Privacy Policy

TravelMontage is operated by Aditya Agarwal, an individual developer, as the data controller for the information described here. You can reach me about anything on this page — including a request to see or delete your data — at aditya130805@gmail.com.

TravelMontage is a small independent project, not a company with a privacy department. I have tried to describe what actually happens in the code rather than write the broadest language a lawyer would allow. If something here is unclear or looks wrong, email me.

Your account

Accounts are handled by Clerk, not by me. When you sign up, Clerk stores your email address and, depending on how you sign in, your name, profile picture, and the identifier from the provider you used (for example Google). TravelMontage stores only the opaque user ID Clerk issues, and asks Clerk for the rest when it needs to show it to you. I never see or store your password.

The photos you upload

The image files themselves are stored in Vercel Blob. Photos larger than 2560 pixels on their longest edge are resized in your browser before upload, so for most phone photos the original camera file never leaves your device — only the smaller copy does. Re-encoding a photo this way also drops the metadata embedded in the file. Photos already under that size are uploaded unchanged, and those may still carry their original embedded metadata, including GPS coordinates.

Stored photos are served from unguessable public URLs. There is no password on an individual image file: anyone who has the exact URL can open it, and the URL is what your browser loads when it shows you your own story. The addresses contain long random strings and are not listed or linked anywhere, so they are not discoverable in practice — but they are not access-controlled, and you should treat them as secret rather than as private.

What is read from your photos

Before a photo is uploaded, your browser reads a few things out of the file and sends them along as ordinary data:

• When it was taken— the capture timestamp from the file’s metadata. If that is missing, TravelMontage tries the filename (phone cameras often encode the date there) and then the file’s modification time, and records which of the three it used so it can decide how much to trust it.
• Where it was taken — the GPS latitude and longitude, when your camera recorded them and they survived whatever exported the file. Many photos have none, and TravelMontage works without it.
• Pixel dimensions, and the camera’s sequence number from the filename, which is used only to put photos in order.

Exact coordinates are stored alongside each photo, because the story uses them to group photos into places and to measure how far you travelled.

What is derived

• Place names — clusters of coordinates are turned into a city and place label (see the Mapbox entry below).
• Place names read from the photos themselves — only when a trip has no coordinates at all. Some cameras never record a location, and downloading or re-exporting a photo usually removes it, which would otherwise leave a story unable to name anywhere. In that case up to ten photos are shown to the AI model, which reports only place names it can actually read in the frame — a station sign, a plaque, a storefront. Each name is then checked against Mapbox and discarded unless it resolves to a real place. Names that survive are stored with the photo, along with the piece of text they were read from, so the source of a place label can always be traced.
• Captions and narration — written by an AI model from your photos (see the next section).
• A written description of each moment— before any caption is written, the model is asked to record plainly what is visible across a moment’s photos: the setting, what is in frame, the light, any readable signage, and whether the people shown are smiling. This description is stored with the moment and kept. Keeping it is what lets a story be re-written — in a different style, or around something you tell us later — without your photos ever being sent to the model again.
• A perceptual fingerprint of each photo — a 64-bit hash used to spot near-duplicates so a story does not show you the same shot four times. It cannot be turned back into an image.
• Trip statistics — dates, number of photos, number of cities, approximate miles travelled.

What you write

Notes you add to a trip or a moment, your answers to the questions asked while a story is being built, edits to titles and locations, and the thumbs up/down you leave on a moment are stored as you entered them. The feedback is used to improve how captions are generated.

How many questions get asked depends on the trip — a long trip across several places has more that photographs cannot show than a single afternoon does. Every one of them is optional, and you can skip straight to your story at any point.

The style you choosefor a story — whether it reads as a story, a storybook, field notes, a postcard, a reel, or a roast — is stored with the trip, so it can be shown to you and used when the story is written or told again a different way.

Your settings

One preference is stored against your account: whether you use the light or dark theme. It exists so the choice follows you between devices instead of being stuck in one browser. A row is only written once you actually change it.

