Privacy
We do not hold your trip in the clear.
Umrah Trip Planner is built so a family can line up quotes without creating an account or handing a readable notebook to a server.
No accounts
There is no sign-up, no login, no email list tied to the notebook, and no user database. We cannot look up “your” trip on the server by name or address because that record does not exist.
Default: this device only
Until you share, the notebook lives in localStorage in that browser. It does not sync to us. Clearing site data on the device deletes it. Other browsers and other phones do not see it unless you send a family link.
Optional share: encrypted in the browser
A family link encrypts the notebook with AES-256-GCM on the device before anything is uploaded. The server stores only{ rev, iv, ct, authHash } — revision, initialization vector, ciphertext, and a hash used to authorize writes. It does not store the key and cannot read the trip.
The key lives in the URL fragment after #k=. Fragments are not sent to Cloudflare, nginx, or Node with the HTTP request. Write access is proven with an HMAC derived from the key; the server keeps a hash of that proof, not the key itself.
The full link is a password. Anyone who has it can decrypt and edit. The path without the fragment cannot.
What we do not index
Marketing pages on this site may be indexed. The planner at /appand the share API at /api are disallowed for crawlers and the planner responds with noindex. Trip contents are not published as public pages.
No sale of data
There is no user database to sell, rent, or broker. We do not run ads against trip contents. Server logs for the share API are for operating the service (rate limits, errors), not for building profiles of travellers.
Your controls
- Stay local: never create a family link.
- Stop sharing on a device: the local notebook remains; the link is dropped there.
- Revoke a leaked link: create a new room and send only the new full URL.
- Erase local data: clear this site’s data in the browser.