WanderBunnies — Version 3.1, effective October 9, 2026.
What changed in this version: visitors with a public blog link can react without an account. We explain the browser identifier used to change or remove those reactions.
This Privacy Notice explains how Tristan Duerk, an individual trading as WanderBunnies ("WanderBunnies," "we," "us," or "our"), processes personal data when you use our web, mobile, and related services (the "Service").
The data controller is:
For privacy requests, please identify yourself, describe the request, and provide the email address associated with your account. We may request reasonable information to verify your identity.
| Category | Examples | How collected |
|---|---|---|
| Account and authentication | Name, email address, username, password credentials, sign-in provider, account role, email-verification status, date of birth or an age confirmation, authentication and session identifiers. | Registration, login, Google, Apple or other enabled sign-in providers, and account management. |
| Profile and preference data | First and last name, home address, preferred airport, optional age and gender, travel preferences (such as pace, comfort level and interests), temperature, appearance and map preferences, family or fellow-traveler relationships, and related contact details. | Information you enter or authorize another group member to share. All optional profile fields are optional. |
| Trip and collaboration data | Destinations, dates, flights, lodging, activities, transportation, itineraries, notes, packing lists, expenses, payments recorded in a shared ledger, comments, chat, reactions, presence, invitations, and follow codes. | Information you create, upload, receive through collaboration, or import. |
| Public blog reactions | The emoji you choose, the public blog day, note, photo, or video you react to, a random identifier stored in your browser for that blog, and the time of the reaction. Your IP address is used to rate-limit reaction requests. The identifier is not an account or advertising identifier. | Only when you react on a public blog. It lets you change or remove that browser's reaction on a return visit. |
| Imported and uploaded content | Documents, PDFs, images and videos you choose to upload or share into the app, emails, email headers and bodies, attachments, extracted travel details, filenames, source metadata, and review history. | Manual uploads, the photo picker, sharing from another app, forwarded email, and optional Gmail import. We only access photos or videos you select or share; we do not use your camera or browse your photo library. |
| Gmail and Google data | Read-only inbox messages and attachments within the authorized scope, the connected Google account address, OAuth tokens, token status, and import history. | Only after you authorize Gmail access and while the connection remains enabled. |
| Billing and transaction data | Stripe customer, subscription, invoice, tax, payment status, plan, entitlement, and webhook identifiers. Payment-card details are handled by Stripe rather than stored by WanderBunnies. | Subscription checkout, billing management, and payment events. |
| Necessary technical and security data | IP address, user-agent, device or app information, timestamps, request and error logs, security events, and server-side error reports. | Use of the Service. Needed to run, secure and fix the Service; not optional. |
| Push notification tokens | A device push token (encrypted before storage) and notification preferences. | When you allow notifications on a mobile device. Removed when you sign out of that device or delete your account. |
| Service usage and cost metering | Which features used paid services (such as AI providers or maps), the units used, and the estimated cost, linked to your account and trip. | Automatically when you use those features. Used to enforce plan limits and manage our costs; linkage to you is removed after 13 months. |
| Optional product analytics (only if you turn it on) | Which features you view and use, task outcomes, session timing, platform, app version and browser family, and whether activity happened before, during or after a trip's scheduled dates. Linked to a random pseudonym for your account. | Only after you opt in under Account → Privacy. Never your location, messages, trip text, or imported content. |
| Optional detailed diagnostics (only if you turn it on) | App crash reports, performance timings (such as how long trips and pages take to load) and session health, linked to a random pseudonym for your account. | Only after you opt in under Account → Privacy. Sent to Sentry. |
| Affiliate and external-link data | Selected activity or destination parameters, an affiliate redirect token, referral/click information, and technical data received when an external link is opened. | When an eligible GetYourGuide or other partner link is requested or opened. |
Do not upload passports, government identification, payment-card numbers, health information, or other sensitive information unless the feature specifically requires it and you have authority to do so. Travel documents may incidentally contain sensitive personal data belonging to you or other people.
