Privacy policy

• Your email address. That's the whole account — there is no password to store, because signing in is a link we email you. Supabase's auth table also keeps the timestamps of your sign-ins.
• The plans engineered for you, and the inputs behind them: city, date, part of day, budget tier, moods, how long you had, and how you were getting around. A plan row is linked to your account so it can appear on your nights.
• Your purchases. Which plan, when, how much, and the Creem order and checkout IDs so a payment can be traced back if something goes wrong. Never any card data — see section 3.
• Ratings and notes you write on a night you bought, and — if you publish a plan — the display name, handle and pitch you chose. Those are public by design; that is the point of publishing.
• One row per generation attempt for cost and quality: the model used, token counts, how long it took, whether it worked, the city, and a hash of the inputs. This is how we know a plan cost $0.012 and how we stop the same request burning the budget twice.

The planner lets you add a sentence in your own words (“it's our fifth anniversary and she hates heights”). That line is the most personal thing on the site, so it is handled differently from everything else:

• Before it leaves our server, URLs, email addresses, phone numbers and invisible characters are stripped out and it is capped at 280 characters.
• It is sent to Google's Gemini API as part of the prompt that composes your plan.
• It is never written to our database. There is no column for it. What we keep is a hash of your inputs and one word — applied, partially applied, ignored or empty — describing whether the note could be used.
• Its effect survives, of course: the plan's prose was written with it in mind. If that matters to you, don't put anything in the note you wouldn't want in the plan.

Five companies are involved in running this. Each gets the minimum it needs to do its job, and none of them get the lot:

• Supabase — the database and the authentication, hosted in the EU (eu-west-3). This is where everything in section 1 lives.
• Creem — payments, as merchant of record. They receive your email and the amount, and they handle the card. Card numbers never reach our servers. Creem issues your receipt and invoice.
• Google (Gemini API) — composes the plan. It receives the city, the venue shortlist, the sky data and your sanitised note. It does not receive your email or your account ID. We are on a paid tier, where Google's terms state prompts are not used to improve their products.
• PostHog — product analytics, EU region, in cookieless mode (section 4). Once you sign in it receives your account ID and email so a funnel isn't split in half at the login step.
• Resend — delivers the sign-in email. It sees your address and the link.

The site itself runs on a single machine we administer, behind Caddy, in Google Cloud's us-central1 region. The other services a plan touches — OpenStreetMap, Open-Meteo, GeoNames, Wikimedia Commons, CARTO and Google Places — are asked about places, never about people. No personal data is sent to any of them.

One cookie. It holds your sign-in session, it exists because you asked to be signed in, and without it the site cannot know who you are. That is a strictly necessary cookie, which is why there is no consent dialog in front of it.

Analytics is configured with memory persistence: no cookie, no localStorage, nothing that survives a page load. The honest cost of that choice is ours to bear, not yours — every full page load starts a fresh anonymous identity, so our own funnel numbers are worse than they could be. We decided that was a better trade than putting a consent wall in front of a date planner.

We also keep your chosen mood and part-of-day in sessionStorage so the page stays the colour you picked while you browse. It is deleted when you close the tab and it never leaves your device.

Under the GDPR you can ask for a copy of your data, ask us to correct it, ask us to delete it, or object to us processing it. Email hello@d8way.com from the address on the account and we'll do it within 30 days — realistically the same week, since there aren't many of you yet.

What deletion actually does, since “we will delete your data” is the easiest sentence in the world to write and not mean. Deleting the account removes, automatically and immediately: your profile, your purchase records, your ratings and blurbs, and every generation-log row. Those are wired to cascade off the auth record, so they cannot be forgotten.

Your plans go too, and that is now automatic. Every night you engineered and never published is deleted with the account, along with its stops — it was personal data and nothing else, and nobody but you could ever see it. This used to be a manual step we promised to remember; it is a database trigger now, so it cannot be forgotten.

The one exception is a night you chose to publish and somebody bought. Our Terms say an unlock is permanent, and honouring that means the plan stays up. What goes is you: it is detached from your account, your display name becomes “a former d8way local”, your handle is replaced with an opaque string nobody can trace back to you, and the line you wrote about yourself is removed. The night survives for the people who paid for it; your name does not.

One thing we can't make disappear, and won't pretend otherwise: the transaction records Creem must keep to satisfy tax and accounting law. Those are theirs to hold, not ours to delete.

Retention. Account data stays as long as the account does. We do not run a job that expires dormant accounts, and we're telling you that rather than implying a cleanup that doesn't exist — if you want yours gone, one email does it.

We're a small operation in Greece and we don't have a Data Protection Officer, because at this size the law doesn't require one. The same address reaches the person who wrote the schema. You can also complain to the Hellenic Data Protection Authority, or to your own country's regulator.

• We don't sell personal data. Not to advertisers, not to venues, not as an “anonymised dataset”.
• We don't track you across other websites. There are no third-party ad pixels, no Meta or Google tags, no fingerprinting.
• We don't read your location from your device. The city in a plan is the one you typed.
• We don't email you things you didn't ask for. The only mail we send is your sign-in link; receipts come from Creem. There is no newsletter to unsubscribe from.