Usage and technical data

TravelMontage counts how many times a story has been opened, and when it was last opened, so it can show you that. Vercel, which hosts the site, processes standard server logs including IP addresses for security and reliability.

TravelMontage also records how the product itself is used, so I can tell which parts work: pages viewed, buttons pressed, how many photos an upload contained and how long it took, whether a story finished building, how long each step took and what it cost to run, which cards of a story were viewed, and the ratings and hides left on captions. What is recorded is counts, durations, and yes/no facts. Your captions, your notes, your trip titles, your filenames, and your email address are never part of it.

Two coarse details are recorded alongside those actions: whether the request came from a phone, a tablet or a desktop, and which countryit came from. The country is worked out by Vercel’s network from the connecting IP address before the request reaches this app. It is the country only — never a region, a city, or a coordinate — and it is not taken from your photos.

When you first sign in, one row is written for your account holding your account ID, the date the account was created, and one country. It is what lets me answer how many people signed up in a month and roughly where from. It is deleted when your account is.

That country is asked of Clerk rather than measured here. Clerk records the approximate location of each of your sign-in sessions, worked out from the IP address you signed in with; TravelMontage reads the country of the session you created your account in, and stores that one country. Clerk also knows the city and the IP address — those are not requested and not stored. If Clerk has no answer, the country of the request itself is used instead, exactly as above. Only the first country found is kept: signing in later from somewhere else does not change it, and does not add a second one.

This is measured by TravelMontage itself, not by an analytics company. There is no third-party analytics product, no advertising, and no tracking pixels. Nothing is shared with anyone, and none of it leaves the same database your trips are in.

Anonymous visitors are not given an identifier to carry around. Instead, each recorded action is tagged with a one-way fingerprint calculated from your IP address, your browser’s user-agent string, a secret, and today’s date. Your IP address is never stored — only the fingerprint, which cannot be turned back into it. Because the date is part of the calculation, the fingerprint changes every day: two visits a day apart cannot be connected to each other. Once you sign in, actions are recorded against your account ID instead, which is how your own history persists.

Cookies

Two kinds, both strictly functional. Clerk sets cookies to keep you signed in. TravelMontage sets one cookie, tm-theme, holding the single word light or dark so the page can render in your chosen theme without a flash, and so that choice survives signing out. Nothing here is used for advertising or cross-site tracking, which is why there is no cookie banner. The usage measurement described above deliberately uses no cookie at all — that was the point of the daily fingerprint.

This is the part most worth understanding, so it gets its own section.

To write a caption, TravelMontage sends a small number of photos from each moment to Anthropic’s Claude model, routed through Vercel AI Gateway. Photos are downscaled to at most 768 pixels first — the model receives a low-resolution copy, not your full-size image. Along with the images it receives the place name, the date, and any note or answer you gave about that trip or moment, because those are what make a caption specific rather than generic.

One other kind of request exists, and only for trips whose photos carry no location at all: up to ten photos, downscaled the same way, are sent in a single request asking the model to report any place name it can literally read in the frame. It is asked to read, never to guess, and whatever it reports is verified against Mapbox before it is used.

Only the photos actually chosen to appear in your story are sent this way, not everything you uploaded. The model’s reply — the caption text — is stored with your trip. The images are sent for that one request and are not retained by TravelMontage anywhere outside your own trip’s storage.

When your story is built, one more request goes to the model, and this one is text-only. To suggest the words you might post alongside a shared story, TravelMontage sends Claude the trip title, region, dates, the tallies shown on the story, and the captions already written for its moments — no photographs. The reply is a set of suggested captions, one per social platform, stored with your trip so the share sheet can show them; you can edit any of them before you post, and a public viewer of your story sees the same suggestions rather than triggering a new request.

If you have a finished story told again in a different style, or you answer the questions asked while it was being built, that also goes to the model as a text-only request: the stored descriptions of your moments, the trip facts, and your own answers, with no photographs. It is the reason those descriptions are kept. The reply replaces the story’s words; your photos are untouched.

