial state, and owned media
• Remove access grants and pending invitations associated with the account or email
• Delete social and collection comments associated with the account
• Delete AI response ratings, structured reasons, and optional feedback comments associated with the account
• Delete transcript sources, source-selection conversations, and private source-derived planning records associated with the account
• Anonymize blog comments and contact messages associated with the account
• Delete any bug-report screenshots you attached, and remove your identity, contact address, and diagnostics from bug reports you filed
• Remove actor identity from change and share records where implemented
• Remove or anonymize user attribution from selected audit and recommendation records
• Delete the Supabase authentication user
• Delete user-linked legal acceptance records
• Preserve a restricted account-deletion event containing a user identifier, optional email hash, status, counts, metadata, and error information for operational accountability

If you are a creator with earnings still due to you or owed by you, account deletion waits until they are paid or resolved, so that payout and tax records stay correct. Contact support if you need help.

If you have an active Human Itinerary Review order, as a buyer or a reviewer, account deletion waits until the order is completed, cancelled, or refunded. Contact support if you need to end it sooner. When the account is deleted, your reports and finding decisions are deleted; payment, earnings, and dispute records are kept as described in Section 8.

Some information may remain where required for security, legal compliance, dispute resolution, fraud prevention, backups, or the rights of other users. Content others copied outside Platix cannot be deleted by Platix.

Deleting your account removes you from creators' buyer lists in Platix. A creator who already saved your details holds them independently; contact them to have those deleted.

If account deletion cannot complete, contact support@platix.io.

10. Security

We use administrative, technical, and organizational measures intended to protect personal information. Current controls include server-side service credentials, HTTP-only session cookies, access checks, row-level database security, rate limits on selected endpoints, restricted media access, and account-deletion tooling.

No security measure is perfect. We cannot guarantee that information will never be lost, accessed, disclosed, altered, or destroyed without authorization.

You are responsible for protecting your account credentials and for avoiding unnecessary sensitive information in public or AI-assisted content.

11. Your choices and controls

Depending on the feature, you may:

• Delete an eligible temporary guest trip before it expires
• Convert a guest identity into a new account or explicitly transfer eligible guest trips to an existing account before expiration
• Edit your profile and display name
• Change trip or collection visibility
• Manage collaborators and invitations
• Edit or delete eligible comments
• Delete saved memory facts
• Turn product announcement emails on or off, and manage activity email notifications
• Unsubscribe from either newsletter using the link in an email from that newsletter
• Update travel preferences
• Clear selected chat histories
• Change or remove your AI response ratings and optional feedback comments
• Delete trips, collections, saved places, and media through available features
• Delete your account
• Avoid posting public or link-accessible content
• Decline to provide optional author-input information for editorial content

You may contact us for additional privacy requests.

12. Privacy rights

Depending on where you live and subject to legal exceptions, you may have rights to:

• Know whether we process your personal information
• Access or receive a copy of personal information
• Correct inaccurate information
• Delete information
• Restrict or object to processing
• Receive portable information
• Withdraw consent where processing is based on consent
• Appeal a denied request where applicable
• Lodge a complaint with a regulator

To submit a request, email support@platix.io with the subject "Privacy Request." We may need to verify your identity and authority before completing a request. An authorized agent may submit a request where permitted by law, but we may require proof of authorization and identity verification.

We will not discriminate against you for exercising an applicable privacy right.

13. California privacy notice

California residents may have rights under the California Consumer Privacy Act, as amended ("CCPA"), if it applies to Platix.

The categories of personal information described in California law that Platix may collect include:

• Identifiers
• Customer-record information
• Internet or electronic-network activity
• Geolocation information
• Audio, electronic, visual, or similar information, including uploaded media
• Commercial or interaction information, if future paid features are introduced
• Inferences about travel preferences
• Sensitive personal information when a user voluntarily provides precise location, account credentials, dietary information, or accessibility needs

Sources, purposes, and recipients are described in Sections 2, 3, and 5.

Platix does not currently sell personal information for money. Platix does not currently share personal information for cross-context behavioral advertising as "share" is defined by the CCPA. If those practices change, we will update this Policy and provide legally required opt-out methods before the change applies.

When you buy a premium trip, we disclose your name and email to that trip's creator at your direction, and you can choose not to. We do not receive payment for this disclosure.

Because Platix does not currently sell or share personal information for cross-context behavioral advertising, a Global Privacy Control signal does not change those practices. If Platix begins an activity subject to opt-out preference signals, it will implement legally required handling before beginning that activity.

The CCPA does not apply to every business. This section is intended to provide transparency and applicable rights; it is not an admission that Platix meets a statutory threshold.

14. European, UK, and Swiss users

Where the GDPR, UK GDPR, or similar law applies, NUDOOO LLC is the controller of personal information described in this Policy unless stated otherwise.

We rely on one or more of the following legal bases:

• Contract, to provide the Service you request
• Legitimate interests, such as security, debugging, product improvement, support, and abuse prevention, balanced against your rights
• Consent, where required for optional processing
• Legal obligation
• Establishment, exercise, or defense of legal claims

Information may be transferred to and processed in the United States and other countries where our providers operate. Those countries may have different data-protection laws from your country. The transfer safeguards applicable to a provider are described in that provider's contractual terms and data-processing documentation. Contact support@platix.io for information about safeguards relevant to your use of the Service.

You may contact your local data-protection authority. European Commission information about GDPR rights is available through its data-protection guidance.

15. Children

The Service is not directed to children under 13. Platix does not knowingly collect personal information from a child under 13 without legally required parental consent.

Users must be at least 18 to create an account or use guest trip creation under the Terms. If Platix later allows users aged 13-17, it will implement a consistent age and guardian policy and update this Policy before doing so.

If you believe a child has provided personal information, contact support@platix.io. We will investigate and delete information where required.

16. Do Not Track

Some browsers offer a "Do Not Track" setting. There is no universally accepted technical standard for responding to these signals, and Platix does not currently respond differently to browser Do Not Track signals.

This does not affect legally required handling of other recognized privacy signals, such as opt-out preference signals where applicable.

17. Advertising, affiliate, and referral features

Premium trips, creator applications, payouts, and payment processing are covered by this Policy. See "Purchase, sales, and payout information" in Section 2 for what we record, and the disclosure table in Section 5 for the role Stripe plays.

Platix may purchase contextual or audience-targeted advertisements from advertising platforms, including Google and Reddit. Measurement performed on Platix is limited as described in Section 7 and depends on the applicable analytics or advertising-measurement choice. Platix does not currently use the Reddit Pixel, Reddit's server-side conversion API, personalized-advertising audiences built from Platix activity, or cross-context behavioral advertising.

Platix does not operate affiliate links or an affiliate-revenue program of its own. Before introducing Platix affiliate tracking or materially expanding advertising technology, Platix will update this Policy and provide any choices or disclosures the law requires.

Creators may include their own affiliate or referral links and promo codes in trips they sell or share, labeled as such. Platix does not add these links, track who follows them, or receive commissions from them, and does not give the linked business your name or contact details. When you follow one, your browser goes directly to that business, which, along with its affiliate network, may use cookies or similar technologies to credit the creator under its own privacy policy. Your browser tells the business only that you came from Platix, not which trip you were viewing.

18. Changes to this Policy

We may update this Policy as the Service or law changes. We will post the updated Policy, revise the effective date, and provide additional notice when required.

Materially different uses of previously collected personal information will be handled as required by law.

19. Contact

Questions, requests, or complaints may be sent to:

NUDOOO LLC
Palo Alto, California, United States
Email: support@platix.io
Privacy contact: COO