Privacy Policy

When you create an account:

• Your email address and a password. We never store the password itself, only a securely scrambled (hashed) version of it.
• A security question you pick from our list, and your answer, used to help you reset your password. The answer is scrambled (hashed) the same way as your password, so nobody at Exdatrips can see or read it.
• Your home airport, if you choose one.
• A scrambled code for each device you sign in on, so we can apply the two-device limit per account.

When you use the members’ area:

• Trips you save, like or mark as booked, routes you follow with the bell, and when you last visited (so we can show what’s new).
• Reviews, ratings and photos you choose to post. Reviews and photos are shown publicly on the site with the name you give, so they can be seen by anyone, including search engines and other automated tools. Only share what you’re happy to be public.

When you pay for a membership:

• Your plan, its status and renewal dates. Payments are handled by Stripe; we never see or store your full card details.
• If you joined through a friend’s invite, which member invited you, so the referral credit can be applied.
• A random code stored on your device (not a cookie). It makes sure each device can only use the free trial once, and that a membership is used on no more than 2 devices, as accounts can’t be shared.

When you visit the site:

• Basic visitor statistics: which pages are viewed, how many visitors we have each day and which website sent you to us (for example Google or Facebook). That’s all.
• Technical logs kept by our hosting and security providers, such as IP address and browser type, used to keep the site running and secure. Failed login attempts are also recorded for a short time to block password guessing.

We count visits with our own simple system, built into the site. We don’t use Google Analytics or any other outside analytics service.

• No cookies, and nothing is stored on your device for it.
• Your IP address and browser type are turned into a one-way code mixed with a secret key and the date. Only that code is saved, never the IP address itself.
• The code changes every day, so we can’t recognise you from one day to the next or follow you around the site over time.
• We don’t track you on other websites and don’t share these statistics with anyone.
• We only see totals: visitors and page views per day, the most viewed pages and where visitors came from.

We use this to understand which pages are useful and improve the site (our legitimate interests). Because it can’t identify you, it doesn’t need your consent.

• No Google Analytics, no Meta (Facebook) Pixel and no other third-party tracking, advertising or retargeting tags.
• We don’t sell or rent your personal data, to anyone.
• We don’t share it with partner companies, data brokers or marketing lists. Only the few providers we need to run the site (see “Who we share data with” below).
• We don’t share it with airlines, booking sites or the sources we use to find flights.
• We don’t pass your details to advertisers, track you across other websites or build advertising profiles of you.
• We don’t see or store your card details.
• We don’t send you marketing emails or newsletters you haven’t asked for.
• We don’t use your personal data to train AI models, and we don’t sell insights about you.

We don’t use any tracking or advertising cookies, so there’s no cookie banner to click away.

We only save a few small, strictly necessary items in your browser’s local storage:

• Your login, so you stay signed in.
• The device code, used for the free trial and the 2-device limit, and, if you came through an invite link, the invite code.
• Small display preferences, such as tips you’ve closed and which city guides you’ve already seen.

The site’s fonts are stored on our own servers, so your browser doesn’t connect to Google or any other font service when you visit.

• To provide your account and membership, and the features you use (our contract with you).
• To take payments, apply trials and referral credits, and keep the records accounting law requires (contract and legal obligation).
• To keep the site secure, prevent abuse such as repeated free trials, shared accounts and password guessing, and to count visits so we can improve the site (our legitimate interests).

We don’t use your data for automated decisions that have legal or similarly significant effects on you.

You don’t have to give us any personal data to browse Exdatrips front pages. To create an account we need your email address, name or alias and a password, and to take a membership we need your payment to go through Stripe. Without these we can’t provide an account or membership.

Our staff see as little as possible:

• Only the site owner can open the member list in our admin tools. It shows each member’s email, name, plan, join date and number of saved devices, and is used only to help members with sign-in problems, give free months and remove test or closed accounts. Other staff only see totals, such as how many members we have and how many people visited the site.
• Names are only visible to the public where you post them yourself, on public reviews and photos.
• To help with a request, such as resetting your devices, staff can look up an account only by the email address you give them.
• Nobody at Exdatrips can see your password or your security answer. Both are stored scrambled.
• Only trusted staff have access to our Stripe account, where they can see the name, email and country of the person who paid, and the card brand and last 4 digits. Never the full card number.

