Effective Date: July 18, 2026
Last Updated: July 18, 2026
RPlan ("RPlan," "we," "us," or "our") operates the free trip planning web application available at rplan.org (the "Service"). This Privacy Policy explains what information we collect, how we use it, who we share it with, and the choices available to you.
By using the Service, you acknowledge the practices described in this Privacy Policy.
RPlan is hosted in France and is the data controller responsible for the personal information described in this policy. As RPlan is hosted in the EU, the General Data Protection Regulation (GDPR) applies to our processing of personal data for all users of the Service, regardless of where you are located. The Service has no geographic access restrictions and is available to users worldwide.
1. Information We Collect
1.1 Information You Provide This includes:
- Trip details, destinations, dates, itinerary notes, and other planning inputs;
- Account information: your name, email address, and password (passwords are stored in hashed, non-reversible form and are never stored or visible in plain text);
- Communications you send to us (e.g., support emails to contact@rplan.org).
1.2 Information Collected Automatically When you use the Service, we and our third-party providers may automatically collect:
- IP address, browser type, device type, and operating system;
- Usage data such as pages visited, features used, and timestamps;
- Cookies or similar tracking technologies (see Section 5).
1.3 Location and Place Search Data When you search for or specify a place within RPlan, the search text you enter is sent from RPlan's server to Google's Geocoding/Places API (using RPlan's own API key) to resolve it into a location. See Section 4.1 for details on exactly what is and isn't shared with Google in this process.
Maps displayed within the app are rendered client-side using Leaflet, loading map tiles directly from MapTiler. These requests go directly from your browser to MapTiler and include your IP address, in the same way loading any image from a third-party server would. See Section 4.1b for details.
We do not collect precise device GPS location unless you explicitly grant location permission through your browser, and only for the purpose of enabling location-based features you request.
2. How We Use Information
We use collected information to:
- Provide, operate, and maintain the Service (e.g., displaying maps, saving itineraries);
- Improve and troubleshoot the Service;
- Respond to support requests sent to contact@rplan.org;
- Monitor for abuse, security issues, or violations of our Terms of Service;
- Comply with legal obligations.
We do not sell your personal information to third parties, and we do not use your data for targeted advertising.
3. No Guarantee of Data Security
RPlan is a free, best-effort project. While we take reasonable, commercially practical steps to protect information in our systems, we make no guarantee or warranty regarding the security of any data you submit to or store within the Service.
Specifically:
- We do not guarantee that data will be protected against unauthorized access, breach, loss, corruption, or disclosure.
- We do not guarantee encryption, redundancy, or backup of stored data beyond whatever measures we choose to implement at our discretion, which may change or be discontinued at any time.
- In the event of a data breach, we will make reasonable efforts to notify affected users and comply with applicable legal notification requirements, but we cannot guarantee prevention of such incidents.
You should avoid submitting sensitive personal information (such as financial details, government ID numbers, health information, or similarly sensitive data) into the Service, as it is not designed or warranted to handle such data securely.
4. Third-Party Services
4.1 Google Maps Services (Place Search). When you search for or specify a place within RPlan, RPlan's server sends the place name or search text you enter to Google's Geocoding/Places API, using RPlan's own API key, in order to resolve it to a location and return map/place details.
- Only the place search text you enter is sent to Google for this purpose.
- This request is made server-to-server from RPlan's backend. Your IP address, device information, account details, or any other personal identifiers are not sent to Google as part of this request.
- This data transmission and Google's handling of it are governed by Google's Privacy Policy and the Google Maps Platform Terms of Service, though as the request originates from our server rather than your browser, Google does not receive this as directly identifiable to you.
4.1a Google Maps Link-Outs. RPlan also provides links that take you directly to Google Maps (google.com/maps) for turn-by-turn directions or additional place context. These are ordinary hyperlinks. Clicking them takes you to Google's own website, at which point your interaction is governed entirely by Google's Privacy Policy and Terms of Service, not by RPlan.
4.1b Map Rendering (OpenStreetMap via MapTiler). The maps displayed within RPlan are rendered client-side using the open-source Leaflet library, using map tiles provided by MapTiler, built on OpenStreetMap data. Attribution (© MapTiler, © OpenStreetMap contributors) is displayed directly on the map.
