Privacy notice

This notice explains what personal data Offskies collects, why, and what rights you have over it. It covers both browsing the site and using the full planning app once you have an account. We are the “data controller” for this data under UK data protection law.

1. Who we are. Offskies (“we”, “us”, “our”) is a gap-year planning tool operated in the United Kingdom. You can reach us about anything in this notice, including any request about your data, at hello@offskies.co.uk. If we ever need a formal registered contact for you, it will be given at that address.

2. The short version. We collect the email you sign in with, the trip plans you build, anything you choose to upload or share, and a small amount of anonymous usage data so we can see how the site is doing. We use it to run the Service and keep it working for you. We don’t sell your data, we don’t hand it to advertisers, and you can ask us to delete it at any time.

3. What we collect and why.

Account and sign-in. Your email address and, if you create one, your username. You can sign in with an emailed “magic link” or with a password you choose to set; passwords are stored in securely hashed form by our authentication provider and we never see them in plain text. When you first join we also note whether you told us you’re a traveller or a parent. We need this to give you an account and let you sign in (lawful basis: performance of our contract with you).

Your plans. The trips you build in the app: destinations and routes, rough budgets, travel dates, interests, checklists, packing lists and deadline reminders. This is the core of what the Service does, and it syncs across your devices so you can pick up where you left off (lawful basis: performance of our contract).

Documents you upload (the vault). If you use the document vault, you can upload copies of things like your passport, travel insurance, visa confirmations and tickets. These can contain sensitive identity information, so we treat them with extra care: they’re held in private, access-controlled storage that only you can reach from your signed-in account, and we don’t use them for anything other than showing them back to you. You choose what to upload, and you can delete any file at any time. We recommend you only upload what you actually need on your trip (lawful basis: performance of our contract; we process this information only on your instructions and because you’ve chosen to store it with us).

Travel groups (planning with your mates). If you create or join a group, other members of that group can see your username, your shared checklist items, expenses you add to the shared cost split, messages you post in the group chat, links you share, and a progress indicator for your own planning. Only people in your group see this, but please treat the group like a group chat: don’t post anything you wouldn’t want the others to see. You can leave a group, and you decide what you share into it (lawful basis: performance of our contract, and your own choice to share).

Parent and check-in sharing. If you turn on a parent or guardian view, we create a private link that shows a read-only summary of your trip: your route and dates, planning progress, a safety-status overview (for example whether you’ve sorted your passport, insurance and jabs) and any check-ins you choose to post. This is shared only with whoever you give the link to, and you can turn it off, which stops the link working. Remember that anyone who has a share link can open it, so only send it to people you trust. Check-ins are only ever the ones you actively post (lawful basis: performance of our contract, and your own choice to share).

Reminders. If you switch on deadline reminders, we send you emails (and, if you enable them, push notifications) about upcoming tasks like booking a visa or arranging jabs. You can turn these off at any time from the app, and every reminder email has an unsubscribe link (lawful basis: your consent, which you can withdraw whenever you like).

AI trip assistant. If you use the AI assistant, the questions you type and a short summary of your route (countries, weeks and budget) are sent to our AI provider (OpenAI) to generate the answer, and your recent conversation is kept in your browser during the session. Our provider processes this only to answer you and does not use it to train its models. Please don’t type passport numbers or other sensitive details into the chat - it doesn’t need them (lawful basis: performance of our contract, and our legitimate interest in providing the feature you’ve asked to use).

Payments. If you buy a paid plan, payment is handled by Stripe. Stripe processes your card details directly; we don’t see or store your full card number. We receive confirmation that a payment succeeded and basic order details so we can give you access and handle refunds (lawful basis: performance of our contract, and compliance with our legal and accounting obligations).

Calendar export. If you export your deadlines and travel dates to Google or Apple Calendar, that happens through a calendar file you choose to add. Once it’s in your own calendar, it lives in your calendar provider’s account under their privacy terms, not ours.

Usage analytics. We use PostHog, a privacy-respecting analytics tool hosted in the EU, to understand how the site and app are used so we can improve them (for example how many people sign up or reach checkout). It’s configured to be cookie-less and not to store data on your device. Where analytics counts as non-essential, we rely on your consent; otherwise we rely on our legitimate interest in understanding and improving the Service, balanced against your privacy.

Technical data. Like any website, our hosting and security providers automatically process basic technical information such as your IP address and browser type to deliver pages and keep the Service secure and available (lawful basis: our legitimate interest in a secure, working Service).

Cookies and device storage. We don’t use advertising or cross-site tracking cookies. We use only the storage that is strictly necessary to keep you signed in and to remember your plan on your device, and our analytics runs without cookies.

4. Who we share it with. We don’t sell your data and we don’t give it to advertisers. We do use a small number of trusted providers who process data on our behalf, under contracts that require them to protect it and only use it for us. These currently include our hosting, database, authentication and file-storage provider (Supabase), our website hosting and content delivery provider (Cloudflare), our payment processor (Stripe), our email-sending provider (Resend), our AI provider for the trip assistant (OpenAI), and our analytics provider (PostHog). Some links in the app (for example to flights or insurance) are affiliate links to third parties such as Travelpayouts; if you follow them, those sites handle any data you give them under their own privacy terms. We may also share data if the law requires it, or to protect our rights, users or the Service.

5. Where your data is held. We aim to keep data within the UK or European Economic Area where we can. Some of our providers may process data outside the UK/EEA. When that happens, we rely on appropriate safeguards recognised under UK data protection law (such as the UK’s international data transfer agreement or addendum, or an adequacy decision) so your data keeps a similar level of protection. You can ask us for more detail about a specific provider.

6. How long we keep it. We keep your account and plan data for as long as you have an account, and for a reasonable period afterwards. If you delete your account or ask us to delete your data, we’ll remove your plans, uploaded documents, group content you control and other personal data, normally within 30 days, except anything we’re required to keep by law (for example basic records of a payment for tax and accounting). Documents you delete from the vault are removed from storage. Waitlist and marketing contacts are kept until you unsubscribe or ask us to delete them.

7. Age. You must be 18 or over to hold an account and buy a plan. If you’re under 18, a parent or guardian should set up and manage the account. The Service is not intended for children under 13, and we don’t knowingly collect their data. If we learn we hold a child’s data without proper authority, we’ll delete it. If you’re a parent or guardian and think we hold data about your child that shouldn’t be there, email us and we’ll sort it out.

8. Keeping your data safe. We use access controls, encrypted connections and per-user isolation so that, as a rule, only you (and, for anything you’ve chosen to share, the people you’ve shared it with) can reach your data. No online service can promise perfect security, but we take reasonable steps to protect your information and we keep the amount we collect to what we actually need.

9. Your rights. Under UK data protection law you can ask us to give you a copy of your data, correct it if it’s wrong, delete it, or limit or object to how we use it, and where it applies you can ask us to transfer it to another service. Where we rely on your consent (such as for reminders or non-essential analytics) you can withdraw it at any time, without affecting anything we did before you withdrew it. To exercise any of these rights, email hello@offskies.co.uk. We’ll respond within the time the law allows, normally within one month, and we won’t charge you for a straightforward request.

10. Complaints. If you’re unhappy with how we’ve handled your data, please tell us first so we can try to put it right. You also have the right to complain to the UK’s data protection regulator, the Information Commissioner’s Office, at ico.org.uk.

11. Changes to this notice. As the Service grows we may update this notice. If we make a significant change we’ll take reasonable steps to let you know, and the “last updated” date above will change.

Questions about your privacy? Email hello@offskies.co.uk. See also our Terms of Service and Refund & Cancellation Policy.