Privacy Policy

The short version: your recs are private by default, we collect only what the product needs, we don't sell your personal information, and we don't use advertising trackers. The data controller is Product Tonic LLC (Delaware, USA) — reachable at hello@recs.travel.

1. What we collect

Account data: email address, display name, optional photo, home city, and bio. Content: the recommendations, notes, trips, and asks you create, and who you share them with. Usage data: product events (e.g., saves, shares, going-confirmations) tied to your account so the product works, plus aggregate, cookieless analytics (Vercel Analytics). Payment data: if you subscribe to Recs Pro, Stripe processes your payment — we receive your subscription status and a customer reference, never your card number. Approximate location: only if you grant it, only in-browser, to sort nearby picks; we don't store a location history.

2. Why we process it (legal bases under GDPR)

To provide the Service (contract): running your account, showing your lists to the people you share them with, sending notifications you trigger, processing subscriptions. To improve and secure the Service (legitimate interest): aggregate usage analytics, error monitoring, abuse prevention. With your consent: optional things like browser location and product emails you can opt out of. We don't use automated decision-making that produces legal effects.

3. Who can see your recs

Only the people you share a link with, people whose asks you answer, and viewers of public share pages you choose to create. There are no public profiles and no browsing of other people's lists. Venue contacts you add privately are visible only to you.

4. Service providers (processors)

We use a small set of providers, each processing data only to serve Recs: Supabase (database & authentication), Vercel (hosting & cookieless analytics), Stripe (payments), Resend (transactional email), Google (place search, photos, and sign-in where you choose it), and Sentry (error monitoring). We don't sell or rent personal information to anyone, and we don't share it with advertisers.

5. International transfers

Recs is operated from the United States and our providers store data primarily in the US. For EU/EEA users, transfers rely on our providers' EU-approved safeguards (EU–US Data Privacy Framework certification and/or Standard Contractual Clauses).

6. Retention

We keep your data while your account is active. When you delete your account (Profile → Delete account), your profile, recs, trips, and shares are deleted. Payment records are retained as required by tax and accounting law. Backups purge on a rolling basis.

7. Your rights — everyone

Access, correct, export, or delete your data anytime: most of it directly in the app, everything else via hello@recs.travel. We respond within 30 days.

8. EU/EEA & UK users (GDPR)

You additionally have the rights to restrict or object to processing, to data portability, and to withdraw consent at any time without affecting prior processing. If you believe we've mishandled your data, you can lodge a complaint with your local supervisory authority — though we'd appreciate the chance to fix it first at hello@recs.travel.

9. California residents (CCPA/CPRA)

You have the rights to know, correct, and delete the personal information we hold about you, and the right to non-discrimination for exercising them. We do not sell or “share” personal information as defined by the CCPA/CPRA, and we don't use or disclose sensitive personal information beyond providing the Service — so there's nothing to opt out of. Exercise any right via hello@recs.travel or in-app; we verify requests by confirming control of the account email. Authorized agents may submit requests the same way.

10. Cookies

We use only strictly necessary cookies (keeping you signed in). Our analytics are cookieless and aggregate. No advertising or cross-site tracking cookies — which is why you don't see a cookie banner.

11. Children

Recs is not directed to children and requires users to be at least 16. If we learn we hold data of a child under 16, we'll delete it — tell us at hello@recs.travel.

12. Changes

If we materially change this policy, we'll notify you by email or in-app before the change takes effect. The effective date above always reflects the current version.

13. Contact

Product Tonic LLC · hello@recs.travel