Privacy notice

tr3ttongruppen operates this site and decides what is stored here. Write to trip@jahrl.com about anything on this page.

The site is run for a private group of friends rather than as a business service. Whether that makes it purely personal use in the legal sense depends on how it is actually used, so the rules below are applied regardless of how that question is answered.

• Your account. Your email address, so a one-time sign-in code can be sent to you. You never set a password.
• Your profile. A display name and, if you choose, a portrait. The profile belongs to your account across the whole app, not to a single trip.
• Membership and access requests. Your role, whether your access is waiting, active or ended, and the message you sent when asking to follow the trip.
• Sign-in records. The time of each completed sign-in. Admins and Travellers can see when each member last signed in. This is how the group knows the private site is being used by the people invited to it.
• Photos. The picture, the time the camera recorded, the time it was uploaded, who uploaded it and, when a place is confirmed, a location. Uploaded pictures are rebuilt by the app, which removes the camera data inside the original file.
• Comments. The text, the author and the time, all recorded by the server rather than the browser.
• Plan and route. Dates, titles, notes and the places chosen for each day.
• Eurosplit. For the three travelling friends only: the date, description, amount and who paid.
• Vault. Travel papers such as bookings, insurance, ferry tickets and other documents, and separately identity papers.
• Activity records. A short history of changes to membership, roles, trip settings and documents, so it is possible to see who changed what.

• Admins can see members' email addresses and last sign-in, manage roles and access, and edit the trip's settings. An Admin can also change another member's display name and portrait; because the profile is app-wide, such a change applies everywhere that profile is used.
• Travellers can see members' last sign-in, the full plan including private notes, exact confirmed places, Eurosplit and the Vault documents they own or that are shared with them.
• Visitors see only what has been shared with them: days marked visible, photos that have been shared and are past the trip's publication delay, and comments. Visitors receive positions rounded to a broad area and broad place labels, never the exact point or street address. Visitors have no access to Eurosplit, the Vault or anyone's email address or sign-in figures.
• Anyone with the link can read the open journey page when an Admin has switched it on. That page shows the shared days, the route, and the shared photos with their titles, captions and broad places, together with the names and portraits of the people who added them. It never shows comments, Eurosplit, the Vault, email addresses, sign-in figures, private notes or exact positions. The page asks search engines not to list it, but that is a request, not protection: the link can be passed on, the pictures can be saved by anyone who sees them, and a search engine may ignore the request. An Admin can switch the open page off again, and a single picture can be kept off it without being deleted. Switching off stops new views, but copies someone already downloaded or cached cannot be recalled.
• Identity papers are visible only to the person who uploaded them, or to named members that person chose. Each opening needs a fresh code sent by email, valid for a few minutes and usable once.

• Hosting, database and file storage — the platform are on Supabase, in an EU region. All photos and documents are in private storage; there are no public file links.
• Maps and place search (Mapbox) — When a map is shown, your browser requests map tiles from Mapbox directly, so Mapbox sees your device's network address and which part of the world is being displayed. When someone searches for a place while planning, the text typed into that search box and the chosen coordinates are sent to Mapbox, together with requests for driving distance and route shape between two chosen points. Photos, captions, names, notes, and trip records are never sent. Mapbox may also collect its own usage measurements from the map component.
• Email — sign-in codes and notices are sent from notify.jahrl.com through the platform's email service.

Hosting, the database and file storage are in an EU region, and sign-in email is sent from Sweden. Mapbox is a United States company and its maps, place search and route service are delivered from its own global network, so those requests are not limited to Europe and involve a transfer outside the EU under Mapbox's own terms. Nothing about members, photos or trip records is part of that; it is map tiles, typed place names, chosen coordinates and your device's network address. The signed processing terms for each service are being confirmed and will be named here once verified.

There is no analytics, advertising or tracking on this site. Your browser keeps your sign-in session and your light or dark preference, both needed for the site to work as you asked. That is why there is no cookie banner.

Each period below runs from the trip's end date as set on the trip settings page, and is applied automatically by a nightly clean-up.

• Identity papers: removed 30 days after the trip's end date.
• Other Vault documents: 12 months after the trip's end date.
• Photos and comments: kept for as long as the trip journal exists. They are not removed automatically; you can delete your own at any time, and you can ask for them all to go.
• Eurosplit entries: 12 months after the trip's end date.
• Access requests and invitations: 6 months after they are decided, and 6 months after they were sent if never answered.
• Sign-in records: 12 months after each sign-in.
• Activity records: 24 months after each entry.

Removing something takes it out of the running site straight away. Backup copies are kept for a limited period by the platform and expire on their own; if a backup ever has to be restored, deletions already made are applied again before the site is opened.

You can ask for a copy of what is stored about you, ask for a correction, ask for removal, object to something being stored, or withdraw a choice you made, for example by removing an identity paper you uploaded. Write to trip@jahrl.com.

Requests are handled without undue delay and normally within one month. If more time is lawfully needed, you will be told within that first month, with the reason. We aim to acknowledge a request within a few days, but that is our own service target, not a deadline that replaces the one above.

If you are not satisfied, you can complain to the Swedish Authority for Privacy Protection (IMY), imy.se.

Your Profile page has a "Delete my account" section. This deletes the whole account, not one trip: your name and portrait belong to the account everywhere it appears. You prove your email with a fresh code, then confirm. Your access ends immediately, and the clean-up runs overnight: profile, portrait, photos and their files, your comments, other people's comments on your photos, Vault documents and their files, shares naming you, memberships, access requests and sign-in records. History entries are reduced to the single fact that an account was deleted, and your sign-in account is removed last. You get one email when it has finished, or telling you what is still outstanding, failed steps are retried automatically each night.

Shared expense entries stay, so the other two people's balances remain correct and the deleted person's share is not handed to them. The description becomes a neutral label and the entry is no longer linked to an account or profile, but a record in a group of three is not anonymous, and it is described here as what it is. Those entries go with the rest of the shared expenses 12 months after the trip's end date.

Removal takes effect in the running site straight away. Backup copies expire on their own schedule; this is not the same thing as the data being gone from every backup the moment you confirm.

Deleting an account does not by itself stop the same email address being invited or asking for access again later.