| Purpose | Legal basis used where GDPR applies |
|---|---|
| Create and secure accounts, authenticate users, confirm the minimum age, provide itineraries, collaboration, import, chat, notifications, support, and requested features. | Performance of a contract; steps at your request before entering a contract. |
| Process Gmail connections, imports, uploads, extraction, and review workflows. | Performance of a contract; consent where applicable to an optional connected-account or import feature. |
| Process subscriptions, taxes, invoices, refunds, fraud checks, and payment disputes; keep billing records. | Performance of a contract and compliance with legal obligations. |
| Enforce plan limits and quotas, and meter the cost of paid services per account and trip. | Performance of a contract (plan limits) and legitimate interests (managing service costs). |
| Operate, maintain, secure, debug, prevent abuse, and keep server-side error reports and security logs. | Legitimate interests, balanced against your rights and expectations; legal obligation where applicable. |
| Save a public blog reaction and let the same browser change or remove it. | Legitimate interests in providing the interaction you request and preventing abuse, balanced against the small amount of data used and your ability to remove the reaction. |
| Send service, security, billing, and account notices. | Performance of a contract or legitimate interests. Marketing messages require consent where required. |
| Generate AI-assisted itineraries, extraction results, summaries, and recommendations. | Performance of a contract or your request for the feature; consent where a separate optional processing activity requires it. |
| Optional product analytics: understand which features are valuable and improve them. | Consent. Off unless you opt in; you can withdraw at any time. |
| Optional detailed diagnostics: find and fix crashes and slow screens in the app. | Consent. Off unless you opt in; you can withdraw at any time. |
Where we rely on legitimate interests, those interests include service security, fraud prevention, troubleshooting, product reliability, cost management, and responsible administration. You may object to processing based on legitimate interests (see section 11); we will assess each objection and stop unless we have compelling legitimate grounds, such as security.
Both are off unless you turn them on, and each is a separate choice. Refusing either one does not change any trip-planning feature or your price.
You can change either choice at any time under Account → Privacy or from the Your Privacy Choices page. Withdrawing stops collection immediately. To also erase what was already collected, use Delete analytics data in Account → Privacy. If your browser sends a Global Privacy Control or Do Not Track signal, product analytics stays off in that browser. If we materially change what these features collect or why, we will ask you again rather than assume your earlier choice still applies.
WanderBunnies may use configured AI providers, which may include OpenAI, Anthropic, Google Gemini, or other providers enabled for a particular feature, to generate itinerary suggestions, parse uploaded travel material, summarize content, or provide chat responses. Depending on the feature, inputs may include destinations, dates, preferences, itinerary text, and relevant uploaded or imported travel content.
AI output can be inaccurate, incomplete, stale, or unsafe. We do not use AI output as a substitute for professional travel, medical, legal, immigration, or emergency advice. We configure providers and contracts to limit use of submitted data to the disclosed service purposes, but provider-specific retention and location may differ; the current provider configuration must be maintained in our internal subprocessor record. Google user data, including Gmail data and data derived from it, is not used to create, train, or improve a generalized artificial-intelligence or machine-learning model.
To check and improve AI quality, we may keep a limited record of AI requests and results, identified only by a salted hash rather than your account. These records are deleted automatically within 30 days.
AI-generated content is labelled where required. You remain responsible for reviewing output before relying on it or sharing it with others.
When you connect Gmail, we request only the permissions needed for the enabled import feature. We use the authorized Gmail data to identify travel-related messages and attachments, extract itinerary information, show import results, and let you review or delete imported data. We do not use Gmail data for advertising, sell it, or use it for unrelated profiling. We do not read messages after you disconnect, except for data already lawfully retained under the retention rules above.
Our use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use Google user data only to provide the user-facing features described in this Notice, such as account authentication and the optional Gmail itinerary-import workflow. Google user data is not used for advertising, sold to data brokers, or used to create, train, or improve a generalized artificial-intelligence or machine-learning model. The OAuth consent screen and this Notice must remain consistent with the actual scopes, storage, processing, sharing, and deletion behavior.
WanderBunnies is collaborative. When you join a group, invite someone, follow a shared trip, or post content in a trip, the information you choose to share may be visible to the relevant members and recipients. You are responsible for obtaining appropriate permission before uploading or sharing another person's information.
We may disclose data to service providers acting under contract, including:
We do not sell Gmail data or use Google user data for advertising. We do not share personal data with affiliate partners merely because you use the Service; an external partner may receive data when you request or open its link.
We and most of our providers process data in the United States. Where data protection law requires it, transfers from the EEA, UK or Switzerland rely on an adequacy decision (including the EU–US Data Privacy Framework for certified providers), the EU Standard Contractual Clauses or UK addendum, or another lawful transfer mechanism, together with appropriate supplementary safeguards. Google Cloud publishes its subprocessor list at cloud.google.com/terms/subprocessors. You may request current information about our other service providers and the transfer mechanism used for each by contacting support@wander-bunnies.com.
