Privacy & data

Accounts are optional

You can plan without signing up. When optional account saving is available, Clerk handles sign-in and holds the email or Google profile you choose to use. PawStops stores an internal account identifier and the Clerk user identifier to associate trips you explicitly save. Signing in is not marketing consent, and we do not add you to Travel-Ball.com or Natural Waterscapes mailing lists.

What we store when you plan a trip

When you plan a trip we save your start, destination, dates, preferences, and itinerary. New trips require an ownership key held by the browser that created them for viewing, changes, and deletion. Older trips remain viewable by link until their owner chooses Make trip private; that blocks future link access but cannot recall downloaded copies. Saving a trip to an account retires its guest ownership key and removes this browser's offline copy. A trip that starts within seven days, or is underway, is saved on the device you open it on, including account trips while you're signed in; other trips are saved when you choose Save itinerary offline. The offline copy holds the itinerary, forecasts along the coming days' drives, EV stations for EV trips, and the Google place IDs and map positions of the hotels and stops you viewed, without names or other details. Forecasts, stations and stop positions are removed from the device after 29 days. Account trips' copies are removed when you sign out on that device or another account signs in. The offline copy is not encrypted storage, and copies on a disconnected device cannot be remotely erased.

Your location

The live features — “Near me”, Driving Mode, “wrap up in X hours”, and replanning from where you are — use your device's GPS. Your position stays in your browser for map display unless you take an action that needs the server: when you replan or ask for wrap-up hotels, your coordinates are sent to our server to compute the new route, and a replan is saved to that trip's revision history. We never track your location in the background — it's only read while a live feature is turned on.

Services we rely on

To build a trip we send the places, coordinates, and route you're working with to third-party services, each under its own privacy policy:

  • Routes, place search, town names and the map come from Google Maps Platform. To plan or replan a trip we send Google its start and destination, or your current position when you replan. As you type a start or destination, what you have typed so far is sent to Google for suggestions, and the place you pick is looked up with Google. "Use my location" sends your position to Google for the name of your town. The addresses you pick are saved with your trip. The map loads from Google, which sees the map area you view and your IP address, as any map service does. Your account identifier and email are not sent.
  • Google lets us keep a route's details for 30 days. After that, a saved trip keeps its dates, settings and overnight towns, and its route is redrawn through the same towns the next time it is opened. Copies saved offline on your device lose the route line after 30 days but keep the day-by-day plan.
  • Fuel, food, coffee and dog stops come from Google Places. To find them we send Google the stretch of your route being searched, or the area around a night's stop. Google's results are shown as they come and never stored on our servers. When a trip is saved on your device, the place IDs and map positions of the hotels and stops you viewed are kept there for up to 29 days, without names or details.
  • The routes of trips planned before the move to Google © OpenStreetMap contributors, via OSRM.
  • Hotel names, ratings and pet-friendly signals from Google Places.
  • When the charging directory is enabled, EV route searches send route coordinates to the Alternative Fuels Data Center API operated by the National Laboratory of the Rockies. Your saved EV profile, email and account identifier are not sent. Station records may be cached for six hours; they do not report live charger availability. For EV trips saved on your device, stations along the coming days' drives are looked up and kept there for up to 29 days.
  • Weather uses Open-Meteo first, with the U.S. National Weather Service as backup. Sampled route coordinates are sent for forecast lookup; your account identifier and email are not sent. Forecasts may be cached for 30 minutes. For trips saved on your device, forecasts for the coming days' drives are looked up when the trip is saved or opened online.
  • Hotel booking links go to Expedia.
  • Optional sign-in uses Clerk and the identity provider you choose. Trip locations and itineraries are not sent to Clerk.

Affiliate links

Our hotel “Book” and “Browse” links are affiliate links. If you book after following one, we may earn a commission at no extra cost to you. It never changes which hotels we show you or how they're ranked — ranking uses only your own brand, star and rating preferences.

Deleting a trip

On the home screen, your recent trips (saved only on this device) each have a trash button. Deleting removes the trip and its history from our database. If you clear this browser's storage you lose the ownership keys and access to private trips. A trip URL cannot recover them. For trips saved to an account, sign in and use My trips to open or delete them. Deleting your Clerk account sends PawStops a signed deletion notification; when received, we remove its saved trips and revisions. A minimal account identifier tombstone remains to prevent delayed requests from restoring a deleted account. After this privacy update, reconnect and save your itinerary offline again; older offline copies are removed when the updated app activates.

