Dayworthy
ENES

Privacy Policy

Effective date: October 18, 2026

This Privacy Policy applies to Dayworthy’s website at dayworthytravel.com and the Dayworthy travel-planning application at app.dayworthytravel.com together (the Services).

This policy also covers the Dayworthy app for iPhone. The app uses the same account and the same data as the web app at app.dayworthytravel.com, and everything below applies to it.

Dayworthy is operated from Chihuahua, Chihuahua, Mexico. Privacy correspondence may be sent to support@dayworthytravel.com or to Libertad 1309, Col. Centro, Chihuahua, Chihuahua, Mexico.

Information we handle

The information Dayworthy handles depends on which part of the Services you use.

Marketing website

The marketing website is a static informational site. It does not provide user accounts, process payments, or maintain an application database.

If you use the contact form, we receive your name if you choose to provide it, your email address, the topic you select, and the message you submit. We use that information to receive, route, manage, and respond to your communication and, where reasonably necessary, maintain relevant correspondence, resolve disputes, comply with legal obligations, or protect legitimate rights and interests.

We do not currently use contact-form submissions to enroll you in newsletters, enrich advertising profiles, train AI models, or build behavioral profiles. If Dayworthy later offers a newsletter or other marketing subscription, enrollment will use a separate, clear signup process.

Account information

You can sign in with Apple, with Google, or with an email address and password. If you use Sign in with Apple and choose “Hide My Email”, we receive a private relay address from Apple instead of your real one. If you use a password, we store only a secure hash of it, never the password itself.

When you sign in, Dayworthy stores your email address and, if provided by Apple or Google, your name. Dayworthy does not store your Google password, Google access or refresh tokens, or a Google account identifier for authentication purposes.

Trip, itinerary, and preference information

When you use the app, Dayworthy may store information you provide or create for travel planning, including:

If you choose to, you can add a profile photo and save inspiration to a trip: links, notes, and screenshots or photos you pick from your device or share into the app from another app. We store these with your trip so you can see them later. The app accesses your photo library only when you choose a picture.

Please do not place passwords, payment credentials, passport numbers, highly sensitive health information, or other information that is not needed for trip planning into free-text fields.

Precise location during active trips

During an active trip, if you grant location permission through your device or browser, Dayworthy may temporarily process your device’s precise location to show where you are relative to itinerary activities, identify nearby places, and provide location-aware recommendations.

Dayworthy does not maintain a historical record of your precise device location for these features and does not use precise location for advertising or unrelated profiling. Precise location may be included transiently in a request to an AI or places provider when necessary to provide the feature you requested.

Production observability is intended not to retain raw precise coordinates. Dayworthy is implementing additional safeguards so raw latitude/longitude values used for location-aware requests are redacted from persisted logs, diagnostics, and AI archives.

Public itinerary sharing

Trips are private by default. If you deliberately enable public sharing for a trip, Dayworthy creates an opaque sharing link that allows anyone with that link to view the shared itinerary. Disabling sharing makes the link unavailable. Deleting the trip or your account removes the associated public share.

Usage and operational information

The app may record limited operational information needed to operate, secure, debug, and control usage of the Services, such as action type, AI provider/model, token usage, estimated cost, timing, status, and internal identifiers. The app may also retain AI input/output snapshots for product operation and debugging, subject to configured archival and redaction controls.

The app sends crash and error reports to Sentry so we can fix problems. Reports describe what went wrong in the app (for example the device model, operating system version and the screen involved). We do not attach your name or email address to these reports, we strip sign-in codes and web addresses’ details before sending, and reports are not used to identify you.

AI processing

Dayworthy uses AI to generate, review, explain, and improve travel recommendations and itineraries. Relevant trip information, preferences, saved places, prompts, itinerary context, and, when needed for a location-aware feature, transient location context may be sent to our configured AI provider. If you forward a booking email, our AI provider reads it to pull out the booking details.

Dayworthy uses Google (Gemini) and OpenAI for these functions. If a separate hosted tracing or observability service is later enabled for production user data, this Privacy Policy will be reviewed and updated as appropriate before that use.

We do not use contact-form submissions from the marketing website for AI training. Dayworthy does not itself use app trip data to train a general-purpose AI model.

Places and location services

Dayworthy uses Google Places to resolve and enrich place information used for planning. Place names, destination context, and related location queries may be sent to Google when needed to provide those functions.

On iPhone, maps are drawn by Apple Maps. Apple receives the map area being shown, as with any app that shows a map. Directions open in Google Maps or Apple Maps, under their own privacy policies.

Cookies, browser storage, and analytics

Marketing website

The marketing website uses one functional cookie, dayworthy_locale, when you actively choose a language or dismiss the language suggestion. Its value is only en or es, it uses SameSite=Lax and Secure over HTTPS, and it lasts approximately one year.

The marketing website also uses session storage under the key dw-collection to remember which homepage photo collection is shown during a visit. It stays in your browser, is not sent to our server, and is cleared when the tab is closed.

Cloudflare Web Analytics is used for cookieless, aggregate traffic measurement and does not use fingerprinting to build visitor profiles.

App

The app uses essential authentication cookies managed by Auth.js/NextAuth, including session, CSRF, and callback cookies, plus first-party local or session storage for product state. The app does not currently use advertising cookies, third-party behavioral tracking, or non-essential analytics SDKs.

