Privacy Policy

1. Who we are

Roadbook (roadbook.us) is a social road trip planner. Roadbook is a registered trade name of Zentered Studios LLC, a Colorado limited liability company. You can reach us on Bluesky at @roadbook.us, or by email at hello@roadbook.us. See also Support.

2. Information we collect

From your Bluesky / AT Protocol account

When you sign in, we receive your decentralized identifier (DID), handle, display name, and avatar URL from the AT Protocol network. We store all four in our database - your DID identifies your account, and your handle, display name, and avatar are stored so we can render your identity in the app and on public profiles. Each time you sign in, we refresh the stored handle, display name, and avatar from the network.

Account preferences

You may optionally save a preferred vehicle, travel party size, and accommodation tier. These are stored in our database and are visible only to you. We also store a unit preference (miles or kilometers) for every account - it defaults to imperial when you sign up, and you can change it any time in settings. Unlike the other three, your unit preference is shown on your public profile, where it determines whether distances are displayed in miles or kilometers.

Notifications

In settings, you can optionally provide a notification email address and turn on email notifications; we send a one-time email to that address to confirm you own it, then use it for trip-invite, activity, and start-reminder emails as long as notifications stay turned on. Both the address and the toggle are optional - apart from that one confirmation email, we send nothing to that address unless you have confirmed it and left notifications turned on. If you turn on browser push notifications, we store the push subscription your browser registers (a delivery endpoint and two cryptographic keys) so we can send notifications to that browser, and delete it when you remove it in settings.

Subscription and billing

Every account stores a subscription tier (free by default). If you start a paid-subscription checkout, we store a payment-processor customer identifier used to look up your subscription status - see Stripe under Third-party services below for what we send to create that record. A subscription status and an expiration date are stored separately, written only once a subscription actually exists (when Stripe's webhook confirms it), not at the moment checkout starts.

Trip and waypoint data

Content you create - trip names, start dates, waypoint names, categories, notes, GPS coordinates, duration, nightly cost estimates, and visibility settings - is stored in our database on your behalf. Exact coordinates are stored privately; for city and town stops, only the city center is shown in shared or public views, so residential addresses are never exposed to non-owners. Trip dates are treated as private and are never included in our public sitemap or shared with search engines.

Social interactions

Visitor notes you add to a stop are stored with your DID. The note text is visible to anyone who can view that trip, and your handle is shown next to it to the trip's owner, collaborators, and people granted viewer access. Star ratings you leave on a trip are stored with your account and used to calculate that trip's average rating - they are not shown with your handle. A worth-it, fine, or skip verdict you leave on a place is counted anonymously in that place's rating breakdown; a tip you add alongside a verdict is stored and attributed to your Bluesky handle, shown publicly on that place's page.

Collaboration

When you share a trip, we store one of two grant roles linked to each recipient's DID or share token: viewer (read-only) or collaborator (read plus suggest and compose access). The trip owner is not a grant role - it is the account the trip belongs to, and is always distinct from anyone it shares with. Personal notes are visible to you alone; booked-lodging details (confirmation numbers, phone, cost) are visible to the trip owner only - viewers and collaborators do not see them. Check-in and check-out dates on a stop are visible to collaborators but hidden from viewers.

Feedback

The feedback button on Roadbook pages lets you send a message with a category (bug, idea, or confusion). We store the message, the category, the page path you were on (without any query string), the time, and your DID if you are signed in. Signed-out visitors can send feedback too, and then no DID is stored. Only the Roadbook team reads feedback. Feedback is stored without a link to your account record, so account deletion does not remove it. To ask about feedback you sent, email privacy@roadbook.us.

Photos

Premium accounts can upload photos to a stop. We convert each upload to WebP, which discards its metadata (such as camera and GPS location data), and store the result in Cloudflare R2.

MCP usage records

If you connect an external AI assistant through our Model Context Protocol (MCP) integration, we record each tool call: the tool name, how long it took, whether it succeeded, the request and response sizes, your DID, and the client name and version the assistant reports. If the assistant supplies them, we also store its stated intent (free text, up to 2,000 characters), a session identifier, and an agent identifier (up to 200 characters each). We do not record any other arguments of the call.

Roadies applications

If you apply to the Roadbook Roadies creator program on /roadies, we store your name, email address, Bluesky handle (optional), and what you tell us about your trips, plus your account DID if you are signed in. Only the Roadbook team sees applications: they are in our database, and we may get an internal alert email about each one. If you are signed in, we send one confirmation email to the address you entered - we do not verify that address first. Guests get no confirmation email. We use the address only to contact you about the Roadies program. Applications are kept until the Roadies program launches, then deleted, or earlier if you ask. Deleting your account does not delete a Roadies application - to have yours removed, email privacy@roadbook.us.

