Legal
Privacy & your data
What we hold, why we hold it, and the controls you have.
What we hold
Your trip brief (coarse bands only — we never store raw budgets or free-text notes in our decision log), your saved trips, your explicit taste preferences, your decision history (pins/rejects/choices, coarse), and — if you have an account — your Clerk-managed identity and email.
Lawful basis (Swiss FADP / EU GDPR — Geneva beachhead)
We process the core decision on the basis of providing the service you requested; account data on the basis of your account; watch emails on the basis of your explicit opt-in. We do not sell personal data and we do not advertise.
Retention
Account data is kept while your account exists. Deleting your account removes your saved trips, watches, taste profile, your sign-in identity, and every decision-history row linked to your account — including rows merged in from your anonymous sessions. Decision rows recorded anonymously and never merged into an account carry no account link and remain only as coarse statistics not linked to any account. Deletion removes the rows; it does not tombstone. Share links created from your account are deleted with it. Links created anonymously and never merged into an account expire on their own (30 days).
Cookies
Functional only: an anonymous session id (keeps your pins and decision history on this device), your display-currency preference if you set one, and the sign-in cookies from our auth provider (Clerk). No advertising or cross-site tracking cookies.
Your rights
You can view and edit your taste, export a machine-readable copy of your data, and delete your account and data from your account page at any time.