Unlike the Google Places request described above, your browser loads these map tiles directly from MapTiler's servers as you pan and zoom the map. This means your IP address and basic browser information are sent directly to MapTiler, in the same way they would be sent to any website or image server you load content from. RPlan does not add any additional personal data to these tile requests, but we do not control, and are not responsible for, how MapTiler processes this incidental request data on their end.
4.2 Hosting and Infrastructure Providers. We may use third-party hosting, database, or infrastructure providers to operate the Service. These providers may process data on our behalf under their own security and privacy practices.
4.3 Analytics. We use Google Analytics to understand how visitors use the Service (e.g., pages viewed, session duration, general geographic region, device/browser type). Google Analytics collects data via cookies and similar technologies as described in Section 1.2 and Section 5. This data is processed by Google in accordance with the Google Privacy Policy. You can opt out of Google Analytics tracking using the Google Analytics Opt-out Browser Add-on or by adjusting your cookie preferences (see Section 5).
4.4 No Sale of Data. We do not sell, rent, or trade your personal information to third parties for their own marketing purposes.
5. Cookies and Tracking Technologies
We may use cookies or similar technologies (such as local storage) to:
- Keep you logged in, if accounts are supported;
- Remember your saved trips or preferences;
- Understand aggregate usage of the Service.
Google Maps Platform and any analytics providers we use may also set their own cookies subject to their respective policies. You can control cookies through your browser settings, though disabling cookies may limit some functionality of the Service.
6. Data Retention
We retain your information for as long as necessary to provide the Service or as required by law. Because the Service operates on a best-effort basis:
- Saved trips, account data, or other User Content may be deleted, lost, or become inaccessible due to technical issues, service changes, or discontinuation of the Service, without notice;
- We do not guarantee any specific retention period or backup availability.
If you wish to have your data deleted, you may contact us at contact@rplan.org, and we will make reasonable efforts to honor such requests, subject to legal or technical constraints.
7. Your Rights and Choices
Because RPlan is hosted in France and subject to the GDPR, all users of the Service, regardless of location, have the following rights regarding their personal data:
- Access: request a copy of the personal information we hold about you;
- Rectification: request correction of inaccurate or incomplete data;
- Erasure: request deletion of your data ("right to be forgotten");
- Restriction: request that we limit how we process your data in certain circumstances;
- Portability: request a copy of your data in a structured, commonly used, machine-readable format;
- Objection: object to processing based on our legitimate interests;
- Withdraw consent: where processing is based on consent, withdraw it at any time without affecting prior lawful processing.
If you are located outside the EU/EEA, you may also have additional rights under your own local data protection laws (for example, the CCPA/CPRA in California); those rights are provided in addition to, not instead of, the GDPR rights above.
Legal basis for processing. We process your account and trip data on the basis of our contract with you (providing the Service you signed up for) and our legitimate interest in operating and improving the Service. Google Analytics data is processed on the basis of your consent, which you can withdraw at any time via your cookie preferences.
To exercise any of these rights, contact us at contact@rplan.org. We will respond within one month, as required under the GDPR (extendable by a further two months for complex requests, with notice to you). You also have the right to lodge a complaint with a data protection supervisory authority, including the French data protection authority, the Commission Nationale de l'Informatique et des Libertés (CNIL) (www.cnil.fr), or the supervisory authority in your own EU member state of residence.
8. Children's Privacy
The Service is not directed at children and is not intended for use by anyone under the age of 15, which is the minimum age of digital consent under French and EU law. We do not knowingly collect personal information from children under 15. If you believe a child under 15 has provided us with personal information, please contact us at contact@rplan.org and we will take steps to delete such information promptly.
9. International Data Transfers
RPlan's servers are located in France (EU). Because the Service is available worldwide with no geographic restrictions, your information will be transferred to and processed in France regardless of where you access the Service from.
Where we or our service providers (such as Google, for Google Maps Platform and Google Analytics) transfer personal data outside the European Economic Area (EEA), such transfers are carried out in accordance with GDPR requirements, including reliance on the European Commission's Standard Contractual Clauses, adequacy decisions, or other approved transfer mechanisms, as applicable to each provider.
10. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. Changes will be reflected by updating the "Last Updated" date above. Continued use of the Service after changes take effect constitutes acceptance of the revised policy.
11. Contact Us
If you have questions, concerns, or requests regarding this Privacy Policy or your data, contact us at: