Datenschutzrichtlinie

This policy says what Cursway does with information about you: what we hold, why we hold it, who else sees it, how long it stays and how to have it removed. It covers the site at cursway.com, whether or not you have an account.

It describes the Cursway that exists today, not one we intend to build. Where we do not do something, we say so plainly rather than leave it open.

Cursway is operated by Yury Ivashka, an individual based in Poland. There is no company behind it: the project is not incorporated as a legal entity, and one person is responsible for it and for the personal data it handles. In the language of the GDPR, that person is the controller of your data.

Address for legal matters:
Tadeusza Krępowieckiego 11
01-456 Warszawa
Polska

For anything about your personal data — a question, a request, a complaint — write to legal@cursway.com and put GDPR request in the subject line. We answer within 30 days. You do not need an account to write, and you do not need to go through any other page first.

Most of Cursway works without an account, and most of what you do here leaves nothing with us. What follows is the whole of what we keep.

Your account. If you create one, it lives in our authentication service, Supabase. It holds your email address and, if you signed in with Google or GitHub, the block of details that provider hands over about you: your name and your picture, the username you have there, the id it knows you by, which service issued the sign-in, and whether it treats your address and your phone as verified. Cursway never asks you for a password: you sign in with a link and a short code we email you, or with one of those two accounts.

Your sign-in session. While you are signed in, Supabase keeps a session record, and it carries the IP address and the browser’s user-agent string the session was opened from. It lasts as long as the session does, and it goes with the account.

The sign-in log. Signing in by email writes a line at every step: asking for the sign-in email, that email failing to go out or being refused because too many were asked for, a wrong code, too many tries at the code, and getting in — with the code or with the link. Getting in with Google or GitHub writes a line as well; a Google or GitHub sign-in that fails or is abandoned on their side, and a link from our email that no longer works, leave none. Each line holds what happened, when, the IP address it came from, the browser’s user-agent string, and the account it belonged to, if it belonged to one. Where an email address was involved, the line keeps a fingerprint of it, made with a secret key of ours, rather than the address.

Sign-ins are not all this log holds. Registering an account, asking us to delete it, and changing your mind about that are each written here too, with the same fingerprint of your address and for the same length of time as everything else — so a request to be deleted is itself a line in the log, and section 9 says how long it stays. Three more kinds of line are about us rather than about you: the log noting that it cleared out its own old entries, a note that our outgoing mail hit one of its hourly or daily ceilings, and a note that an account has been erased — with no account id and no address of the person in it, only how many lines the erasure reached.

This log is how a run of failed sign-ins on your account becomes visible instead of silent. The IP address goes into it as it is, not hashed, and this is not the only place holding one: the session record above carries it too. Everywhere else in what we store, an address is turned into a salted hash before anything is written.

Messages you send us. The contact form and the feedback button store what you sent: the text, your name and email address if you gave them, which page you were on, the language of the interface and which of the two you used. A report sent from the map also carries a snapshot of what the map was showing — where it was centred, how far it was zoomed, which layers were on, the departure point you had chosen and the date. Stored with it is a salted hash of your IP address, which is what stops one sender flooding the form; the address itself is not stored. We no longer record the browser’s user-agent string with a message, but messages sent before we stopped still carry it. A message sent through the contact form also reaches us as an ordinary email, and that copy is a separate thing from the stored one — sections 9 and 11 say what follows from that.

What you open on the map. If you accept analytics, opening a layer or following a link from the map writes a line: a random session id that belongs to that browser tab, the kind of event, the layer, the thing it was about — an airport code, a route, a hotel, a place — and your account if you are signed in. Where the line is about a link leading off the site, it also carries which partner or advertiser it led to, the airline where there is one, and the price and currency you were shown. If you do not accept, nothing is written and the session id is never created.

The welcome email. We record that it was sent to you, when, and in which language, so that it is not sent twice.

Roughly where you are. Our host works out a country, a city and approximate coordinates from your IP address and passes them to us with the request. We use them once, to suggest a departure airport, and we do not keep them as data of their own. To answer the next request from the same area without working it out again, the coordinates, rounded to about a kilometre, go into the name under which that suggestion is cached for up to 24 hours — not as they are, but signed with a secret key of ours. That signature is not irreversible: there are few enough places on a map to try them all, so what protects them is that our key stays secret. The suggestion itself is saved in your browser — section 5.

This section is here because a privacy policy that only lists what a company takes tells you half of it.

• No search history. What you type — into the search, into the chat — is not written down anywhere on our side. What is recorded is narrower and it is in section 3: if you accept analytics, the layer you opened and the destination, hotel or place you followed a link to, tied to your account while you are signed in. Refuse analytics and not even that is written.
• No saved trips. Cursway does not save trips to an account.
• No chat conversations. What you write to the chat is not stored on our side at all. It lives in your browser — section 5 — and where it goes to be answered is section 7.
• No password you chose, no phone number, no date of birth, no postal address. We do not ask for any of them.
• No device fingerprinting and no advertising trackers. There is no Google Analytics, no Meta pixel and nothing of that kind on the site. That is a statement about trackers, not about Google: your browser does fetch some company logos from it, and section 7 says so plainly.
• No marketing email. The only messages we send are the sign-in code, the welcome note and the code that confirms you want your account deleted.
• No statistics kept about you after you leave. We build no anonymised aggregates from your activity, so there is nothing of that kind to survive your account.

Cookies. We set only one of them ourselves: the language you choose in the language menu. It is written only when you pick a language there, holds nothing but that language, and is kept for a year, so it survives closing the browser. The others belong to your sign-in session, which sets its own. The Cloudflare anti-bot check that guards the chat and the sign-in form also runs in your browser, and Cloudflare may keep there what that check needs.

