Privacy Policy

• Account details — your email address, and (if you use Google sign-in) your name and avatar. We use passwordless sign-in, so we never store a password.
• What you give us to plan — the Instagram Reel and post links you paste, your dates, budget, origin, and free-text preferences, plus the trips and itineraries Astrail generates for you.
• Your travel taste — preferences you tell us during onboarding and ones Astrail infers as you use it (pace, budget, food, neighborhoods), so plans get sharper over time.
• Feedback — ratings, corrections, and messages you send us.
• Technical & usage data — basic logs and request counts needed to run the service, prevent abuse, and enforce limits.

When you paste a Reel or post link, Astrail reads the publicly available content of that post to extract the places mentioned. We do not log into Instagram as you, and we do not access private accounts or content that isn’t public. Only submit links you have the right to share.

To run the planning pipeline (extract places, verify them, build the itinerary), personalize your results, keep your saved trips, respond to feedback, secure the service, and — occasionally — email you about your account or the beta. We do not sell your personal data, and we don’t run ads.

We use a small set of trusted providers to operate Astrail. Each handles only what it needs to:

• Supabase — authentication, database, and file storage
• OpenAI — the AI agents that plan your trip
• Apify — retrieving public reel and post content you link
• Mapbox — maps and geocoding
• Travala — searching hotels near your trip’s places
• mem0 — storing your remembered travel preferences
• Resend — sending account emails
• Vercel, Render, and Cloudflare — hosting and delivery

Astrail’s recommendations are generated by AI from public content and third-party data. We work hard to attach evidence to every stop, but results can still be incomplete or wrong — always confirm key details (hours, prices, safety, bookings) before you rely on them.

You can access, correct, or delete your data. To delete your account, email us at zhihao@astrail.xyz. During the beta we handle deletion requests manually, and we action them within 30 days of your email. Deletion removes your account, saved reels, and generated trips, and erases your remembered preferences (including your mem0 memory). Depending on where you live, you may also have rights under the GDPR or CCPA/CPRA, including the right to access your data and to opt out of any sharing — email the same address and we’ll respond within 30 days.

We use an essential cookie to keep you signed in. We keep any analytics minimal and use it only to understand and improve the beta.

We keep your data while your account is active. When you ask us to delete it, we remove it from our systems within 30 days and instruct our processors to do the same, except where we’re legally required to retain limited records.

Astrail isn’t intended for anyone under 16. If you believe a child has given us data, contact us and we’ll remove it.

As Astrail grows out of beta (including when hotel booking arrives), we’ll update this policy and change the date above. Material changes will be communicated in-app or by email.

Questions about your privacy? Email zhihao@astrail.xyz.