The app also uses one first-party attribution cookie, dw_activation. It is set only when you select the Start planning button on a publicly shared itinerary. It contains the entry point (the shared itinerary) and a random identifier; it does not contain your name, email address, or trip details. It is HttpOnly, uses SameSite=Lax and Secure over HTTPS, and expires after 24 hours. If you create a trip within that time, the cookie is deleted after that trip is created.

We use this cookie to measure, in aggregate, how often that button leads to a newly created trip. When you select it, the app records the entry point, whether you were signed in, and the random identifier. At the time it is recorded, the click record does not include an account ID for the person who selected the button. It is also associated with the shared itinerary; if the shared itinerary or its owner’s account is deleted, that association is removed. If you create a trip while the cookie is present, the app records a matching trip-creation event using the same random identifier; that event is linked to your account. The trip-creation record is a usage record and is removed when you delete your account; click records are retained as described in Retention and deletion.

The planning buttons on the marketing website, such as Start planning or Customize this itinerary, do not set this cookie or any other. When you select one, your browser sends a small form to the app, which records one anonymous count of which button was selected, on which page, and in which language, and then takes you into the app. The record contains no account, cookie, or identifier, and the app does not store your IP address or browser details with it. As with any web request, the app’s servers and hosting provider process the request itself. We use these counts to understand which pages lead people to try Dayworthy.

Dayworthy does not currently present a cookie-consent banner. Before enabling other non-essential tracking technologies, applicable consent requirements will be reviewed.

For more detail about the marketing website technologies, see our Cookie Policy.

Service providers and international processing

Dayworthy is operated from Mexico and uses service providers that may process information in the United States or other countries where they operate infrastructure. Current providers include:

We provide these services with information only as reasonably necessary for their function or as otherwise required by law.

Contact-form processing

When you submit the marketing-site contact form, the information you provide is sent to Web3Forms for spam filtering and email delivery. Your email address is used as the Reply-To address so we can respond.

The marketing website does not store contact submissions in its own database. Once delivered, the message may remain in our email systems for as long as reasonably necessary to respond, maintain relevant correspondence, resolve disputes, comply with legal obligations, or protect legitimate rights and interests.

Retention and deletion

App information is generally retained while your account remains active and as reasonably necessary to provide the Services, maintain security and integrity, resolve disputes, and comply with legal obligations.

You can permanently delete your account from the app through Profile → Privacy & your data. Account deletion removes the live account and associated user-linked data, including trips, itineraries, saved/imported places, travel logistics, preferences, feedback, AI action records, usage records, public share tokens, and associated user-uploaded avatar data where applicable. How to delete your account.

Deleted data may remain temporarily in routine backups until those backups expire. Production PostgreSQL backups are currently retained for about two weeks. Backup copies are maintained for disaster recovery, not for ordinary product use, and expire according to the backup-retention schedule.

Forwarded emails are processed to extract your booking details. Deleting an import or a trip removes that booking data from your Dayworthy account. The original email may remain with Resend for up to 30 days before it is deleted automatically; Resend does not provide an API to delete a received email sooner.

A deleted user may later sign in again and create a new, empty account; deleted account data is not restored to the new account.

Payments

Dayworthy is currently free and does not currently process payments through the Services. If paid features are introduced, pricing and payment terms will be presented before purchase and this Privacy Policy will be updated to identify the payment processor and relevant data practices before payment processing goes live.

Do Not Track and cross-site tracking

The Services do not track users across unrelated websites for behavioral advertising. Because Dayworthy does not currently engage in that type of tracking, browser Do Not Track signals do not change the Services’ behavior. We do not sell your personal information or share it for advertising.

Your privacy choices and rights

You may contact us to ask about personal information associated with you, request access to it, request correction of inaccurate information, request deletion or cancellation where applicable, object to certain processing, or ask us to limit its use or disclosure.

For privacy requests, email support@dayworthytravel.com. Please describe the request clearly and provide enough information for us to locate the relevant account, trip, or correspondence. We may request reasonable information necessary to verify your identity or authority to act for another person.

For requests under Mexican data-protection law, including rights of Access, Rectification, Cancellation, and Opposition (ARCO), we will handle the request according to applicable legal procedures and time limits.

Children

The Services are intended as a general travel-planning service and are not specifically directed to children. Dayworthy does not require visitors to provide their age merely to browse the marketing website. If future paid or age-sensitive functionality changes this posture, the policy and product controls will be reviewed.

Security

We use reasonable administrative and technical measures appropriate to the information handled by the Services. Web traffic is transmitted over HTTPS, sign-in uses Apple, Google, or email and password (stored only as a secure hash), the app uses bounded authentication sessions, and the Dayworthy email domain uses email-authentication controls. No internet service can guarantee absolute security.

Changes to this Privacy Policy

We may update this Privacy Policy when the Services, providers, or data practices change. The current version will be posted on this page with its effective date. If a change materially affects how we use personal information already collected, we will provide notice appropriate to the nature of the change and applicable law.

Before enabling non-essential tracking, materially different AI/data uses, paid processing, or additional production processors that materially affect personal-data handling, Dayworthy will review whether this Privacy Policy or additional consent is required.

Contact

Privacy questions and requests can be sent through the contact page or by email to support@dayworthytravel.com.

Privacy correspondence may also be sent to:

Libertad 1309, Col. Centro
Chihuahua, Chihuahua, Mexico