Privacy Policy

Effective date: July 28, 2026

This Privacy Policy applies to Dayworthy’s website at dayworthytravel.com and the Dayworthy travel-planning application at app.dayworthytravel.com together (the Services).

Dayworthy is operated from Chihuahua, Chihuahua, Mexico. Privacy correspondence may be sent to support@dayworthytravel.com or to Libertad 1309, Col. Centro, Chihuahua, Chihuahua, Mexico.

Information we handle

The information Dayworthy handles depends on which part of the Services you use.

Marketing website

The marketing website is a static informational site. It does not provide user accounts, process payments, or maintain an application database.

If you use the contact form, we receive your name if you choose to provide it, your email address, the topic you select, and the message you submit. We use that information to receive, route, manage, and respond to your communication and, where reasonably necessary, maintain relevant correspondence, resolve disputes, comply with legal obligations, or protect legitimate rights and interests.

We do not currently use contact-form submissions to enroll you in newsletters, enrich advertising profiles, train AI models, or build behavioral profiles. If Dayworthy later offers a newsletter or other marketing subscription, enrollment will use a separate, clear signup process.

Account information

The app currently uses Google OAuth for production sign-in. When you sign in, Dayworthy stores your email address and, if provided by Google, your name. Dayworthy does not store your Google password, Google access or refresh tokens, or a Google account identifier for authentication purposes.

Trip, itinerary, and preference information

When you use the app, Dayworthy may store information you provide or create for travel planning, including:

• trip names, destinations, cities, dates, travel party, and travel rhythm;
• travel preferences, interests, tolerances, budget preferences, constraints, must-do items, and other Taste Graph/profile information;
• saved or imported places, notes, source links, addresses, accommodations, bases, and itinerary selections;
• itinerary dates, ordering, planned times, visit durations, and whether a stop has been marked visited;
• flight information and other transportation or travel-logistics information you choose to add;
• pre-trip to-dos and notes;
• feedback you choose to submit; and
• AI-generated recommendations, notes, itinerary content, and related planning outputs.

Please do not place passwords, payment credentials, passport numbers, highly sensitive health information, or other information that is not needed for trip planning into free-text fields.

Precise location during active trips

During an active trip, if you grant location permission through your device or browser, Dayworthy may temporarily process your device’s precise location to show where you are relative to itinerary activities, identify nearby places, and provide location-aware recommendations.

Dayworthy does not maintain a historical record of your precise device location for these features and does not use precise location for advertising or unrelated profiling. Precise location may be included transiently in a request to an AI or places provider when necessary to provide the feature you requested.

Production observability is intended not to retain raw precise coordinates. Dayworthy is implementing additional safeguards so raw latitude/longitude values used for location-aware requests are redacted from persisted logs, diagnostics, and AI archives.

Public itinerary sharing

Trips are private by default. If you deliberately enable public sharing for a trip, Dayworthy creates an opaque sharing link that allows anyone with that link to view the shared itinerary. Disabling sharing makes the link unavailable. Deleting the trip or your account removes the associated public share.

Usage and operational information

The app may record limited operational information needed to operate, secure, debug, and control usage of the Services, such as action type, AI provider/model, token usage, estimated cost, timing, status, and internal identifiers. The app may also retain AI input/output snapshots for product operation and debugging, subject to configured archival and redaction controls.

AI processing

Dayworthy uses AI to generate, review, explain, and improve travel recommendations and itineraries. Relevant trip information, preferences, saved places, prompts, itinerary context, and, when needed for a location-aware feature, transient location context may be sent to our configured AI provider.

Dayworthy currently uses the OpenAI API directly for these functions. Dayworthy may use orchestration software such as LangGraph as part of the application architecture. If a separate hosted tracing or observability service is later enabled for production user data, this Privacy Policy will be reviewed and updated as appropriate before that use.

We do not use contact-form submissions from the marketing website for AI training. Dayworthy does not itself use app trip data to train a general-purpose AI model.

Places and location services

Dayworthy uses Google Places to resolve and enrich place information used for planning. Place names, destination context, and related location queries may be sent to Google when needed to provide those functions.

Cookies, browser storage, and analytics

Marketing website

The marketing website uses one functional cookie, dayworthy_locale, when you actively choose a language or dismiss the language suggestion. Its value is only en or es, it uses SameSite=Lax and Secure over HTTPS, and it lasts approximately one year.

The marketing website also uses session storage under the key dw-collection to remember which homepage photo collection is shown during a visit. It stays in your browser, is not sent to our server, and is cleared when the tab is closed.

Cloudflare Web Analytics is used for cookieless, aggregate traffic measurement and does not use fingerprinting to build visitor profiles.

