Privacy Policy

TravelMontage is operated by Aditya Agarwal, an individual developer, as the data controller for the information described here. You can reach me about anything on this page — including a request to see or delete your data — at aditya130805@gmail.com.

TravelMontage is a small independent project, not a company with a privacy department. I have tried to describe what actually happens in the code rather than write the broadest language a lawyer would allow. If something here is unclear or looks wrong, email me.

Your account

Accounts are handled by Clerk, not by me. When you sign up, Clerk stores your email address and, depending on how you sign in, your name, profile picture, and the identifier from the provider you used (for example Google). TravelMontage stores only the opaque user ID Clerk issues, and asks Clerk for the rest when it needs to show it to you. I never see or store your password.

The photos you upload

The image files themselves are stored in Cloudflare R2, along with the resized copies the story shows and one file of small thumbnails used to choose each moment’s photos. Photos larger than 2560 pixels on their longest edge are resized in your browser before upload, so for most phone photos the original camera file never leaves your device — only the smaller copy does. Re-encoding a photo this way also drops the metadata embedded in the file. Photos already under that size are uploaded unchanged, and those may still carry their original embedded metadata, including GPS coordinates.

Stored photos are served from unguessable public URLs. There is no password on an individual image file: anyone who has the exact URL can open it, and the URL is what your browser loads when it shows you your own story. The addresses contain long random strings and are not listed or linked anywhere, so they are not discoverable in practice — but they are not access-controlled, and you should treat them as secret rather than as private.

What is read from your photos

Before a photo is uploaded, your browser reads a few things out of the file and sends them along as ordinary data:

• When it was taken— the capture timestamp from the file’s metadata. If that is missing, TravelMontage tries the filename (phone cameras often encode the date there) and then the file’s modification time, and records which of the three it used so it can decide how much to trust it. When most photos share nearly the same modification time, which is what a download or copy leaves behind, those times are not treated as when anything was taken.
• Where it was taken — the GPS latitude and longitude, when your camera recorded them and they survived whatever exported the file. Many photos have none, and TravelMontage works without it.
• Pixel dimensions, and the camera’s sequence number from the filename, which is used only to put photos in order. When no filename has one, your browser sends each photo’s place in the alphabetical order of the filenames instead, for the same purpose. The filenames themselves are not sent.
• How each photo looks, as a few numbers— how sharp it is, how bright, how much of it is blown out or black, and how colourful — plus a near-duplicate fingerprint (described below). Your browser measures these from a small copy of the photo; they are used to choose which photos front your story, so a blurred frame does not get picked over a sharp one of the same view.
• A small thumbnail of every photo, at most 256 pixels on its longest side. Your browser makes these and uploads them together as a single file per trip. They let a story be built from all your photos without downloading the full-size ones.

Exact coordinates are stored alongside each photo, because the story uses them to group photos into places and to measure how far you travelled.

Trying it on the home page sends nothing.Photos you drop on the home page’s “try it” table are read only by your browser: it takes their times and locations to sort them into moments and draws small previews, all on your device. None of it is uploaded or stored, and closing the page forgets it. To make a story, you choose the photos again after signing in.

What is derived

• The colour of a story’s table— while a story is open, the browser of whoever is reading it takes a colour from each moment’s main photo, from the copy already on screen, and tints the page behind it. It is worked out on that device each time, and is never stored or sent anywhere.
• Place names— clusters of coordinates are turned into a city and place label (see the Mapbox entry below). When the AI model recognises a specific landmark in a moment’s photos — a national park, a named mountain or building — that name is checked against Mapbox and used only if it resolves to a real place close to where the photos were taken.
• Place names read from the photos themselves — only when a trip has no coordinates at all. Some cameras never record a location, and downloading or re-exporting a photo usually removes it, which would otherwise leave a story unable to name anywhere. In that case up to ten photos are shown to the AI model, which reports only place names it can actually read in the frame — a station sign, a plaque, a storefront. Each name is then checked against Mapbox and discarded unless it resolves to a real place. Names that survive are stored with the photo, along with the piece of text they were read from, so the source of a place label can always be traced.
• Captions and narration — written by an AI model from your photos (see the next section). When you retell a story in other voices, the words for each voice you have read it in are kept with the trip, so you can switch back without anything being written again. They are discarded when the story is rebuilt, when your answers or a memory change it, and when the trip is deleted.
• A written description of each moment— before any caption is written, the model is asked to record plainly what is visible across a moment’s photos: the setting, what is in frame, the light, any readable text such as signs, the details that set the moment apart, and the people shown — how many, what their faces and body language show, and a plain description of what they are wearing or carrying, so the same companion can be recognised from one moment to the next. It never records who anyone is, and never describes anyone’s body or age. This description is stored with the moment and kept. Keeping it is what lets a story be re-written — in a different style, around your answers to its questions, or around a memory you add to one moment — without your photos ever being sent to the model again.
• A perceptual fingerprint of each photo — a 64-bit hash used to spot near-duplicates so a story does not show you the same shot four times. It cannot be turned back into an image. For photos uploaded since October 2026 your browser calculates it; for older ones the server does.
• Trip statistics — dates, number of photos, number of cities, approximate miles travelled.