We use trusted service providers to run Exdatrips. They only process your data on our instructions and for the purposes above:

• Hosting and database providers, which store the site and its data on servers in the United States.
• Network, security and content-delivery providers, such as Cloudflare, which protect the site and deliver it quickly.
• Stripe, our payment provider, which processes membership payments. Stripe is certified to the highest level of payment-card security (PCI DSS Level 1). Your card details go straight to Stripe and are never seen or stored by Exdatrips. Stripe handles your payment data under its own privacy policy (stripe.com/privacy).
• Unsplash, Pexels and Wikimedia Commons, the photo libraries some of our pictures come from. Those photos load straight from their servers, so your browser connects to them (and they can see your IP address) to show the image. We don’t use them for tracking.
• Our email provider, when you write to us.

When you click through to book, the airline’s own privacy policy applies to anything you give them.

We may disclose data if the law requires it, or to protect our rights, our members or the public.

We keep your account data for as long as you have an account.

When you delete your account, it is permanent and takes effect straight away: your profile, saved and booked trips, likes, followed routes and reviews are deleted, any active membership is cancelled, and your photos are removed from the site.

Some records are kept after that, only as long as necessary: payment and invoice records, for as long as accounting and tax law requires; the free-trial device code and referral records, to prevent misuse of trials and invites; and backups, which are overwritten in the normal course of operation.

Device codes not used for 30 days are cleared automatically. Failed login records are cleared after a short time.

Visitor statistics don’t identify you and may be kept for longer.

You have the right to:

• Be told how we use your data, which is what this policy is for.
• Access the personal data we hold about you and get a copy of it.
• Have inaccurate data corrected.
• Have your data deleted. You can delete your account yourself from your account page.
• Restrict or object to how we use your data, including for our legitimate interests.
• Receive your data in a portable format.

To use any of these rights, email exdatrips@gmail.com. We may ask you to confirm it’s you, and we’ll reply within one month. It’s free.

You also have the right to complain to a data protection authority, for example the one in the EU country where you live or work, or the Information Commissioner’s Office (ICO) in the UK (ico.org.uk).

Our servers are in the United States, so your data is transferred outside the EU and UK. Where this happens we rely on recognised safeguards, such as the EU–US Data Privacy Framework (and its UK extension) or the European Commission’s standard contractual clauses (and the UK equivalents).

Memberships are for people aged 18 or over. We don’t knowingly collect personal data from children. If you think a child has given us their data, contact us and we’ll delete it.

The site uses encrypted connections (HTTPS), passwords and security answers are stored scrambled, repeated wrong logins are blocked, and access to member data is limited. No online service can be completely secure, so please use a strong password that you don’t use anywhere else.

If a personal data breach ever happens, we will act straight away to contain it. Where the law requires it, we will report it to the data protection authority (the Danish Data Protection Agency, Datatilsynet, and the ICO for UK users) within 72 hours of becoming aware of it. We don’t hold sensitive data such as card details, ID documents or health information, so a high-risk breach is unlikely. But if one ever did put you at high risk, we will also tell you directly by email, without undue delay, with what happened and what you can do to protect yourself.

We may update this policy when the site or the law changes. The date at the top shows the latest version. If we make important changes, we’ll make that clear on the site.

Exdatrips (exdatrips.com) is run by Cph publishing & Service ApS, Frederiksborgvej 180, st, 2400 København, Denmark. Cph publishing & Service ApS is the data controller for the personal data described in this policy.

Our UK representative, for UK users only (UK GDPR, Article 27), is Janet Thomasson, 78 Hutton Avenue, Ashton-under-Lyne, OL6 6QZ, England. You can contact her about your data at exdatrips@gmail.com with the subject “For our UK representative”, and she’ll reply with her direct phone number if you have any questions.

We are not required to appoint a Data Protection Officer.

We are registered with the UK Information Commissioner’s Office (ICO). Our registration number is ZC285469.

Questions about your data or this policy, or a request to use your rights? Email us at exdatrips@gmail.com.