App

The app uses essential authentication cookies managed by Auth.js/NextAuth, including session, CSRF, and callback cookies, plus first-party local or session storage for product state. The app does not currently use advertising cookies, marketing-attribution cookies, third-party behavioral tracking, or non-essential analytics SDKs.

Because the Services do not currently use non-essential tracking technologies that require consent, Dayworthy does not currently present a tracking-consent banner. If that changes, consent requirements will be reviewed before activation.

For more detail about the marketing website technologies, see our Cookie Policy.

Service providers and international processing

Dayworthy is operated from Mexico and uses service providers that may process information in the United States or other countries where they operate infrastructure. Current providers include:

• Cloudflare — marketing-site hosting, CDN, security infrastructure, cookieless aggregate web analytics, and cloud object storage used by parts of the app infrastructure;
• Web3Forms — marketing-site contact-form processing, spam filtering, and delivery;
• Purelymail — email hosting for the Dayworthy team inbox;
• Railway — hosting and database infrastructure for the Dayworthy app;
• Google — Google OAuth authentication and Google Places services;
• OpenAI — AI processing for itinerary generation, review, explanation, and recommendations; and
• Resend — transactional email and app feedback notifications where enabled.

We provide these services with information only as reasonably necessary for their function or as otherwise required by law.

Contact-form processing

When you submit the marketing-site contact form, the information you provide is sent to Web3Forms for spam filtering and email delivery. Your email address is used as the Reply-To address so we can respond.

The marketing website does not store contact submissions in its own database. Once delivered, the message may remain in our email systems for as long as reasonably necessary to respond, maintain relevant correspondence, resolve disputes, comply with legal obligations, or protect legitimate rights and interests.

Retention and deletion

App information is generally retained while your account remains active and as reasonably necessary to provide the Services, maintain security and integrity, resolve disputes, and comply with legal obligations.

You can permanently delete your account from the app through Profile → Privacy & your data. Account deletion removes the live account and associated user-linked data, including trips, itineraries, saved/imported places, travel logistics, preferences, feedback, AI action records, usage records, public share tokens, and associated user-uploaded avatar data where applicable.

Deleted data may remain temporarily in routine backups until those backups expire. Production PostgreSQL backups are currently retained for up to 14 days. Backup copies are maintained for disaster recovery, not for ordinary product use, and expire according to the backup-retention schedule.

A deleted user may later sign in again and create a new, empty account; deleted account data is not restored to the new account.

Payments

Dayworthy is currently in free public beta and does not currently process payments through the Services. If paid features are introduced, pricing and payment terms will be presented before purchase and this Privacy Policy will be updated to identify the payment processor and relevant data practices before payment processing goes live.

Do Not Track and cross-site tracking

The Services do not track users across unrelated websites for behavioral advertising. Because Dayworthy does not currently engage in that type of tracking, browser Do Not Track signals do not change the Services’ behavior.

Your privacy choices and rights

You may contact us to ask about personal information associated with you, request access to it, request correction of inaccurate information, request deletion or cancellation where applicable, object to certain processing, or ask us to limit its use or disclosure.

For privacy requests, email support@dayworthytravel.com. Please describe the request clearly and provide enough information for us to locate the relevant account, trip, or correspondence. We may request reasonable information necessary to verify your identity or authority to act for another person.

For requests under Mexican data-protection law, including rights of Access, Rectification, Cancellation, and Opposition (ARCO), we will handle the request according to applicable legal procedures and time limits.

Children

The Services are intended as a general travel-planning service and are not specifically directed to children. Dayworthy does not require visitors to provide their age merely to browse the marketing website. If future paid or age-sensitive functionality changes this posture, the policy and product controls will be reviewed.

Security

We use reasonable administrative and technical measures appropriate to the information handled by the Services. Web traffic is transmitted over HTTPS, deployed authentication uses Google OAuth, the app uses bounded authentication sessions, and the Dayworthy email domain uses email-authentication controls. No internet service can guarantee absolute security.

Changes to this Privacy Policy

We may update this Privacy Policy when the Services, providers, or data practices change. The current version will be posted on this page with its effective date. If a change materially affects how we use personal information already collected, we will provide notice appropriate to the nature of the change and applicable law.

Before enabling non-essential tracking, materially different AI/data uses, paid processing, or additional production processors that materially affect personal-data handling, Dayworthy will review whether this Privacy Policy or additional consent is required.

Contact

Privacy questions and requests can be sent through the contact page or by email to support@dayworthytravel.com.

Privacy correspondence may also be sent to:

Libertad 1309, Col. Centro
Chihuahua, Chihuahua, Mexico