Travel plans are personal. We treat them that way.

Information Ashore handles

Ashore stores the structured information used to operate a trip: destinations, dates, traveler names, itinerary items, notes, estimated costs, booking-readiness labels, import metadata, recommendations, reactions, questions, and recent owner-only undo checkpoints. The booking importer processes uploaded or pasted source material without retaining the original file or raw source text after the request completes. In trip planning and chat, Ashore saves extracted document text and source names privately with your planning session so you can ask follow-up questions. Original uploaded files are not retained.

Private execution records can include tasks, vendor names, contact and booking permissions, budget and deposit limits, refundability and alternate-time rules, booking windows, retry and audit events, confirmation codes, prices, cancellation terms, and evidence sources. This execution record is not included in guest trip pages or guest API responses.

Companions can contribute reactions, reaction reasons, and recommendations without an account. AI planning questions require a completed account introduction. Ashore assigns the browser a random participant identifier so changing a reaction does not inflate group totals.

Owner and participant cookies

Ashore uses essential HTTP-only cookies. Account cookies keep you signed in until you sign out or the session expires. Older, unclaimed trips can use an owner capability cookie; once a trip belongs to an account, that account is required for owner access. A separate participant cookie remembers a companion’s reactions. These cookies are not advertising trackers. Trip-owner and participant cookies are retained for up to one year unless cleared earlier. Legacy planning cookies last up to 90 days.

An owner may create a one-time recovery link for a new browser. Its secret stays in the URL fragment and is returned only once; Ashore stores a cryptographic hash and creation time. Successful recovery consumes the key and rotates owner access, invalidating the prior owner cookie and replacing any previous account association.

Google accounts

Creating plans or booking trips requires a Google account and a short Ashore introduction. Supabase Auth verifies your Google identity and stores your account identifier, name, and email. Ashore uses that identity to save and reopen your plans and bookings across devices. Signing in can associate unclaimed trips proven by this browser’s owner cookies with your account. Signing in does not give Ashore access to your inbox.

Your introduction is stored in Supabase under your account. It can include a preferred name, usual departure city or airport, travel interests, and how you heard about Ashore. These questions may be skipped. We save progress when you continue, so you can finish later or on another device. Travel answers can become editable defaults for future trips; the details you give for a specific trip take priority. Referral answers help us understand how people find Ashore and are not sent to the planning model. You can edit your introduction from Account; account deletion removes this customer profile.

Signing out removes account and trip-owner cookies from this browser, along with locally remembered planning and booking details. It does not delete trips saved to your account. To delete your account, open Account and choose Delete account. After confirmation, Ashore disconnects linked Gmail accounts, removes cards from your trip wallets, and deletes your account, saved trips, chats, imported content, shared links and travel preferences. If a booking or call is in progress, it must finish or be resolved first. A connected-service failure leaves deletion paused and lets you retry from Account. Contact Ashore Support if you need help.

Account deletion does not cancel reservations, recall delivered messages, or delete payment providers’ transaction history. We retain a minimal deletion receipt containing technical account and trip identifiers and timestamps to prevent delayed background tasks from restoring erased data. It contains no chat, imported document, name or email address.

Mobile numbers and text messages

Adding a mobile number at ashore.travel/sms is optional and takes a separate, explicit opt-in: the number alone is not consent, the tick beside it is. We store the number and the moment you agreed, because carriers require proof that you asked to be messaged.

We message you only about trips you have asked Ashore to handle, and we do not send marketing texts. Message frequency varies. Msg & data rates may apply from your carrier. Reply STOP at any time to stop immediately, or HELP for help.

Mobile information will not be shared with third parties or affiliates for marketing or promotional purposes. Text messaging opt-in data is not sold or shared. Your number is passed to our messaging carrier only so far as is needed to deliver the messages you asked for.

Removing your number on that page withdraws consent and deletes both the number and the record of when it was given. Deleting your Ashore account removes them too.

Sharing and visibility

Anyone who receives a trip’s guest link can view its shared itinerary, traveler names, group reaction totals, booking-readiness labels, and recommendations. Guest and friend-link responses do not include the planner’s reusable travel profile or dietary restrictions.

A guest can create a separate, editable copy of a shared trip. A copy keeps the itinerary but receives fresh identities and does not include the original profile, dietary restrictions, traveler list, recommendations, reactions, reaction reasons, or claimed reservations.

How information is used

• Import, generate, refine, save, and display structured itineraries.
• Create and maintain private execution tasks within traveler-defined boundaries.
• Record approvals, retries, booking windows, and reservation evidence without equating an attempt with success.
• Answer questions about a shared trip and summarize group preferences.
• Keep reactions and recommendations consistent across participants.
• Protect owner-only editing and operate, secure, and improve the service.

Ashore processes limited connection information, such as an address supplied by the hosting network, to prevent automated abuse and excessive model usage. Production rate-limit counters use salted cryptographic hashes rather than storing raw client addresses and expire from active use after their short request window.

Ashore does not sell trip or profile data and does not use it for third-party behavioral advertising.

Service providers and external links

The trip planner uses OpenRouter and its configured model providers to interpret your preferences and generate suggestions, with public web research for practical details. Planning sessions can include companion ages, room arrangements, access needs, and the optional explanations you supply. Planning conversations are saved privately with that trip and can be cleared from conversation history. Live voice conversations use OpenAI; dictation uses the configured transcription provider. Ashore does not retain microphone recordings. These details and conversations stay out of the separate shared-plan view. You can delete a planning session from Trip details; inactive sessions expire after 90 days.

