Privacy policy

The short version

If you use TravelVerseBD without an account, your map, settings and emergency card stay only in your browser. If you create an account, some data is stored in our database; exactly what, why and for how long is listed below. We use no advertising trackers and no analytics that identify people.

Without an account: only on your device

If you are not logged in, the following live in your browser and are not sent to our server:

• Which districts you marked as visited, wishlist or home, plus preferences such as the map title and colour theme (localStorage, key: ghurobd-travel).
• Your light/dark theme preference (localStorage).
• The name, blood group and health notes on your emergency card, your trusted contacts' names and numbers, your check-in plan and your safety-checklist ticks (localStorage, key: ghurobd-safety).
• When you press “Help near me”, your browser sends one request with your approximate coordinates to OpenStreetMap's Overpass server to find nearby hospitals and police stations. We do not store it.
• Larger items, such as a photo you add as a map background, may be kept in the browser's database (IndexedDB).
• A cookie called gbd_lang that remembers your language for one year. It only contains bn or en.

What is stored when you create an account

• Email, username, display name and preferred language, plus optional extras you add such as home district, bio and interests.
• You sign in with Google only (Firebase Authentication). We store no password; from Google we receive just your verified email and name.
• Login sessions: only a SHA-256 hash of the random token in your cookie is stored, with its expiry, last-seen time and the first 200 characters of your browser's user-agent. The cookie is httpOnly, lasts 30 days, and in production is named __Host-gbd_session.
• Your marked districts and countries, saved places, trips, journal entries, reviews, comments, and any reports or contribution requests you submit.
• If you create a location-share link: its label, destination, expiry, status and (while sharing) your latest approximate position. Only a hash of the link's secret token is stored.
• An audit log of some important account actions (for example sign-up): who, what and when.
• Phone notifications (only if you switch them on): your browser's push address and keys, so urgent notices can be sent. Switching them off on the Notifications page removes them.
• Community SOS helper mode (only if you switch it on): a rounded area (about 5 km) and the radius you chose. Your exact position is not kept. You can switch it off at any time.
• If you ask for help through Community SOS: the kind of help, your short note, your exact position and the time. Helpers see only the rounded area. Your exact position is shown only to helpers who answered, and only if you choose to give it. A request closes by itself after 3 hours. It is not a replacement for 999.

What other people can see

• Journal entries and trips are private by default. Nobody else sees them unless you share or publish them.
• Reviews and comments are visible to everyone once published, with your username or display name.
• Profile and passport visibility default to “public”, and appearing on the leaderboard is on by default. You can change these in settings.
• Your email is never shown on a public profile.
• Your location is private. We do not collect your device location unless you start a location share in the Safety Center or use Community SOS (switching on helper mode, or asking for help). If you do, only your latest approximate position is kept (to about 100 m, a little finer if you ask for help) — no history — and it is erased when you stop sharing or the link expires. Place coordinates are approximate.

AI features

When you use an AI feature such as the trip drafter or the assistant chat, what you type, plus the minimum context the feature needs, is sent to the AI provider the site is configured with (the app integrates Google's Gen AI SDK). How the provider handles it is described in its own policy.

We do not store the text of your prompts. We only keep usage counts: which feature, which provider and model, success or failure, token counts, how long it took, and your user ID if you were logged in.

Your account has an “AI personalisation” setting (on by default) that controls whether your profile information is given to the AI.

Weather and third parties

When weather is shown, your browser contacts Open-Meteo directly, sending the approximate coordinates of the district. Open-Meteo can see your IP address, as any website you visit can, and handles it under its own policy. Our server is not in the middle of that request.

We do not include scripts from advertisers or tracking companies.

Technical records

• To stop abuse we count requests per time window. For this, a truncated one-way hash of your IP address (or your user ID when logged in) is stored with a counter that resets on schedule. The raw IP address is not stored in our database.
• Visit statistics: to learn how many people come, which pages are read, which country and kind of device they use, and how fast the site loads, we use Vercel Web Analytics and Speed Insights. They use no cookies, do not keep an identifier for you, and do not follow you to other sites. Pages that are personal or whose address carries a secret (account, admin, notepad, journal, trips, location-share and SOS links) are never sent to them.
• The hosting or server platform running the site may keep ordinary request logs. That is outside our application and under the platform's own policy.

Your control

• You can export your data and delete your account from the settings page.
• Deleting your account removes your profile, sessions, marked districts and countries, saved places, trips you own, journal entries, reviews and comments. Records that are not your content (such as AI usage counts and the audit log) may remain without a link to you. If you own a trip that has other members, the trip is deleted too.
• To remove data from anonymous use, clear this site's data in your browser.
• The session cookie lasts 30 days; logging out deletes the session.

Contact and changes

For privacy questions or requests, tell us through the contribute page.

If this policy changes, the date on this page will be updated, and we will describe any significant change here.