Privacy Policy

Last updated: October 2026

By Sloth ("we", "our", "us") operates the website bysloth.com and its free tools. This policy explains what data we collect, how we use it, and your rights.

What we collect

We collect only what's needed to run the service:

• Account data — if you sign up, we store your email address and a display name you choose. Passwords are managed by Supabase Auth and never stored in plain text.
• Trip data — routes, stops, journal entries, and community notes you create. This lives in your account and is not shared with other users except where you explicitly contribute a public note.
• Email captures — if you enter your email in the free tools' email gate, we store your address and the tool name. We use this only to send the occasional product update. You can unsubscribe at any time.
• Usage analytics — we use PostHog (EU-hosted, posthog.com/privacy) to track anonymised events, and only if you accept analytics (see "Your analytics choice" below). In the app this covers: which tabs and screens you open; whether you run a route search and which optional fields you used (via stop, budget, dates, number of days) and the start and end places you enter (for example "Istanbul" and "Kathmandu"), which we use to learn which routes people want — never your via stops, budget, journal or other text you type; how many stops and legs a route has; and when you save, edit, delete, share, export or publish a trip or start live tracking. We do not record your screen or sessions in the app, and we do not send trip, journal or note text to PostHog. Please enter a city or area rather than a home address when planning a route. No personal identifiers are sent to PostHog unless you are logged in, in which case your user ID (a UUID) may be included.
• Server logs — standard web server logs (IP address, user agent, request URL, timestamp). Retained for 30 days, used only for debugging and abuse prevention.

What we don't collect

• We do not sell your data to anyone.
• We do not use your data to train AI models.
• We do not run advertising. We earn affiliate commissions when you book transport through links in the planner — your click data is not shared with advertisers, only a booking reference with the operator.
• We do not track you across other websites.

Third-party services we use

• Supabase — database and authentication. EU-hosted. supabase.com/privacy
• PostHog — product analytics, EU region. posthog.com/privacy
• Meta Pixel — measures the effectiveness of our Meta (Facebook/Instagram) ads. Loaded only if you accept analytics. facebook.com/privacy/policy
• GitHub Pages — static site hosting. GitHub Privacy Statement
• Google Fonts — fonts loaded from Google's CDN. This shares your IP with Google. Google Privacy Policy
• Place lookup (Photon by Komoot, Open-Meteo) — the names of your route stops are sent from our server, not your browser, to these geocoding services to place the stops on the map. Your IP address is not shared with them. photon.komoot.io, open-meteo.com
• Anthropic API — route suggestions are generated via Claude. Your from/to inputs are sent to Anthropic's API. We do not send personal account information. Anthropic Privacy Policy

Cookies and local storage

We use browser localStorage (not cookies) to store your trip data locally so the planner works without an account. No tracking cookies are set by our domain. If you accept analytics, PostHog stores a random identifier in your browser (in localStorage or a cookie) for analytics continuity — this is not personal data. If you accept analytics, the Meta Pixel may also set its own cookies (such as _fbp) to measure ads. Your accept or decline choice is also kept in localStorage.

Your analytics choice

Analytics are off until you accept. You are asked the first time you visit, and you can change your mind at any time: in the app, open Profile and switch Analytics on or off. Switching it off stops analytics straight away and clears the identifier PostHog stored in your browser. Declining does not limit what you can do in bysloth.

Your rights

If you have an account, you can:

• Export your trip data at any time using the PDF or GPX export buttons
• Withdraw analytics consent at any time from Profile → Analytics in the app
• Delete your account and all associated data by emailing us
• Request a copy of what we hold on you

We aim to respond to data requests within 30 days.

Children

By Sloth is not directed at children under 13. We do not knowingly collect data from children.

Changes

We may update this policy as the product evolves. Material changes will be announced to registered users by email. The date at the top of this page always reflects the latest version.

Contact

Questions about privacy: hello@bysloth.com