Privacy

Updated 6 October 2026. Aeolus is a free public travel-planning pilot.

Accounts and saved journeys

You can see planning basics before signing in. Creating an account lets you save and research private journeys. Supabase handles account identity, email sign-in links and Google sign-in. Aeolus stores your journey brief, preferences, notes, research, booking checks and saved plans in its server database. Accounts can access their own journeys.

Your browser keeps an access token in session storage. An HttpOnly secure cookie lets the server restore your session. These support sign-in rather than advertising. Local development previews use a separate local account; they do not create a production account.

Research and booking links

To research your journey, the server sends necessary planning context to configured AI model services and destination or route queries to search, extraction and travel-data providers. Those services process requests under their own terms. Research may contain preferences you supplied; avoid putting passwords, passport numbers or payment details in your brief or chat. Public source evidence can be cached for later research.

Booking links take you to external travel providers with their own privacy and booking terms. Eligible links may earn Aeolus a commission. Booking and payment happen with the provider. Personal booking checks and uploaded confirmations do not establish live provider verification.

Uploaded confirmations

Uploaded confirmations stay in private storage and are available only through your signed-in journey. They expire after 90 days. Removing a confirmation or journey queues its private files for deletion; the storage cleanup worker must finish that removal. File metadata and research can contain personal details from documents you choose to upload.

Exports and deletion

Settings offers an account export including saved journeys and stored confirmations. Treat that download as private. A selected journey summary is a separate download containing only the days and transport you choose; review its titles, places, dates and public citations before sharing it. Downloaded files remain on your device and with anyone you share them with.

Settings also offers account deletion when identity erasure is configured. It requires typing your account email, locks further private planning, erases private journeys and stored files, and then removes your identity. If identity or storage removal fails, retry the deletion. Minimal deletion records and provider accounting needed to settle outstanding costs remain without journey content. Backups may retain earlier data until they expire; restored data must be checked against deletion records before service resumes.

For privacy or deletion help, contact jbyoung12@gmail.com.

Public updates

When you request public updates, we store your email address to tell you about Aeolus. Updates are optional and the public pilot is already open. Joining does not create an account. Public update subscriptions are separate from accounts; deleting an account does not remove a separately requested update subscription. We do not send your email address to our analytics providers.

Error monitoring

When enabled for production, Sentry receives technical error categories, the application release, a random error identifier and limited code file locations. This can include errors in the private workspace. We exclude journey content, account identifiers, email addresses, passwords, tokens, request URLs, headers and bodies. We disable browsing breadcrumbs, session replay, profiling and performance traces. Sentry is inactive until a dedicated Aeolus project is configured. SeeSentry’s privacy policy.

Website analytics

We use Cloudflare Web Analytics to measure traffic and page performance, and PostHog to measure public page visits and clicks into the demo and journey workspace.

These analytics run on our public landing page and demo. The private journey workspace does not load either analytics provider. We do not send trip details, notes, email addresses or account identifiers to these services.

PostHog uses cookieless tracking: it counts visitors using a short-lived server-generated hash instead of storing an analytics cookie. We disable session recordings, automatic interaction capture and person profiles. We strip query strings, URL fragments and referring-page paths from PostHog events. Cloudflare only loads on clean public URLs with safe referrers. Both integrations honor the browser’s Do Not Track setting.

Providers receive network requests and process technical information to deliver their services. See Cloudflare’s privacy policy and PostHog’s privacy policy for their practices.