Deleting your Paw Stops account

In the Paw Stops app for iPhone or Android, open the Account menu and choose Delete account. On the web, go to pawstops.com/delete-account, sign in and choose Delete my account. Either way, your account, its sign-in and every trip saved to it, with its history, are deleted right away, on all your devices. Trips that were never saved to your account stay on the device that created them. We keep only the minimal account identifier described under Deleting a trip, so a delayed request can't restore the account. Usage analytics and bug reports don't record your account identifier. Some include a trip id; once your account's trips are deleted, those ids no longer lead to your account. A bug report keeps any name or email you typed into it.

Usage analytics

To understand how Paw Stops is used and to keep it working, we record usage on the website and in the iOS and Android apps in our own database. We do not use an external analytics service or advertising cookies, and we do not build advertising profiles from these records.

  • What you do: the pages you open (the type of page only, so every itinerary is recorded as the same trip page), how long a page is open in the foreground, how far you scroll, which tools you use (such as Driving Mode or the weather view), actions such as planning a trip or opening a hotel booking link, and the domain of links you follow to other sites.
  • How the app performs: page-speed measurements, and error messages from the app with web addresses, email addresses, ids and long numbers removed before they are sent.
  • Where a visit came from: the domain of the site that linked you here and any campaign tags in that link (utm_ values limited to letters, numbers and simple punctuation).
  • Your device, in general terms: device type, operating system and browser family (the full browser identification string is not kept), screen-width range, language, and the app or site version.
  • Approximate location: your country and state or province, which our hosting provider derives from your connection. Your IP address, city and postal code are not stored with these records.

A random device id stored in this browser or app, and a random id for each visit, connect this activity across visits, and some records include a trip id that links to route information. This is pseudonymous data, not anonymous data. Analytics never accepts your account identifier, email addresses, free-text hotel names, addresses, travel dates or edit keys. But when a trip is saved to an account, the trip id in a record can be matched to that trip and so to the account, so these records should be treated as linked to you.

Detailed usage records are deleted automatically after 14 months. We keep daily totals, such as the number of visits from each country on a given day, which contain no device, visit or trip ids. Clearing browser storage removes this browser's random ids but does not erase records already made, and deleting a trip does not delete its earlier usage records. Contact us with questions about stored data.

Your choices: if your browser sends the Global Privacy Control signal, Paw Stops records no usage analytics. You can also turn usage analytics off for this browser or app with the switch on this page. The service records described below continue, because they are needed to run and protect Paw Stops.

Protecting the service

Our hosting service processes IP addresses to deliver requests and help protect the service. Paw Stops also limits how many requests can come from one IP address in a short time. To count them we store a hash of your IP address made with a secret key, never the address itself. The hash changes with every time window (one minute for most limits, one day for bug reports), and each count is deleted after its window ends, usually within the hour. These counts are kept apart from usage analytics, but while a window is open, requests from the same network share one count. Hosting and upstream services may process connection information under their own policies. These operational identifiers should not be understood as anonymous merely because an address is transformed.

To spot outages and slow responses, we also record, for each request to our servers, which kind of request it was, whether it succeeded and how long it took, and for calls our servers make to the data providers listed above, which provider was called, whether it answered and how long it took. These records contain no IP address, device id, trip id or location, and are deleted after 14 months.

When a trip is planned or replanned, or a server request fails, we also keep a short technical record so we can find and fix problems: whether it worked, where and why it failed (our own error message with numbers and web addresses removed), how long it took, the trip's length and number of days, your planning settings (such as daily driving limit and vehicle type), and the start and end points rounded to about 10 km (6 miles). It contains no addresses or place names, IP address, or device, account or trip id. These records are deleted after 30 days; only daily counts of successes and failures are kept. Because they are needed to run the service, they are kept even when usage analytics is turned off.

Bug reports and feature requests

When you send a bug report or feature request, we store what you write, the topic you pick, the page you were on (its address without anything after a ? or #; on a trip page that includes the trip's id), whether you used the website or the iOS or Android app, your browser's user agent (which names your browser, its version and your device's operating system), and whether you were signed in. If you add your name or email, we store those too and use them only to reply about your report, including sending updates on it if you check that box. We do not use them for marketing or add them to any mailing list. Reports don't record your account identifier or usage-analytics ids, but a trip id in the page address can be matched to that trip, and to your account if the trip is saved to one.

To have a report deleted, email [email protected].

Contact

Questions about your data? Email [email protected].