What you write

Notes you add to a trip or a moment, your answers to the questions asked while a story is being built, edits to titles and locations, and the thumbs up/down you leave on a moment are stored as you entered them. The feedback is used to improve how captions are generated.

The questions are asked while your photos are being read, each one beside the photo it is about, and each answer is saved as you give it. How many get asked depends on the trip — a long trip across several places has more that photographs cannot show than a single afternoon does. Every one of them is optional. Nothing is written until you say so: if you leave partway, the trip waits in your library, unfinished, with your answers kept, until you finish it or delete it. To choose what to ask, the AI model proposes questions from the same photos and descriptions it is already sent; no extra data goes to it for that.

The style you choosefor a story — whether it reads as a story, a storybook, field notes, a postcard, a reel, or a roast — is stored with the trip, so it can be shown to you and used when the story is written or told again a different way.

Your settings

One preference is stored against your account: whether you use the light or dark theme. It exists so the choice follows you between devices instead of being stuck in one browser. A row is only written once you actually change it.

Usage and technical data

TravelMontage counts how many times a story has been opened, and when it was last opened, so it can show you that. Vercel, which hosts the site, processes standard server logs including IP addresses for security and reliability.

TravelMontage also records how the product itself is used, so I can tell which parts work: pages viewed, buttons pressed, how many photos an upload contained and how long it took, whether a story finished building, how long each step took and what it cost to run, which cards of a story were viewed, and the ratings and hides left on captions. What is recorded is counts, durations, and yes/no facts. Your captions, your notes, your trip titles, your filenames, and your email address are never part of it.

Two coarse details are recorded alongside those actions: whether the request came from a phone, a tablet or a desktop, and which countryit came from. The country is worked out by Vercel’s network from the connecting IP address before the request reaches this app. It is the country only — never a region, a city, or a coordinate — and it is not taken from your photos.

When you first sign in, one row is written for your account holding your account ID, the date the account was created, and one country. It is what lets me answer how many people signed up in a month and roughly where from. It is deleted when your account is.

That country is asked of Clerk rather than measured here. Clerk records the approximate location of each of your sign-in sessions, worked out from the IP address you signed in with; TravelMontage reads the country of the session you created your account in, and stores that one country. Clerk also knows the city and the IP address — those are not requested and not stored. If Clerk has no answer, the country of the request itself is used instead, exactly as above. Only the first country found is kept: signing in later from somewhere else does not change it, and does not add a second one.

This is measured by TravelMontage itself, not by an analytics company. There is no third-party analytics product, no advertising, and no tracking pixels. Nothing is shared with anyone, and none of it leaves the same database your trips are in.

Anonymous visitors are not given an identifier to carry around. Instead, each recorded action is tagged with a one-way fingerprint calculated from your IP address, your browser’s user-agent string, a secret, and today’s date. Your IP address is never stored — only the fingerprint, which cannot be turned back into it. Because the date is part of the calculation, the fingerprint changes every day: two visits a day apart cannot be connected to each other. Once you sign in, actions are recorded against your account ID instead, which is how your own history persists.

