Privacy Policy

TravelMontage is operated by Aditya Agarwal, an individual developer, as the data controller for the information described here. You can reach me about anything on this page — including a request to see or delete your data — at aditya130805@gmail.com.

TravelMontage is a small independent project, not a company with a privacy department. I have tried to describe what actually happens in the code rather than write the broadest language a lawyer would allow. If something here is unclear or looks wrong, email me.

Your account

Accounts are handled by Clerk, not by me. When you sign up, Clerk stores your email address and, depending on how you sign in, your name, profile picture, and the identifier from the provider you used (for example Google). TravelMontage stores only the opaque user ID Clerk issues, and asks Clerk for the rest when it needs to show it to you. I never see or store your password.

The photos you upload

The image files themselves are stored in Vercel Blob. Photos larger than 2560 pixels on their longest edge are resized in your browser before upload, so for most phone photos the original camera file never leaves your device — only the smaller copy does. Re-encoding a photo this way also drops the metadata embedded in the file. Photos already under that size are uploaded unchanged, and those may still carry their original embedded metadata, including GPS coordinates.

Stored photos are served from unguessable public URLs. There is no password on an individual image file: anyone who has the exact URL can open it, and the URL is what your browser loads when it shows you your own story. The addresses contain long random strings and are not listed or linked anywhere, so they are not discoverable in practice — but they are not access-controlled, and you should treat them as secret rather than as private.

What is read from your photos

Before a photo is uploaded, your browser reads a few things out of the file and sends them along as ordinary data:

• When it was taken— the capture timestamp from the file’s metadata. If that is missing, TravelMontage tries the filename (phone cameras often encode the date there) and then the file’s modification time, and records which of the three it used so it can decide how much to trust it.
• Where it was taken — the GPS latitude and longitude, when your camera recorded them and they survived whatever exported the file. Many photos have none, and TravelMontage works without it.
• Pixel dimensions, and the camera’s sequence number from the filename, which is used only to put photos in order.

Exact coordinates are stored alongside each photo, because the story uses them to group photos into places and to measure how far you travelled.

What is derived

• Place names — clusters of coordinates are turned into a city and place label (see the Mapbox entry below).
• Captions and narration — written by an AI model from your photos (see the next section).
• A perceptual fingerprint of each photo — a 64-bit hash used to spot near-duplicates so a story does not show you the same shot four times. It cannot be turned back into an image.
• Trip statistics — dates, number of photos, number of cities, approximate miles travelled.

What you write

Notes you add to a trip or a moment, edits to titles and locations, and the thumbs up/down you leave on a moment are stored as you entered them. The feedback is used to improve how captions are generated.

Your settings

One preference is stored against your account: whether you use the light or dark theme. It exists so the choice follows you between devices instead of being stuck in one browser. A row is only written once you actually change it.

Usage and technical data

TravelMontage counts how many times a story has been opened, and when it was last opened, so it can show you that. Vercel, which hosts the site, processes standard server logs including IP addresses for security and reliability.

TravelMontage also records how the product itself is used, so I can tell which parts work: pages viewed, buttons pressed, how many photos an upload contained and how long it took, whether a story finished building, how long each step took and what it cost to run, which cards of a story were viewed, and the ratings and hides left on captions. What is recorded is counts, durations, and yes/no facts. Your captions, your notes, your trip titles, your filenames, and your email address are never part of it.

Two coarse details are recorded alongside those actions: whether the request came from a phone, a tablet or a desktop, and which countryit came from. The country is worked out by Vercel’s network from the connecting IP address before the request reaches this app. It is the country only — never a region, a city, or a coordinate — and it is not taken from your photos.

When you first sign in, one row is written for your account holding your account ID, the date the account was created, and that same country. It is what lets me answer how many people signed up in a month and roughly where from. It is deleted when your account is.

This is measured by TravelMontage itself, not by an analytics company. There is no third-party analytics product, no advertising, and no tracking pixels. Nothing is shared with anyone, and none of it leaves the same database your trips are in.

Anonymous visitors are not given an identifier to carry around. Instead, each recorded action is tagged with a one-way fingerprint calculated from your IP address, your browser’s user-agent string, a secret, and today’s date. Your IP address is never stored — only the fingerprint, which cannot be turned back into it. Because the date is part of the calculation, the fingerprint changes every day: two visits a day apart cannot be connected to each other. Once you sign in, actions are recorded against your account ID instead, which is how your own history persists.