We keep information only as long as necessary for the purposes above, to provide the Service, resolve disputes, enforce agreements, maintain security, and meet legal, tax, accounting, or regulatory obligations.
| Data | Retention |
|---|---|
| Account and profile data | While the account is active and until deletion is completed, except for information required for legal, security, fraud-prevention, or dispute purposes. |
| Trip and shared content | Until you or an authorized group member deletes it, the account is deleted, or retention is necessary for a legal or shared-collaboration purpose. Shared content may be retained in de-identified or group-scoped form where needed to preserve another member's trip. |
| Public blog reactions | Until you remove the reaction from the same browser or the associated blog day, post, or trip is deleted. Clearing browser storage removes your ability to identify and remove that reaction from the page; contact us for help with a privacy request. |
| Uploads, imported documents, parsed items, and Gmail data | Until the item is deleted, Gmail is disconnected, the account is deleted, or a shorter feature-specific period ends, subject to legal and security exceptions. |
| OAuth tokens | Until disconnect, expiry, account deletion, or revocation, whichever occurs first. |
| Optional product analytics events | 90 days, then deleted. Summaries linked to your account: up to 13 months. Only collected if you opt in. |
| Optional detailed diagnostics (Sentry) | Expire within 30 days. Only collected if you opt in. |
| AI quality records | Deleted within 30 days. |
| Service usage and cost metering | Linked to your account and trip for up to 13 months; after that only totals per feature and provider remain. |
| Record of your privacy choices | While your account exists and for 3 years after it is deleted, kept under a pseudonymous key, so we can show what you agreed to. |
| Billing and accounting records | For the period required by tax, accounting, consumer-protection, and payment laws (generally 7 years). |
| Security, diagnostic, and audit logs | For the shortest period reasonably necessary to investigate incidents, protect the Service, comply with legal duties, and defend claims. |
| Backups | Until overwritten or securely deleted under the documented backup lifecycle. |
Depending on where you live and subject to legal exceptions, you have the following rights regarding your personal data:
Deletion may not remove information that another user lawfully contributed to a shared trip or information we must retain by law; when you delete your account we tell you what is retained and why.
Submit other requests to support@wander-bunnies.com. We respond within one month under the GDPR and UK GDPR (extendable by up to two further months for complex requests, in which case we will tell you), or within 45 days under California and similar US state laws (extendable once by 45 days with notice). You may complain to the data-protection authority in your country of residence, place of work, or the alleged infringement.
We use administrative, technical, and organizational safeguards appropriate to the risks, including access controls, encryption in transit, encryption of sensitive tokens at rest, provider security controls, authentication protections, logging, rate limits, and incident-response procedures. No system is completely secure. If we identify a data breach that legally requires notification, we will notify affected people and authorities as required.
Accounts require age 16 or older everywhere; we confirm this when an account is created or first used. A person under 16 may not create or hold an account, and we do not knowingly collect children's personal data through account creation.
An adult account holder may enter travel information for a minor dependent or family member as part of planning a shared trip, such as adding them as a traveler or including their travel documents. The adult submitting that information is responsible for having the authority to provide it and for its accuracy. Minors and other travelers without an account are never subjects of product analytics or diagnostics. If you believe a child has created an account or otherwise provided personal data directly and improperly, contact us so we can investigate and delete it where appropriate.
Residents of California and other US states may have rights to know or access, correct, delete, obtain a portable copy, limit the use of sensitive personal data, opt out of sale, sharing or targeted advertising, appeal a decision about a request, and receive equal service. These rights apply subject to the thresholds, definitions, and exemptions in the relevant law. We do not sell or share personal data for cross-context behavioral advertising. We honor Global Privacy Control as an opt-out signal. To appeal a decision about your request, reply to our response or email support@wander-bunnies.com with "Appeal" in the subject. See Your Privacy Choices.
We may update this Notice to reflect changes to the Service, providers, law, or processing. Each version has a number, an effective date and a summary of what changed. For a material change to optional analytics or diagnostics, we will ask for your choice again rather than assume your earlier choice still applies.
This feature is off by default and only available if you turn it on. If you choose to connect a bank or credit card account to import transactions as trip expenses:
Consumer Terms · Your Privacy Choices · Cookie Notice · Delete your account · Withdrawal Form · Content Moderation and DSA Procedure