Legal · Effective 28th July 2026 · Last updated 25th September 2026

Privacy Policy

RPlan (“RPlan,” “we,” “us,” or “our”) operates the trip planning web application available at rplan.org (the “Service”). This Privacy Policy explains what information we collect, how we use it, who we share it with, and the choices available to you.

By using the Service, you acknowledge the practices described in this Privacy Policy.

RPlan is based in the United Kingdom and is the data controller responsible for the personal information described in this policy. The UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 apply to our processing of personal data for all users of the Service, regardless of where you are located. The Service has no geographic access restrictions and is available to users worldwide.

1. Information We Collect

1.1 Information You Provide

This includes:

Trip details, destinations, dates, itinerary notes, and other planning inputs;
Account information: your name, email address, and password (passwords are stored in hashed, non-reversible form and are never stored or visible in plain text);
Communications you send to us (e.g., support emails to contact@rplan.org).

1.2 Information Collected Automatically

When you use the Service, we and our third-party providers may automatically collect:

IP address, browser type, device type, and operating system;
Usage data such as pages visited, features used, and timestamps;
Cookies or similar tracking technologies (see Section 5).

1.3 Location and Place Search Data

When you search for or specify a place within RPlan, the search text you enter is sent from RPlan's server to Google's Geocoding/Places API (using RPlan's own API key) to resolve it into a location. See Section 4.1 for details on exactly what is and isn't shared with Google in this process.

Maps displayed within the app are rendered client-side using Leaflet and MapLibre, loading map tiles directly from OpenFreeMap (and, for the satellite view on shared trip pages, from MapTiler). These requests go directly from your browser to those providers and include your IP address, in the same way loading any image from a third-party server would. See Section 4.1b for details.

We do not collect precise device GPS location unless you explicitly grant location permission through your browser, and only for the purpose of enabling location-based features you request.

2. How We Use Information

We use collected information to:

Provide, operate, and maintain the Service (e.g., displaying maps, saving itineraries);
Improve and troubleshoot the Service;
Respond to support requests sent to contact@rplan.org;
Monitor for abuse, security issues, or violations of our Terms of Service;
Comply with legal obligations.

We do not sell your personal information to third parties, and we do not use your data for targeted advertising.

3. No Guarantee of Data Security

RPlan is a best-effort project. While we take reasonable, commercially practical steps to protect information in our systems, we make no guarantee or warranty regarding the security of any data you submit to or store within the Service.

Specifically:

We do not guarantee that data will be protected against unauthorized access, breach, loss, corruption, or disclosure.
We do not guarantee encryption, redundancy, or backup of stored data beyond whatever measures we choose to implement at our discretion, which may change or be discontinued at any time.
In the event of a data breach, we will make reasonable efforts to notify affected users and comply with applicable legal notification requirements, but we cannot guarantee prevention of such incidents.

You should avoid submitting sensitive personal information (such as financial details, government ID numbers, health information, or similarly sensitive data) into the Service, as it is not designed or warranted to handle such data securely.

4. Third-Party Services

4.1 Google Maps Services (Place Search). When you search for or specify a place within RPlan, RPlan's server sends the place name or search text you enter to Google's Geocoding/Places API, using RPlan's own API key, in order to resolve it to a location and return map/place details.

Only the place search text you enter is sent to Google for this purpose.
This request is made server-to-server from RPlan's backend. Your IP address, device information, account details, or any other personal identifiers are not sent to Google as part of this request.
This data transmission and Google's handling of it are governed by Google's Privacy Policy and the Google Maps Platform Terms of Service, though as the request originates from our server rather than your browser, Google does not receive this as directly identifiable to you.

4.1a Google Maps Link-Outs. RPlan also provides links that take you directly to Google Maps (google.com/maps) for turn-by-turn directions or additional place context. These are ordinary hyperlinks. Clicking them takes you to Google's own website, at which point your interaction is governed entirely by Google's Privacy Policy and Terms of Service, not by RPlan.

4.1b Map Rendering (OpenStreetMap via OpenFreeMap and MapTiler). The maps displayed within RPlan are rendered client-side using the open-source Leaflet and MapLibre libraries, using map tiles provided by OpenFreeMap, built on OpenStreetMap data. The satellite view on shared trip pages uses imagery provided by MapTiler. Attribution (OpenFreeMap, © OpenMapTiles, © OpenStreetMap contributors, or © MapTiler for satellite imagery) is displayed directly on the map.

Unlike the Google Places request described above, your browser loads these map tiles directly from OpenFreeMap's servers (or MapTiler's, for satellite imagery) as you pan and zoom the map. This means your IP address and basic browser information are sent directly to OpenFreeMap or MapTiler, in the same way they would be sent to any website or image server you load content from. RPlan does not add any additional personal data to these tile requests, but we do not control, and are not responsible for, how these providers process this incidental request data on their end.

