Service providers

Updated: September 16, 2026

Our Privacy Policy says we share your information with the services that run our studio. This is the list, and what each one receives. When we add a service, we update this page.

Every one of them acts on our instructions and may use your information only to do the job we've given them. None of them may use it for their own marketing.

Running your trip page

Netlify—hosts our website and trip pages.
Google—Firebase stores your trip data and handles sign-in; Google Workspace runs our email; Google Maps powers maps, place search and travel times, so an address you type is sent to Google to find matches; Google Fonts serves our typefaces. Loading a page with a Google map or font connects your browser to Google directly, so Google sees your IP address and which page you're on.
CARTO—map imagery on trip pages and quizzes. Your browser loads tiles from CARTO directly, so CARTO sees your IP address and the area you're viewing. Underlying map data comes from OpenStreetMap.
Cloudflare—privacy-preserving analytics on our public marketing pages. Sets no cookies and doesn't track you across sites.

Reaching you

Twilio—sends sign-in codes by SMS, verifies phone numbers, and carries calls we place from our planning tools. When you've agreed to call notes, Twilio transcribes using its speech partner, Deepgram.
Resend—sends transactional email.
Postmark—receives and parses email you send to our desk address, or that we're copied on, including attachments.
Meta—receives and replies to your Instagram messages.
ntfy—push notifications that tell us on our phones when something arrives. A notification can include your name and a short preview.

Planning the trip

Anthropic—the AI behind our planning work. Your trip and traveler details are sent to its models so we can draft plans and packing lists, read documents and email you send, organize what you told us, and summarize what you're responding to—including dietary needs, allergies and children's details where those matter to the plan. Your information is not used to train its models.
Microsoft—Azure AI Document Intelligence reads passport data pages so you don't have to type them. We ask Microsoft to delete its temporary copy as soon as we've read it. If you email a photo of an ID, we hold the image where only Zach can open it until he's checked it, then delete it. The details go on your record; the image doesn't.
Brave Search—destination, hotel and restaurant research. We send search terms about the trip, such as a city or a cuisine you like, never your name or contact details.
Apify—when you share an Instagram or TikTok link, we send the link to pull its caption and transcript so we understand what you liked. The link only, nothing about you.
Spotify—creates a trip playlist when your trip includes one. New playlists are private. A few older ones are public on our profile, titled with a short trip code rather than anyone's name.

Booking and payment

Fora—the host agency we book through. Fora holds a client record for you and, if you put a card on file for bookings, holds that card. We receive only the last four digits.
Stripe—processes payments. We don't store full card numbers.
Travel suppliers—hotels, transport providers, restaurants and venues, as needed to hold and run your reservations. This can include your name, your dates, and any dietary needs or allergies a venue needs in order to keep you safe.