While preference memory is on, Ashore can remember a directly supplied departure airport and personal travel tastes for future trips, along with the words they came from. A usual airport is separate from a last-used suggestion. One-trip exceptions, document speakers, dates, trip budgets and other travelers’ details are not automatically added to your profile. Open Your travel defaults in Trip details to edit, remove or pause this memory. Preferences follow your account. Older browser-only preferences can be imported through that control.

Use my location is optional and only requests location when you click it. For nearby-airport suggestions, the coordinates are rounded before being sent to Ashore and Google Maps. Ashore does not save the device coordinates or turn that location into a home airport. You can enter an airport or city instead.

A production deployment may use hosting, database, and AI-model providers to process trip data on Ashore’s behalf. When model-backed planning is enabled, the relevant trip context and prompt may be sent to that configured model provider. Payment credentials and identity documents should never be submitted to the planner.

Files, pasted conversations, and readable Google Docs or Sheets links that you add to planning are treated as private trip sources. When you send an attachment in chat or use it to start a plan, its extracted text becomes part of the context processed through OpenRouter and its configured model providers. The separate web research step receives a public travel question rather than your documents or full conversation.

If a shared ChatGPT or Claude page requires you to interact before importing, you can open a temporary browser hosted by Browser Use. That provider processes the shared page and your interactions in that window. Ashore requests no saved login profile, recording, proxy or automatic CAPTCHA solving for this flow. You complete any required verification yourself and choose when to import the visible conversation. The window closes after import or cancellation and expires after five minutes. Only imported conversation text and its source link are saved with your trip.

Connecting Gmail is optional. Composio manages the Google connection and its authorization tokens for your planning owner identity. The connection requests read-only access: Ashore cannot send, edit or delete your mail through this feature. You enter a search and choose which emails to import; Ashore saves only those selected emails as trip sources. Disconnecting stops future access but does not remove copies you already imported. You can remove an unsent source, clear the conversation and its sources, or delete the planning session. You can connect several Google inboxes, choose which one to search, and disconnect each separately. Deleting one planning session does not disconnect Gmail from your other sessions under the same planning identity. A Gmail connection made before signing in may need to be connected again under your account.

Ashore displays Google Maps place information and, when you open Google reviews, requests a small live review sample for that place. Review text is not saved in your trip or sent to Ashore’s AI review analysis. Reviewer images load from Google when displayed. Google Maps features and content are subject to the Google Maps Additional Terms of Service and Google Privacy Policy. Opening a place or route in Google Maps leaves Ashore.

Google Calendar

Calendar access is a separate choice from signing in or connecting Gmail. With your consent, Ashore connects through Composio using our custom Google application. Composio stores and refreshes the Google authorization; Ashore encrypts its account reference. Google permits access to events on calendars you own. Ashore only adds, updates or removes the itinerary events you explicitly export to your primary calendar, and sends no invitations. Changes to a trip require another calendar update. Disconnecting removes access; events already exported remain in Google Calendar. Google revokes permissions at the application-project level, so disconnecting Calendar or Gmail can also require reconnecting the other for the same Google account.

Saved travel accounts

When Travel accounts is available, you can open a private browser hosted by Browser Use and sign in directly to a travel website. That provider processes the pages and the credentials you enter there, and retains the browser profile, including cookies and storage needed to preserve sign-in. Ashore stores an encrypted reference to that profile under your account. Passwords and verification codes entered in this private browser are not added to your Ashore conversation. We request no browser recording or automatic CAPTCHA solving for this flow.

If you approve an account rate check, Ashore temporarily copies cookies for that website into a separate browser with restricted network access. Those cookies are not sent to the language model or saved in trip data. Automated rate checks do not authorize purchases. Private verification codes entered in Ashore are sent directly to the bound website field and are not retained in your conversation. A one-time Gmail code check requires your explicit approval and a separately connected inbox; it checks recent sign-in messages for the website and refuses ambiguous or unverified matches.

Choose Save & close to save the connection, or Disconnect to stop access and remove its saved browser profile. Sessions have a limited duration; a website may still require you to sign in again. These connections are not included in shared trips, and an Ashore Google sign-in does not authorize access to Gmail or supplier accounts. Connecting a website does not approve a purchase. Account deletion must disconnect saved travel profiles before removing your account; if the provider is unavailable, deletion pauses for a retry. Removing the connection does not delete your account with the travel website or cancel reservations.

Support and quality review

Authorized Ashore operators may review saved conversations and search results to investigate problems, support your trip, and check service quality. This access is restricted to configured operator accounts and is logged. The review screen cannot send messages, change your trip, or make bookings on your behalf. Access logs record the operator, conversation reference, purpose, and time, without copying the conversation text.

Retention, access, and deletion

Trip records remain available so planners and companions can return to them. Undo checkpoints are bounded and older checkpoints are discarded as newer planner changes replace them. A planner can permanently delete a trip through Trip settings. That removes the stored itinerary, private execution plan and evidence, active recovery-key hash, profile snapshot, companion-feedback ledgers, recommendations, and undo history, and existing planner, guest, calendar, recommendation, recovery, and execution links stop working.

For access or correction help, or if owner access has been lost, contact Ashore Support. Ashore may retain limited records when reasonably necessary for security, legal obligations, or abuse prevention.

Security and changes

Owner edit tokens are stored as cryptographic hashes, production database access is server-mediated, and private trip surfaces opt out of indexing and caching. No online service can promise perfect security; report a suspected access issue promptly through Support.

If this policy changes materially, the effective date and content on this page will be updated before the new terms apply.

Contact

For privacy requests or questions, use the current contact listed on the Support page.