privacy

Bregway LLC (losthighway.ai) is the data controller. our registered address will be published here. reach us at contact@losthighway.ai.

only what the product visibly uses:

• account — email address or phone number, and your profile settings.
• your travel content — saved places and lists you import or create, trips, guide sections and host notes you write.
• connected services — location history and similar data only if you explicitly connect a source; you can disconnect at any time.
• usage metering — token counts and request metadata for AI features, to enforce plan limits and billing.
• API keys you bring — stored encrypted (AES-256-GCM); used only to proxy your own requests.
• form submissions — name, email, and message when you contact us or submit a property.

• we don’t sell your data.
• we don’t train AI models on your content.
• we don’t run advertising trackers in the app.

people who open a guest guide link need no account and get no tracking beyond standard server logs. the “unlock” cookie that reveals a guide’s private sections is functional only — it holds a derived token, not personal data, and expires after 30 days.

we use a small set of processors to run the product:

• supabase — authentication, database, file storage
• vercel — hosting and delivery
• anthropic — AI features (itineraries, suggestions)
• mapbox — maps on trips, lists, and guest guides
• google (places API) — place search and autocomplete
• stay22 — affiliate links on marketing pages only
• resend — transactional email for inbound forms (when enabled)

data may be processed in the united states and other countries where these providers operate.

account data lives until you delete your account; deleting it cascades through your places, lists, trips, and guides. form submissions are kept for up to 24 months. to delete your account or exercise any data right, email contact@losthighway.ai— we’ll confirm within 30 days.

you can ask for access to, correction of, export of, or deletion of your personal data. if you’re in a jurisdiction with statutory privacy rights (GDPR, CCPA, or similar), we honor those requests under the same email.

the service is not directed at children under 16. we’ll flag material changes to this policy in the product, and the date at the top moves whenever it changes.