Cookies

Two kinds, both strictly functional. Clerk sets cookies to keep you signed in. TravelMontage sets one cookie, tm-theme, holding the single word light or dark so the page can render in your chosen theme without a flash, and so that choice survives signing out. Nothing here is used for advertising or cross-site tracking, which is why there is no cookie banner. The usage measurement described above deliberately uses no cookie at all — that was the point of the daily fingerprint.

This is the part most worth understanding, so it gets its own section.

To write a caption, TravelMontage sends a small number of photos from each moment to an AI model, sent to the model’s provider directly. When you create a trip you may be offered a choice of who writes it: Anthropic (its Claude model), OpenAI, or Google (its Gemini model). Whichever you pick is the only one that receives that trip’s data, for its first build and for every later retelling, answer, or memory, and it receives everything this section describes and nothing more. If you don’t choose, it is OpenAI. Trips created before this choice was offered, in October 2026, were written by Anthropic and stay with Anthropic. Photos are downscaled to at most 768 pixels first — the model receives a low-resolution copy, not your full-size image. Along with the images it receives the place name, the date, and any note or answer you gave about that trip or moment, because those are what make a caption specific rather than generic.

Choosing those photos is the step before. For a moment with more photos than its card can hold, the model is shown a contact sheet: one image of up to sixteen of that moment’s small thumbnails, side by side, at most 768 pixels across in total. Before that, using the measurements your device made, near-duplicate shots are narrowed to their sharpest frame. From the sheet the model picks the photo that fronts the card and up to three more, and writes one or two sentences on what the whole moment shows. Only the photos it picks are then sent at the 768-pixel size described above. So for a large trip the model sees a small copy of many of your photos, and a readable copy of only the few in your story.

One more kind of request exists, and only for trips whose photos carry no location at all: up to ten photos, downscaled the same way, are sent in a single request asking the model to report any place name it can literally read in the frame. It is asked to read, never to guess, and whatever it reports is verified against Mapbox before it is used.

The model’s reply — the caption text — is stored with your trip. The images are sent for that one request and are not retained by TravelMontage anywhere outside your own trip’s storage.

When your story is built, a further request goes to the model, and this one is text-only. To suggest the words you might post alongside a shared story, TravelMontage sends the model the trip title, region, dates, the tallies shown on the story, and the captions already written for its moments — no photographs. The reply is a set of suggested captions, one per social platform, stored with your trip so the share sheet can show them; you can edit any of them before you post, and a public viewer of your story sees the same suggestions rather than triggering a new request.

If you have a finished story told again in a different style, or add a memory to one of its moments, that also goes to the model as a text-only request: the stored descriptions of your moments, the trip facts, and your own answers or memory, with no photographs. It is the reason those descriptions are kept. The reply replaces the story’s words; your photos are untouched. The one exception is a memory added to a moment from a story built before descriptions were kept: that moment has no description to work from, so its photos are sent again, downscaled as above.

The model provider and Vercel process this data as service providers under their own terms, which, on the paid API plans TravelMontage uses, do not permit using it to train their models. They may retain request data briefly for abuse monitoring. I do not use your photos, captions, or notes to train anything, and I do not sell or share them with anyone for advertising.

TravelMontage runs on other companies’ infrastructure. These are all of them:

Clerk

Accounts and sign-in. Holds your email address and profile details, and the approximate location of each sign-in session, of which this app reads only the country.

Vercel

Hosting and server logs. Requests to the AI model are made from Vercel’s servers but go straight to the model provider; Vercel does not process them as a separate service. A story is built in steps by Vercel Workflows, which holds what one step hands the next while the build runs: place names, the description of each moment, and the written story and captions — never the photos themselves. Vercel deletes that record a day after the build.

Cloudflare

Stores your photo files, their resized copies, and the file of thumbnails, in its R2 storage, and serves them through its network whenever a story is viewed. Like any web server, it sees the IP address and browser of whoever loads a photo. It also answers the DNS lookups for travelmontage.com, which tell a browser where the site is; the site itself is not served through Cloudflare.

Neon

The Postgres database holding trips, photo records, coordinates, captions, and notes.

Anthropic

Writes captions and narration from downscaled photos, as described above, for trips you chose Claude to write and for every trip created before the choice was offered in October 2026.

OpenAI

Receives the same data Anthropic would, for every trip created since the choice was offered, unless you chose another provider for it.

