Privacy Policy

1. Information we collect

Information you provide

• Account details. When you sign in with Google or with an email sign-in link, we receive and store your email address, and — if available — your name and profile photo. You can edit your display name and upload a custom avatar at any time.
• Travel Personality Quiz responses. The answers you select, the display name you provide, and the personality archetype and dimension scores we derive from them.
• Trip plans and itineraries. Destinations, trip length, group size, and the activities, notes, and edits you create or modify in the planner.
• Travel preferences (optional). Food and drink needs (including whether you avoid alcohol) and allergies, getting-around needs (such as step-free access), your home airports, and any other notes you add to your profile. Some of these may relate to your health. We use them only to shape the plans you make, never show them on a plan, and delete them with your account. You can change or remove them at any time on your profile. On a group trip, only the items you choose to share with that trip reach its planner; the organizer sees how many people share each need, never who.
• Group features.Trip ideas (“Who’s In?” pulse checks), the responses you give (in / maybe / can’t), destination and date votes, and any name you supply when responding without an account.
• Waitlist and contact. An email address you submit to join a waitlist. If you write to us through our contact form, your name, email address and message, which we keep so we can reply, and a one-way hash of your IP address, which we use only to limit spam.

Information collected automatically

• Cookies and similar identifiers. We use a small set of cookies to keep you signed in and to link activity you started before creating an account (see Cookies below).
• Device and usage data.Basic technical information such as browser type and pages visited, handled by our hosting provider as part of operating the Service. We also note the kind of browser you’re using — for example, whether it’s an app’s built-in browser — but not the full details your browser sends. When you ask for an email sign-in link, we keep a record that one was sent to your address and a one-way hash of your IP address, used only to limit abuse. If that browser holds a quiz result or travel map you haven’t saved yet, the link carries a reference to it, so it’s saved to your account whichever browser you open the link in. When you report a page, we keep the report with the same one-way hash of your IP address (or your account, if you are signed in), used only to limit abuse and to review the report.
• Rate-limiting. To prevent abuse of anonymous response forms, we store a one-way cryptographic hash (SHA-256) of your IP address. We do not store your raw IP address for this purpose.

Information from third parties

When you choose to sign in with Google, Google shares your email address and basic profile information with us in accordance with the permissions you grant and Google’s own privacy policy.

2. How we use your information

• Provide, operate, and maintain the Service and your account.
• Generate your travel personality result, compatibility comparisons, and AI-assisted itineraries.
• Power group coordination — pulse checks, voting, and shared trips.
• Send transactional emails, such as sign-in links and trip-related notifications you’ve opted into.
• Maintain security, prevent abuse, debug issues, and improve the Service.
• Comply with legal obligations.

We do not sell your personal information. We use the Meta Pixel and Meta’s Conversions API to measure how our own advertising on Facebook and Instagram performs (for example, that an ad led to a completed quiz or a new account). For that measurement we may share a hashed version of your email address and account identifier, along with your IP address and browser information, with Meta. See Cookies below and Meta’s Privacy Policy.

3. Cookies

We use cookies that are necessary for the Service to function. These include a session cookie that keeps you signed in, and identifiers that let us connect a quiz result or plan you created before signing in to your account once you do (so your work isn’t lost), and that let you return to an anonymous group response you submitted. We also set a first-party visitor identifier (a random value, no personal data) that lets us count, in aggregate, things like how many people who start the quiz finish it and how many come back within a week. With it we note how your first visit arrived — the page you landed on, and the campaign tag on the link if it came from one of our ads — so we can tell which ads bring people who stay. If you came from one of our ads, we also keep a scrambled, one-way copy of the ad’s click reference, so the same click opened in a second browser counts as one visit, not two. It is never shared and never tied to your name.

When you open a link another member shared — a quiz result, a trip, a plan, a map — we set a signed cookie that remembers which link it was, for 30 days. If you then take the quiz or create an account, that is counted for the person who shared the link, as a number on their profile. They never see who you are, and the cookie carries no information about you.

We also use the Meta Pixel, which sets Meta’s _fbp and _fbc cookies to measure our own advertising and to attribute actions on the Service (such as viewing a result, joining the waitlist, or creating an account) to a Meta ad. You can control ad measurement through your Meta ad settings or by blocking these cookies in your browser; the Service works without them.

4. AI-generated itineraries

Our planner uses Anthropic’s Claude API to generate itineraries. When you generate or edit a plan, the relevant inputs (such as your destination, trip length, travel personality, and any travel preferences you’ve saved) are sent to Anthropic to produce the result. Venue suggestions are looked up using the Google Places API. AI-generated content can be inaccurate or incomplete — please verify details such as hours, prices, and availability before relying on them.

5. How we share information

We share information only as described below. We do not sell it.

• Service providers. We use trusted vendors to operate the Service, including Vercel (hosting and avatar storage), Railway (database hosting), Anthropic (AI itinerary generation), Google (sign-in and venue data), and Resend (email delivery). These providers process information on our behalf.
• Other users, when you choose to share. If you share a quiz result, comparison, or plan link, or respond to a group trip, your display name and the shared content are visible to others with that link or in that group.
• Legal and safety. We may disclose information if required by law or to protect the rights, safety, or property of our users, the public, or Clixel Media.
• Business transfers. If Clixel Media is involved in a merger, acquisition, or sale of assets, information may be transferred as part of that transaction.

6. Data retention

We keep your information for as long as your account is active or as needed to provide the Service. You can delete your account at any time (see Your rights), after which we delete or de-identify your personal information, except where we are required to retain it for legal, security, or fraud-prevention purposes.

7. Your rights and choices

• Access and update. You can view and edit your profile information from your account settings.
• Delete your account. You can permanently delete your account and associated personal data from your account settings. When you do, plans you created are disassociated from you or removed.
• Regional rights. Depending on where you live (for example, the EEA/UK under GDPR or California under the CCPA/CPRA), you may have rights to access, correct, delete, or port your information, and to object to or restrict certain processing. To exercise these rights, contact us at hey@weshouldgo.com.

8. Security

We protect information in transit using encryption (HTTPS/TLS) and take reasonable measures to safeguard the data we hold. No method of transmission or storage is completely secure, however, so we cannot guarantee absolute security.

9. Children’s privacy

WeShouldGo is not directed to children under 13 (or the minimum age required in your country), and we do not knowingly collect personal information from them. If you believe a child has provided us information, contact us and we will delete it.

10. International users

We are based in the United States and process information there. If you access the Service from another region, you understand that your information may be transferred to and processed in the United States.

11. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we’ll revise the “Last updated” date above, and for material changes we’ll provide additional notice where appropriate.

12. Contact us

Questions about this policy or your information? Email us at hey@weshouldgo.com.