Cookies

Two kinds, both strictly functional. Clerk sets cookies to keep you signed in. TravelMontage sets one cookie, tm-theme, holding the single word light or dark so the page can render in your chosen theme without a flash, and so that choice survives signing out. Nothing here is used for advertising or cross-site tracking, which is why there is no cookie banner. The usage measurement described above deliberately uses no cookie at all — that was the point of the daily fingerprint.

This is the part most worth understanding, so it gets its own section.

To write a caption, TravelMontage sends a small number of photos from each moment to Anthropic’s Claude model, routed through Vercel AI Gateway. Photos are downscaled to at most 768 pixels first — the model receives a low-resolution copy, not your full-size image. Along with the images it receives the place name, the date, and any note you wrote for that trip or moment, because those are what make a caption specific rather than generic.

Only the photos actually chosen to appear in your story are sent this way, not everything you uploaded. The model’s reply — the caption text — is stored with your trip. The images are sent for that one request and are not retained by TravelMontage anywhere outside your own trip’s storage.

Anthropic and Vercel process this data as service providers under their own terms, which do not permit using it to train their models. They may retain request data briefly for abuse monitoring. I do not use your photos, captions, or notes to train anything, and I do not sell or share them with anyone for advertising.

TravelMontage runs on other companies’ infrastructure. These are all of them:

Clerk

Accounts and sign-in. Holds your email address and profile details.

Vercel

Hosting, server logs, and Blob storage for your photos. Also operates the AI Gateway that requests pass through.

Neon

The Postgres database holding trips, photo records, coordinates, captions, and notes.

Anthropic

Writes captions and narration from downscaled photos, as described above.

Mapbox

Turns coordinates into place names. Coordinates are rounded to three decimal places — roughly a 100-metre cell — before being sent, and the answer is cached, so Mapbox receives a coarsened location and not a precise trace of where you stood. Your exact coordinates are never sent to Mapbox.

I do not sell your personal information, and I do not share it with anyone other than the providers above, except where the law requires it.

The infrastructure above is operated primarily from the United States, and photo storage for this project is in a US region. If you are in the United Kingdom, the European Economic Area, or elsewhere outside the US, using TravelMontage means your data is transferred to and processed in the United States. Those transfers rely on the standard contractual protections each provider offers.

A story is private to your account until you create a share link. Creating one mints a long random address that anyone holding it can open without signing in — it does not reveal your email address or your other trips. You can revoke a link at any time, which stops the story page from loading for anyone who has it.

Revoking the link does not change the photo file URLs described earlier. Someone who saved a direct image address while the story was shared can still reach that image. Deleting the trip deletes the files themselves, which is the way to make them unreachable.

• Trips, photos, and captions are kept until you delete them or delete your account.
• Deleting a trip removes its database records and its stored image files, including the resized copies.
• An upload abandoned partway through — photos sent but the trip never finished — is cleaned up automatically after 24 hours.
• Cached place names are stored against coarse coordinate cells, not against you, and are kept to avoid repeating lookups.
• Usage records are kept indefinitely. They are what the product is measured by over time — whether people come back months later, what a story cost to build last year — and a rolling window would erase exactly those answers. They carry no captions, no note text, no filenames, and no email addresses. The daily fingerprint that tags the anonymous ones stops being linkable to anything after a day, so an old record is not a record of a person. If you ask me to delete your data, the usage records tied to your account go with it.

Wherever you live, you can ask me to show you what data is held about you, correct it, export it, or delete it. You can do the last two yourself at any time from your settings, and delete individual trips from your library. For anything else, email aditya130805@gmail.com and I will respond within 30 days.

If you are in the EEA or UK, the GDPR gives you the rights to access, rectification, erasure, restriction, portability, and objection, and the right to complain to your local supervisory authority. The legal bases I rely on are performance of a contract (to build the story you asked for), legitimate interests (keeping the service running and secure), and consent where you chose to upload photos containing location data.

If you are a California resident, the CCPA gives you the rights to know, delete, correct, and opt out of sale or sharing. TravelMontage does not sell or share personal information, so there is nothing to opt out of, and I will not discriminate against you for exercising any right.

TravelMontage is not intended for anyone under 13, and I do not knowingly collect information from children under 13. If you believe a child has created an account, email me and I will remove it. If you are between 13 and 18, please use TravelMontage only with a parent’s or guardian’s permission.

Traffic is encrypted in transit, data is encrypted at rest by the providers above, and access to the production database and storage is limited to me. I want to be straightforward that no service can promise perfect security, and that the public-URL behaviour described earlier is a real characteristic of how photos are served, not an oversight I have hidden in a clause.

If this policy changes, the date at the top changes with it. For a change that materially affects how your data is handled, I will make a reasonable effort to tell account holders rather than quietly editing the page.