4.2 Hosting and Infrastructure Providers. We may use third-party hosting, database, or infrastructure providers to operate the Service. These providers may process data on our behalf under their own security and privacy practices.

4.3 Analytics. We use Google Analytics to understand how visitors use the Service (e.g., pages viewed, session duration, general geographic region, device/browser type). Google Analytics collects data via cookies and similar technologies as described in Section 1.2 and Section 5. This data is processed by Google in accordance with the Google Privacy Policy. You can opt out of Google Analytics tracking using the Google Analytics Opt-out Browser Add-on or by adjusting your cookie preferences (see Section 5).

4.4 AI Assistant (OpenAI). If you use the optional AI assistant (available on RPlan Pro), a snapshot of the relevant trip data - such as your plan labels, checklist items, and packing item names for the trip you are working on - is sent from RPlan's server to OpenAI, using RPlan's own API key, so that a suggestion can be generated and returned to you.

Only the trip data needed to answer your request is sent, together with the message you type. Your account credentials and payment details are never sent.
The request is made server-to-server from RPlan's backend, so your IP address and browser information are not sent to OpenAI as part of it.
OpenAI's processing of this data is governed by OpenAI's policies. Per OpenAI's API terms, data submitted via the API is not used to train their models.
The assistant is off-limits to free accounts, is on by default for Pro accounts, and can be turned off at any time in your account settings. When off, no trip data is sent to OpenAI.

4.4 No Sale of Data. We do not sell, rent, or trade your personal information to third parties for their own marketing purposes.

5. Cookies and Tracking Technologies

We may use cookies or similar technologies (such as local storage) to:

Keep you logged in, if accounts are supported;
Remember your saved trips or preferences;
Understand aggregate usage of the Service.

Google Maps Platform and any analytics providers we use may also set their own cookies subject to their respective policies. You can control cookies through your browser settings, though disabling cookies may limit some functionality of the Service.

6. Data Retention

We retain your information for as long as necessary to provide the Service or as required by law. Because the Service operates on a best-effort basis:

Saved trips, account data, or other User Content may be deleted, lost, or become inaccessible due to technical issues, service changes, or discontinuation of the Service, without notice;
We do not guarantee any specific retention period or backup availability.

If you wish to have your data deleted, you may contact us at contact@rplan.org, and we will make reasonable efforts to honor such requests, subject to legal or technical constraints.

7. Your Rights and Choices

Because RPlan is based in the UK and subject to the UK GDPR, all users of the Service, regardless of location, have the following rights regarding their personal data:

Access: request a copy of the personal information we hold about you;
Rectification: request correction of inaccurate or incomplete data;
Erasure: request deletion of your data (“right to be forgotten”);
Restriction: request that we limit how we process your data in certain circumstances;
Portability: request a copy of your data in a structured, commonly used, machine-readable format;
Objection: object to processing based on our legitimate interests;
Withdraw consent: where processing is based on consent, withdraw it at any time without affecting prior lawful processing.

If you are located outside the UK, you may also have additional rights under your own local data protection laws (for example, the GDPR in the EU/EEA, or the CCPA/CPRA in California); those rights are provided in addition to, not instead of, the UK GDPR rights above.

Legal basis for processing. We process your account and trip data on the basis of our contract with you (providing the Service you signed up for) and our legitimate interest in operating and improving the Service. Google Analytics data is processed on the basis of your consent, which you can withdraw at any time via your cookie preferences.

To exercise any of these rights, contact us at contact@rplan.org. We will respond within one month, as required under the UK GDPR (extendable by a further two months for complex requests, with notice to you). You also have the right to lodge a complaint with the UK's data protection supervisory authority, the Information Commissioner's Office (ICO) (ico.org.uk).

8. Children's Privacy

The Service is not directed at children and is not intended for use by anyone under the age of 13, which is the minimum age of digital consent under UK data protection law. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal information, please contact us at contact@rplan.org and we will take steps to delete such information promptly.

9. International Data Transfers

RPlan is based in the United Kingdom. Because the Service is available worldwide with no geographic restrictions, your information will be transferred to and processed in the UK regardless of where you access the Service from.

Where we or our service providers (such as Google, for Google Maps Platform and Google Analytics) transfer personal data outside the UK, such transfers are carried out in accordance with UK data protection law, including reliance on the UK International Data Transfer Agreement (IDTA), UK adequacy regulations, or other approved transfer mechanisms, as applicable to each provider.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Changes will be reflected by updating the “Last Updated” date above. Continued use of the Service after changes take effect constitutes acceptance of the revised policy.

11. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or your data, contact us at: contact@rplan.org