Session data

We set a browser cookie containing a signed random session id, not your decentralized identifier. The cookie itself expires after 30 days. If the id is tampered with, the signature no longer matches and we reject it. Your account is looked up server-side from the session record it points to, stored in our database, and that record is deleted when you sign out. The session record itself has no separate automatic expiry or prune - if you never sign out, it is retained until you do (or until you sign out everywhere), regardless of the cookie's 30-day limit. We also set a second cookie that remembers your Bluesky handle across sign-ins, kept for 180 days - see Cookies below for details.

3. How we use your data

• Display your trips and itineraries to you and the people you choose to share with.
• Generate AI summaries of places and trips using Google Gemma (via Cloudflare Workers AI). For a trip highlight, we send the trip name and the name and category of each stop.
• Compute drive-time estimates locally on our server from the coordinates already stored for your trip, using straight-line distance and a fixed average-speed assumption - no route coordinates are sent to a third party for this.
• Write an AI draft of a trip journal when a Premium trip owner asks for one. We send the trip name, the stop names, and the owner's private journal entries for that trip to Google Gemma (via Cloudflare Workers AI).
• Check campground availability by sending campground IDs to Recreation.gov.
• Fetch park metadata from the National Park Service and fallback photos from Unsplash, then cache results for 30 days to reduce API calls.
• Send trip-invite, activity, and start-reminder emails to your confirmed notification address, and trip-invite and activity push notifications to browsers where you have push turned on - both only if you have opted in.
• Contact Roadies applicants about the Roadies program at the address they gave, including one confirmation email to a signed-in applicant.
• Authenticate you on return visits.

4. Third-party services

Roadbook relies on the following third-party services. Each has its own privacy policy.

• Mapbox - map rendering, static maps, geocoding, and place search. Coordinates and place queries are sent to Mapbox. mapbox.com/legal/privacy
• Photon (Komoot) - place search and photo location lookup. Place search text, a coordinate near your trip used to rank search results, and the location taken from photos you import are sent to Photon. komoot.com/privacy
• Apple Maps and WeatherKit - place search and stop weather. Place search text and a coordinate near your trip used to rank search results are sent to Apple Maps. A stop's place location and a date range tied to its planned arrival date are sent to WeatherKit. Fetched server-side. apple.com/legal/privacy
• Open Charge Map - EV charger lookup. Stop and place locations, and points between consecutive stops, are sent to Open Charge Map to find nearby chargers. Fetched server-side.
• OpenStreetMap Overpass API - lodging suggestions. A stop's place location is sent to find nearby lodging. Fetched server-side.
• National Weather Service and NIFC (WFIGS) - fire alerts and active wildfires near a stop. A stop's place location is sent to both. Fetched server-side.
• US Census Geocoder - county lookup. When a new place is added, its location is sent to find its US county. Fetched server-side.
• OpenFreeMap - map tiles. Your browser loads the map tiles for the area a map shows from OpenFreeMap.
• AT Protocol / Bluesky - identity and authentication. bsky.social privacy policy
• National Park Service (NPS) - park metadata, fetched server-side only.
• Recreation.gov / RIDB - campground directory and availability, fetched server-side. A stop's place location is sent to find nearby campgrounds. No user credentials are shared.
• Unsplash - fallback waypoint photos, fetched server-side. unsplash.com/privacy
• Cloudflare - hosting (Workers), database (D1), serverless functions, AI inference (Workers AI), photo storage (R2) and image conversion, sending our notification and Roadies emails (Email Service), short-lived rate-limit counters (KV and Durable Objects), and privacy-preserving web analytics. For some requests from signed-out visitors, the counter key is your IP address. cloudflare.com/privacypolicy
• PostHog - product analytics for a small set of named funnel events (sign-in, trip creation, etc.). Cookieless, no session recording, no advertising. Events are identified by your Bluesky DID. We do not send your handle. Data is processed on PostHog's US Cloud. Not loaded for visitors in the EU/EEA or when we cannot determine your country. posthog.com/privacy
• Stripe - payment processor for Roadbook's paid subscription. The first time you start a checkout, we send your account DID to Stripe as customer metadata, and Stripe issues a customer identifier we store on your account. You enter your card on Stripe's checkout page. Stripe processes the payment and holds the card, and no card data reaches Roadbook. Stripe tells us your subscription status and when the current billing period ends, and we store both on your account. You manage or cancel your subscription in Stripe's customer portal, which you open from the billing page. stripe.com/privacy
• External AI assistant (premium, optional) - if you connect an external AI assistant (for example Anthropic, OpenAI, or Google) via our Model Context Protocol (MCP) integration, that assistant reads the trip and private-journal content you grant it, and can write journal drafts on your behalf. The assistant provider is chosen by you and is outside Roadbook's control - your data is governed by that provider's own privacy policy once the assistant reads it.

5. Data sharing

We do not sell your data. Trip visibility is controlled entirely by you:

• Private - visible to you only.
• Friends - visible to anyone with the link, signed in or not.
• Public - visible to anyone with the link, and indexable by search engines via our sitemap. Only public trips with indexing turned on are listed in the sitemap.

6. Data retention

• Your trips, waypoints, comments, and ratings are retained until you delete them or request account deletion.
• A cached AI trip highlight is deleted and regenerated when the trip's stops change. Otherwise it is kept with a long expiry (10 years in our code). Other cached place data expires on its own schedule.
• Feedback, MCP usage records, and rate-limit counters are not tied to account deletion. Rate-limit counters expire on their own, within the length of their rate-limit window.
• OAuth sessions are deleted when you sign out.
• Session records have no separate automatic expiry or prune - if you never sign out, the record is retained until you do (or until you sign out everywhere).
• Your notification email address and push subscriptions are retained until you remove them in settings, or for as long as your account exists; when we process a full account deletion request, we remove both.
• Stripe may retain its customer and payment records under its privacy policy, including for legal, tax and accounting requirements.
• Roadies applications are kept until the Roadies program launches, then deleted, or earlier on request.

7. Your rights

You can delete individual trips and waypoints at any time through the app. There is no delete-account button. To request full account deletion, contact us on Bluesky at @roadbook.us or email privacy@roadbook.us. We process deletion requests by hand. Account deletion removes all trips, waypoints, comments, ratings, session data, your notification email address, and your push subscriptions associated with your DID. It does not remove feedback you sent or MCP usage records, which are stored without a link to your account record. If you have a paid subscription, we cancel it immediately before deleting your account. Deleting your account ends your Premium access, even if time remains in the paid period. You can request a refund within 14 days after any charge by emailing hello@roadbook.us. Stripe may retain its customer and payment records under its privacy policy, including for legal, tax and accounting requirements. A Roadies application is separate from your account: ask us to delete it too.

8. Cookies

We set two cookies. The session cookie holds a signed random session id, not your decentralized identifier, expires after 30 days, and is deleted when you sign out. The second cookie remembers the Bluesky handle you last signed in with, so the sign-in screen can pre-fill it next time - it holds only your public handle, never your DID or an access token, and is signed. It is kept for 180 days. Remembering your handle across sign-ins is the whole point of this cookie, so unlike the session cookie, it is not cleared when you sign out. We do not use tracking cookies, advertising cookies, or any third-party cookies.

9. Analytics

Roadbook uses two privacy-preserving analytics tools and no advertising or cross-site trackers.

Cloudflare Web Analytics

Cookieless, aggregate pageview and referrer data with no per-user identity. Cloudflare excludes EU/EEA visitors automatically.

PostHog

A small set of named product events (for example: signed in, trip created) used to understand where people drop off between sign-up and their first trip. It is cookieless (nothing is stored in your browser), captures no autocaptured clicks, no session recordings, and no advertising data. Events are identified by your Bluesky DID, not your handle, so we can analyze the funnel. PostHog data is processed in the United States. We do not load or send any data to PostHog for visitors in the EU/EEA, or for visitors whose country we cannot determine - the decision is made server-side from your approximate country before any script loads, so no consent prompt is needed.

10. Affiliate links

Some links on our Gear Guide and EV Rigs pages are affiliate links: if you buy something through them, we may earn a small commission at no extra cost to you. Affiliate relationships never influence our picks. We do not share any personally identifiable information with affiliate partners; they may set their own cookies once you click through to their site, governed by their privacy policies.

11. Changes to this policy

We will post any updates here with a revised effective date. Continued use of Roadbook after changes constitutes acceptance of the updated policy.

12. Data controller

The data controller for personal data processed by Roadbook is Zentered Studios LLC, Colorado, USA. For privacy questions or deletion requests, contact us on Bluesky at @roadbook.us or email privacy@roadbook.us.