Google

Receives the same data Anthropic would, through its Gemini API, only for trips you chose Gemini to write.

Mapbox

Turns coordinates into place names. Coordinates are rounded to three decimal places — roughly a 100-metre cell — before being sent, and the answer is cached, so Mapbox receives a coarsened location and not a precise trace of where you stood. Your exact coordinates are never sent to Mapbox.

Mapbox is also asked the reverse question — name to place — in three cases: when you type a destination into the optional “where was this trip?” field, when the model has read a place name off one of your photos and that name has to be checked against a real gazetteer, and when the model has recognised a landmark in a moment and that name has to be confirmed as being near the photos. In the first two cases Mapbox receives only the text of a place name. In the third it receives the landmark’s name and the moment’s location rounded to about a kilometre, so the lookup can prefer nearby matches. It never receives a photo.

I do not sell your personal information, and I do not share it with anyone other than the providers above, except where the law requires it.

The infrastructure above is operated primarily from the United States, and photo storage for this project is in a US region. If you are in the United Kingdom, the European Economic Area, or elsewhere outside the US, using TravelMontage means your data is transferred to and processed in the United States. Those transfers rely on the standard contractual protections each provider offers.

A story is private to your account until you create a share link. Creating one mints a long random address that anyone holding it can open without signing in — it does not reveal your email address or your other trips. You can revoke a link at any time, which stops the story page from loading for anyone who has it.

A link made from the share sheet ends with the name of the app it was made for, such as ?via=whatsapp. When someone opens the story from that link, the app name is recorded with the visit, so I can see which apps send people back. Nothing else about the person opening it is added; the visit is recorded the same way as any other, as described under how the product is measured.

Revoking the link does not change the photo file URLs described earlier. Someone who saved a direct image address while the story was shared can still reach that image. Deleting the trip deletes the files themselves, which is the way to make them unreachable, within a day.

• Trips, photos, captions, and the questions asked with your answers are kept until you delete them or delete your account — including a trip you never finished.
• Deleting a trip removes its database records and its stored image files, including the resized copies and the file of thumbnails. Copies held in Cloudflare’s cache can still be served by their URL for up to a day after that, and then expire.
• The working record of a story build, kept by Vercel Workflows while it runs, is deleted by Vercel a day after the build.
• An upload abandoned partway through — photos sent but the trip never finished — is cleaned up automatically after 24 hours.
• Cached place names are stored against coarse coordinate cells, not against you, and are kept to avoid repeating lookups.
• Usage records are kept indefinitely. They are what the product is measured by over time — whether people come back months later, what a story cost to build last year — and a rolling window would erase exactly those answers. They carry no captions, no note text, no filenames, and no email addresses. The daily fingerprint that tags the anonymous ones stops being linkable to anything after a day, so an old record is not a record of a person. If you ask me to delete your data, the usage records tied to your account go with it.

Wherever you live, you can ask me to show you what data is held about you, correct it, export it, or delete it. You can do the last two yourself at any time from your settings, and delete individual trips from your library. For anything else, email aditya130805@gmail.com and I will respond within 30 days.

If you are in the EEA or UK, the GDPR gives you the rights to access, rectification, erasure, restriction, portability, and objection, and the right to complain to your local supervisory authority. The legal bases I rely on are performance of a contract (to build the story you asked for), legitimate interests (keeping the service running and secure), and consent where you chose to upload photos containing location data.

If you are a California resident, the CCPA gives you the rights to know, delete, correct, and opt out of sale or sharing. TravelMontage does not sell or share personal information, so there is nothing to opt out of, and I will not discriminate against you for exercising any right.

TravelMontage is not intended for anyone under 13, and I do not knowingly collect information from children under 13. If you believe a child has created an account, email me and I will remove it. If you are between 13 and 18, please use TravelMontage only with a parent’s or guardian’s permission.

Traffic is encrypted in transit, data is encrypted at rest by the providers above, and access to the production database and storage is limited to me. I want to be straightforward that no service can promise perfect security, and that the public-URL behaviour described earlier is a real characteristic of how photos are served, not an oversight I have hidden in a clause.

If this policy changes, the date at the top changes with it. For a change that materially affects how your data is handled, I will make a reasonable effort to tell account holders rather than quietly editing the page.