Awayfolk
Privacy
Seller and operator: Gard Visdal Halvorsen, Bjerregaards gate 68A, 0174 Oslo. Phone: +47 472 89 490. E-mail: hello@awayfolk.app.
What we store
Your name and the email address verified by your sign-in provider or an email code, your trips and memberships, and the ideas, plans, lists, shared expenses, repayments, photos and memories you add. Your optional travel style stores the travel frequency, pace and interests you choose, together with your AI-sharing choice. You can edit or clear these choices in Profile. Uploaded photos are compressed in the browser; metadata from the original photo is not included. For existing Trip Pass purchases, Stripe handles the payment and receives the trip’s name, which appears on the receipt. We keep only a record that the trip was paid, the amount and when, never card details.
Who sees what?
The travel party shares the itinerary, ideas, booking notes, shared expenses, repayments and memories. Personal packing and outfits are private. Shared packing lists and checklists are shared with the travel party, and everyone on the trip sees how far each person has come with their own packing, as a count, never what is on it. A connected AI can use the trips you are on, including new ones, unless you limit it to chosen trips on the AI page; it never sees another traveller’s personal lists. Your personal travel style is private from the group. A connected AI can read only your structured travel-style choices, and only while you have explicitly enabled AI sharing in Profile. Switching it off stops future reads; it cannot remove information already present in an earlier AI conversation.
Maps and place search
When a map is shown, in the app or on a card in an AI chat, OpenFreeMap receives your IP address and the map area; in the few browsers that cannot draw it, OpenStreetMap does instead. Place searches you send, and the place a card names when it has no pin, are shared with Photon / Komoot from our server; the trip’s name, travellers and notes are not sent. Name searches are cached for seven days. When you explore an area, Geoapify receives the chosen area, category and any search text through our server; results are cached for one day. Available place photos come from Wikipedia and Wikimedia Commons with credit. Google Maps opens only when you choose a map or directions link.
Providers
Cloudflare is used for storage and hosting, Auth0 and Google for sign-in, Apple for Sign in with Apple when available, and Stripe for payments on the website. When you choose email sign-in, Resend receives your address and the one-time code to deliver the email, without trip content. Passwords are stored as salted, one-way hashes. Trip chat is stored by Awayfolk for the current members; AI connections cannot read it. If you enable notifications, your browser’s push service receives an encrypted generic notification, without message text or place names. You can turn notifications off on each device and mute individual trips. The mobile app stores session credentials in the device’s Keychain or Keystore. When you connect Claude, ChatGPT, Gemini or Grok, the content you give access to is also processed by that AI service. A price estimate you ask for sends the card’s title, category and place, with the trip’s destination, month and number of travellers, through Vercel’s AI Gateway to OpenAI; notes and travellers’ names are never sent. A tailored packing list you ask for sends, the same way, the trip’s destination as you see it, its month, the chosen trip styles, the number of nights and travellers, the titles and categories of the trip’s ideas and itinerary and the titles already on the packing lists, never notes or names. The weather on a trip day comes from MET Norway: our server sends the day’s position, rounded to about a kilometre, and nothing about you. When you paste a link into the idea bank, our server fetches that page and its picture to fill in the card; the site sees Awayfolk, not you. Destination and place photos, including card photos in AI chats, can load directly from Wikimedia Commons, which receives your IP address and the image URL; that URL may reveal the place shown. To find a destination photo when you create a trip, our server searches English Wikipedia for the destination you type and reads the photo’s credit from Wikimedia Commons; for AI chat cards it looks up the referenced article the same way. Trip names, travellers’ names, notes and sign-in tokens are never sent. Maps come from OpenFreeMap. When a card names a place but has no pin, our server looks that name up with Photon (OpenStreetMap data) near the trip’s destination, and nothing about you is sent.
Storage and access
Trips and photos are stored with Cloudflare in Europe. Awayfolk keeps the name and verified email address provided at sign-in, never your provider’s password. Email verification records and hashed abuse counters are removed by the nightly cleanup after they expire. A trip is kept until its owner deletes it or asks us to, and until then everyone on it can read it. Temporary PDF exports are kept for seven days. We keep the record of each Trip Pass payment (the trip and buyer, amount, time, and Stripe checkout, payment and refund references) for five years after the end of the accounting year, as Norwegian bookkeeping law requires, even if the trip or account is deleted. You can delete your account from your profile. Shared trips you own must first be transferred to another member. Personal trips, uploaded photos and your chat messages are deleted; other shared contributions, including recorded expenses and repayments, can remain for the other travellers. You can also request a copy, correction or deletion of your data by writing to the operator; we respond within 30 days. You can also complain to Datatilsynet.
Measurement
To see whether Awayfolk works for people, we count sign-ups, the days someone opens it, invitations sent and accepted, trips, payments and file sizes, and visits to the public pages: which page, the campaign or site a visit came from, the browser language and the country, but never the IP address. We use necessary cookies for sign-in and verification, with no advertising tracking.