Privacy Policy

Last updated: [DATE]. This policy will be reviewed by legal counsel before launch.

1. Information We Collect

Account Information

Email address, name, and password (or Google OAuth credentials) when you create an account.

Family Profile

Names and birth months/years of family members, travel interests per family member, accessibility needs, dietary restrictions and preferences, meal planning style, and travel budget. This information is used solely to personalize your experience within the app.

Location Data

Home address (city, state, ZIP) and hotel/rental addresses entered per trip plan. These are used exclusively to calculate personalized drive times to destinations. We convert addresses to GPS coordinates via Google Maps Geocoding API and store the coordinates — not your full street address — for cached drive time calculations. Addresses are never shared with third parties beyond the geocoding service.

Trip Plans

Destinations, schedules, and notes you create within the trip planner are stored in your account and accessible only to you.

Payment Information

Payment processing is handled entirely by Stripe. We never see, store, or have access to your credit card numbers or bank account details. We store only a Stripe customer identifier linked to your account.

2. How We Use Your Information

• Personalize destination and dining recommendations based on your family profile
• Calculate drive times from your address to destinations
• Filter content by age appropriateness for your children
• Process subscription payments and manage your billing
• Send transactional emails (account confirmation, booking requests, consultation scheduling)

3. Information Sharing

We do not sell your personal information. We share data only with:

• Supabase (database hosting) — stores your profile and trip data
• Google Maps Platform — receives addresses for geocoding and drive time calculation only
• Stripe — processes payments
• Sanity (content management) — does not receive any user data
• Vercel (hosting) — standard web hosting infrastructure

4. Data Security

All data is encrypted in transit (HTTPS) and at rest (Supabase PostgreSQL encryption). Row-Level Security policies ensure users can only access their own data. Authentication uses industry-standard JWT tokens with secure HTTP-only cookies.

5. Data Retention and Deletion

Your data is retained as long as your account is active. You may delete your account at any time, which permanently removes your profile, trip plans, and all associated data. Cached drive times (which contain only GPS coordinates, not addresses) expire after 30 days.

6. Children's Privacy

Florida Unlocked is designed for use by parents and guardians. We collect children's first names and birth months/years only as entered by parents for the purpose of age-appropriate content filtering. We do not knowingly collect information directly from children under 13.

7. Cookies

We use essential cookies for authentication session management only. We do not use advertising cookies or third-party tracking cookies.

8. Your Rights

You have the right to:

• Access all personal data we hold about you
• Correct inaccurate information
• Delete your account and all associated data
• Export your trip plans and profile data
• Opt out of non-essential communications

9. Contact

For privacy questions or data requests, contact us at [EMAIL].