Privacy policy

What we do not collect

• Itinerary data. Passenger names, email addresses, phone numbers, routes, dates and fares stay in your browser.
• Accounts. There is no registration and no login.
• Generated documents. Nothing is stored on a server, so nothing can be retrieved, subpoenaed or leaked from one.
• Tracking across sites. No advertising pixels, no cross-site trackers, no data sold or shared with brokers. Affiliate links are plain links — see below.

How the generator handles your data

The generator is client-side JavaScript. When you fill in the form, the values live in your browser's memory. When you generate a preview, the document is rendered in your browser.

When you take a share link, the itinerary is compressed and encoded into the part of the URL after the #. Browsers do not transmit that fragment to servers — it is handled entirely on the client. The itinerary therefore exists in the link itself and in the browser of whoever opens it, and nowhere else.

The practical consequences are worth being explicit about, in both directions:

• We cannot see, recover or delete an itinerary you generated, because we never had it
• Anyone you send the link to can read the itinerary, including the passenger name and any contact details you entered — treat it as you would an email attachment
• The link may be stored in browser history, in the messaging app you sent it through, and in the recipient's history

Do not put passport numbers, payment details or other sensitive personal data into the generator. It has no field for them by design.

Local storage

The travel itinerary checklist saves which items you have ticked in your browser's local storage, so your progress survives a page reload. That data stays on your device, is readable only by this site in that browser, and is never transmitted. Clearing your browser data removes it, and the "Reset" button clears it immediately.

No other feature writes to local storage.

Cookies

This site sets no cookies. See the cookie policy for the detail.

Server logs

Like any website, requests reach a web server, and the hosting provider may keep standard access logs — IP address, timestamp, requested path, user agent — for security and operational purposes.

Because itinerary data travels in the URL fragment, it does not appear in those logs. A request for /itinerary/#… is logged as a request for /itinerary/, with the fragment absent, since the browser never sends it.

Third-party requests

The tools make no requests to third-party services while you use them. Airport data is served from this site. There are no embedded fonts, analytics scripts, maps or widgets loaded from other domains.

Some pages link out to airline and government websites. Following those links takes you to sites with their own privacy practices, over which we have no control.

Some pages also contain affiliate links to booking partners. These are ordinary links: nothing is requested from the partner or the affiliate network when the page loads, so no pixel, script or cookie is involved in rendering it. If you click one, the affiliate network records the click and sets its own cookie on its own domain, under its own privacy policy, so that a later booking can be attributed. Not clicking means no contact with it at all.

Your rights

Data protection law gives you rights of access, rectification and erasure over personal data held about you. Since we hold no personal data about visitors beyond standard server logs, there is in practice nothing to access, correct or erase. If you believe we hold data about you, contact us.

Children

This service is not directed at children and we do not knowingly collect data from anyone.

Changes

We will update this policy if our practices change, and the date above will reflect it. Any change that introduced collection of itinerary data would be a change of principle, not of detail, and would be stated prominently.

Contact

Privacy questions: contact us.