Anthropic and Vercel process this data as service providers under their own terms, which do not permit using it to train their models. They may retain request data briefly for abuse monitoring. I do not use your photos, captions, or notes to train anything, and I do not sell or share them with anyone for advertising.

TravelMontage runs on other companies’ infrastructure. These are all of them:

Clerk

Accounts and sign-in. Holds your email address and profile details, and the approximate location of each sign-in session, of which this app reads only the country.

Vercel

Hosting, server logs, and Blob storage for your photos. Also operates the AI Gateway that requests pass through.

Neon

The Postgres database holding trips, photo records, coordinates, captions, and notes.

Anthropic

Writes captions and narration from downscaled photos, as described above.

Mapbox

Turns coordinates into place names. Coordinates are rounded to three decimal places — roughly a 100-metre cell — before being sent, and the answer is cached, so Mapbox receives a coarsened location and not a precise trace of where you stood. Your exact coordinates are never sent to Mapbox.

Mapbox is also asked the reverse question — name to place — in two cases: when you type a destination into the optional “where was this trip?” field, and when the model has read a place name off one of your photos and that name has to be checked against a real gazetteer. In both cases Mapbox receives only the text of a place name. It receives no photo, and no coordinate.

I do not sell your personal information, and I do not share it with anyone other than the providers above, except where the law requires it.

The infrastructure above is operated primarily from the United States, and photo storage for this project is in a US region. If you are in the United Kingdom, the European Economic Area, or elsewhere outside the US, using TravelMontage means your data is transferred to and processed in the United States. Those transfers rely on the standard contractual protections each provider offers.

A story is private to your account until you create a share link. Creating one mints a long random address that anyone holding it can open without signing in — it does not reveal your email address or your other trips. You can revoke a link at any time, which stops the story page from loading for anyone who has it.

Revoking the link does not change the photo file URLs described earlier. Someone who saved a direct image address while the story was shared can still reach that image. Deleting the trip deletes the files themselves, which is the way to make them unreachable.

• Trips, photos, and captions are kept until you delete them or delete your account.
• Deleting a trip removes its database records and its stored image files, including the resized copies.
• An upload abandoned partway through — photos sent but the trip never finished — is cleaned up automatically after 24 hours.
• Cached place names are stored against coarse coordinate cells, not against you, and are kept to avoid repeating lookups.
• Usage records are kept indefinitely. They are what the product is measured by over time — whether people come back months later, what a story cost to build last year — and a rolling window would erase exactly those answers. They carry no captions, no note text, no filenames, and no email addresses. The daily fingerprint that tags the anonymous ones stops being linkable to anything after a day, so an old record is not a record of a person. If you ask me to delete your data, the usage records tied to your account go with it.

Wherever you live, you can ask me to show you what data is held about you, correct it, export it, or delete it. You can do the last two yourself at any time from your settings, and delete individual trips from your library. For anything else, email aditya130805@gmail.com and I will respond within 30 days.

If you are in the EEA or UK, the GDPR gives you the rights to access, rectification, erasure, restriction, portability, and objection, and the right to complain to your local supervisory authority. The legal bases I rely on are performance of a contract (to build the story you asked for), legitimate interests (keeping the service running and secure), and consent where you chose to upload photos containing location data.

If you are a California resident, the CCPA gives you the rights to know, delete, correct, and opt out of sale or sharing. TravelMontage does not sell or share personal information, so there is nothing to opt out of, and I will not discriminate against you for exercising any right.

TravelMontage is not intended for anyone under 13, and I do not knowingly collect information from children under 13. If you believe a child has created an account, email me and I will remove it. If you are between 13 and 18, please use TravelMontage only with a parent’s or guardian’s permission.

Traffic is encrypted in transit, data is encrypted at rest by the providers above, and access to the production database and storage is limited to me. I want to be straightforward that no service can promise perfect security, and that the public-URL behaviour described earlier is a real characteristic of how photos are served, not an oversight I have hidden in a clause.

If this policy changes, the date at the top changes with it. For a change that materially affects how your data is handled, I will make a reasonable effort to tell account holders rather than quietly editing the page.