Privacy Policy

What we collect

• Your account. Your email address if you sign in with an email code or with Google, and a random guest ID if you use Pylos without signing in.
• Trips and preferences. The destinations, dates, travel party, budget, interests and notes you enter; the itineraries we build for you; and your saves, star ratings, thumbs and source mix.
• Places you’ve been. Trips and places you log yourself: city, dates, favorites, ratings and notes.
• Community. Your profile name, handle and photo if you add one, the people you follow, and any trips you choose to share or make public.
• Connected accounts, only if you connect them. See Google Calendar and Gmail below. In the phone app, if you allow it, your calendars and the location data in your photos are read on your phone to find past trips; only the trips found (a place and dates) are sent to Pylos. Your photos never leave your phone.
• Basic technical data. IP address, browser and device type, pages visited and error logs, kept for security and to keep Pylos working.

Google Calendar

Connecting Google Calendar is optional. When you choose to connect it:

• What we access. Read-only access to the events on your main calendar (the calendar.events.readonly permission). We read events from the past six years once, at the moment you connect: each event’s title, location, notes and dates. We can’t see your other calendars, sharing or settings.
• What we use it for. Only to find trips you’ve taken and places you’ve been, such as hotel stays, flights and restaurant reservations, so we can learn your taste and plan trips you’ll like. Nothing else.
• What we keep. Only the trips and places we find: a place name, city, date and the kind of booking (for example, “OpenTable reservation”). We do not store your calendar events, and we never write to or change your calendar.
• How long we have access. We give the access back to Google as soon as the read finishes, so Pylos has no ongoing access to your calendar. You can also see and remove apps with access in your Google Account settings.
• Sharing. We don’t sell Google user data or use it for advertising. The places we find are used to personalize your plans, which includes sending them to our AI provider (see below) when it builds your itinerary. We don’t use Google user data to develop, improve or train generalized AI or machine learning models, and our AI provider doesn’t train on it. No person at Pylos reads your Google data unless you ask us to, it’s needed for security, or the law requires it.
• Deleting it. You can remove imported places from your profile at any time, or ask us to delete everything (see below).

Pylos’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Gmail

Connecting Gmail is optional. When you choose to connect it:

• What we access. Read-only access to your email (the gmail.readonly permission), used once, at the moment you connect. We search for booking confirmations from the past six years from hotels and booking sites, airlines and rail companies, restaurant booking sites and tour sites, and for at most a few hundred of them we read only the subject, the sender, the date and Gmail’s short preview of the text. We don’t open the rest of those emails, their attachments or any other email, and we never send, change or delete email.
• What we use it for. Only to find hotel stays, flights, restaurant reservations and tours you’ve booked, so we can learn your taste and plan trips you’ll like. To pick out the bookings, each email’s subject, preview, date and the sender’s domain are sent to our AI provider, with greetings, email addresses, links, phone numbers and booking numbers taken out first.
• What we keep. Only the bookings we find: a place name, city, date and the site it was booked with (for example, “Booked with Resy”). We do not store your emails or their previews.
• How long we have access. We give the access back to Google as soon as the read finishes, so Pylos has no ongoing access to your email. You can also see and remove apps with access in your Google Account settings.
• Sharing and deleting. Everything above under Google Calendar about sharing, AI training, people reading your data and deleting it applies to Gmail data too, and so does our commitment to the Google API Services User Data Policy, including the Limited Use requirements.

How we use your information

• To build and improve your itineraries, including learning your taste from the places you’ve been and how you rated them.
• To run the community features you choose to use, like following friends and sharing trips.
• To keep Pylos secure, prevent abuse and fix problems.
• To answer you when you contact us.

We don’t sell your personal information, and we don’t use it for advertising.

Who we share it with

• Service providers that run Pylos for us, under contracts that limit their use of your data: Supabase (database and sign-in), Vercel (hosting), Anthropic (the AI model that drafts itineraries from your request, preferences and travel history), Google Maps Platform (checking places and showing their photos) and Typeform (if you use the step-by-step trip form).
• Other people, when you choose. Public profiles and public trips can be seen by anyone; trips shown to followers are seen by your followers; and a shared trip link can be opened by anyone who has it. You can change a trip’s visibility or turn its link off at any time.
• When the law requires it, or to protect the rights, property or safety of our users, the public or Pylos.
• If Pylos changes hands, as part of a merger or sale, under this policy.

Keeping and deleting your data

We keep your information while your account is active. You can delete trips and remove logged or imported places at any time. To delete your account and everything linked to it, email team@newcenturydevelopment.com from the address you sign in with; we’ll delete it within 30 days, except where the law requires us to keep something.

Your rights

Depending on where you live (for example, under the GDPR in Europe or the CCPA in California), you may have the right to access, correct, delete or download your information, and to object to or limit how we use it. Email team@newcenturydevelopment.com and we’ll respond within 30 days. We won’t treat you differently for using these rights.

Security

We encrypt data in transit, limit who can access it, and keep sign-in tokens in your device’s secure storage in the phone app. No service is perfectly secure, but we work to protect your information and will tell you if a breach affects you.

Children

Pylos isn’t meant for children under 13 (or under 16 in the EEA and UK), and we don’t knowingly collect their information.

Where we process data

Pylos is based in the United States, and your information may be processed there and in other countries where our providers operate.

Changes

If we change this policy, we’ll update the date at the top, and tell you in the app or by email if the change is significant.

Contact

Questions or requests: team@newcenturydevelopment.com. See also our Terms of Service.