Everything else is your browser’s own storage, which is a different thing and much larger. It holds:

• your conversation with the chat, the most recent part of it, with no expiry;
• your departure point, its airport and coordinates, your travel dates and your currency;
• what the map looked like — where it was centred, which layers and panels were open, and the hotels, places and flights you collected on it; these expire after a week;
• small pieces of interface state: the theme, whether the chat panel is open, hints you have dismissed;
• your cookie choice, and — only if you accept analytics — the random session id from section 3.

None of that is telemetry. We do not read it, and storing it sends it nowhere. Where a piece of it is needed to answer something you asked for, it travels with that request and only then: your departure point, dates, the place you are looking at and currency make up the short trip-context line that goes with a chat message (section 7), and a report sent from the map carries the snapshot described in section 3.

To clear it: press Clear conversation — the bin in the corner of the chat — and confirm, and the copy of the conversation your browser keeps is gone. Clear this site’s data in your browser, and everything your browser keeps for the site is gone. A private window keeps nothing after you close it.

Three things wait for your consent, and all three stay off until you give it: the traffic statistics our host collects, the error reporting that runs in your browser, and the map events in section 3.

Everything else is what the site needs in order to work at all — signing you in, remembering your language, checking that you are not a bot, and the state your browser keeps for you — and it does not ask.

You choose on the band that appears at the edge of the first page you open — at the bottom, or under the header on the map; the sign-in pages do not show it. Nothing that waits for your consent runs until you answer, and closing the band without an answer counts as no until you open the site again in a new tab.

To change your mind afterwards, use Cookies. It is in the footer of every page that has one and in the account menu in the header — on the map too. It opens the same band right where you are, showing your current choice; closing it without a new answer changes nothing.

Error reporting on our servers is not part of that choice and cannot be: a server has no way to read a decision stored in your browser. Section 8 says on what ground it runs.

Cursway is assembled out of other companies’ services. These are the ones that can see something about you, and what each of them gets.

• Supabase — our database and our sign-in. It holds everything in section 3 that we store. The servers for this project are in Ireland.
• The AI provider — OpenAI or Anthropic, depending on which model is configured. When you write to the chat we send your message, the recent part of the conversation and the short trip-context line: departure city and its airport code — the one you picked, or, until you pick one, the one we guessed from your IP address — dates, the place you are looking at, currency. We do not send your name, your email address or your account id. When the provider is OpenAI, each message also carries an identifier so that abuse is traced to one person rather than to Cursway as a whole: a hash, made with a secret key of ours, of your account id if you are signed in or of your IP address if you are not. It stays the same from one message to the next; without our key it cannot be turned back into the id or the address, and that key is what protects it. Anthropic receives no identifier.
• Vercel — our host. Every request passes through it, so it sees your IP address, and it is what works out the rough country and city in section 3. It also collects the traffic statistics that wait for your consent.
• Resend — sends our email. It gets the address a message goes to and what is in it. A message you send through the contact form also reaches us as email, so its text and the address you gave travel through Resend as well. The provider is able to record when a link in an email is opened.
• Sentry — collects errors so that we can fix them. In your browser only after you accept; on our servers always. A report identifies a signed-in person by account id, never by email address.
• Upstash — counts requests so that the usage limits work. What it stores is a salted hash, not your address and not your account id.
• Cloudflare — runs the anti-bot check on the chat and the sign-in form. Your browser talks to it directly. How Cloudflare handles this data is set out in its Turnstile Privacy Addendum.
• Search and travel providers — Travelpayouts and Aviasales, Scrape.do, Trivago, Google Routes, OpenRouteService, Transitous. From our servers they receive the search itself: a place, coordinates, dates, the number of guests. Trivago, for one, is sent coordinates and dates when a room price is refreshed, and nothing about the person asking. None of them is given your name, your address or your account. The hotel photos are a different matter: those your browser loads from Trivago itself — see the images below.
• Open-Meteo — weather, air quality and sea conditions. Most of those calls we make from our servers, so it sees ours and not yours. One does not go that way: the weather badge on a ground route is fetched by your browser straight from Open-Meteo, and for that one it sees your IP address.
• Unsplash — the photograph behind a destination header. We send it the city name in English and nothing else. The picture it answers with is then loaded by your browser from Unsplash directly, so it also sees your IP address and which page asked.
• Map tiles, photos, flags, logos and your profile picture — these your browser fetches straight from the companies that host them: the map from OpenFreeMap and CARTO, hotel photos from Trivago, photos of places from Wikimedia, the flags from flagcdn, the logos from Apistemic, wway and Clearbit and, where none of those has one, from Google. If you signed in with Google or GitHub, the picture on your account is loaded from that provider too. Each of them sees your IP address and which page asked for the image.

Affiliate links are a different thing and should not be read as part of this list. Following one takes you to another company’s site, and from that moment their privacy policy applies, not ours. We hand them nothing about you: the link carries which partner it is and which part of Cursway it came from.

Some of these companies may process data outside the European Economic Area.

Running your account is what you asked us for when you created one, and holding what it needs is how that is performed.

Some of it we hold because we have a legitimate interest in Cursway working and in its not being abused. The sign-in log is the clearest case: without it, a run of failed sign-ins against your account is invisible to us and to you, and there is no way to tell an attack from an ordinary evening. Error reporting on our servers rests on the same argument — an error nobody sees is an error nobody fixes — and so do the usage limits.

Analytics and the error reporting inside your browser run on your consent and on nothing else. Withdraw it and they stop.

We have no bookkeeping duty that would oblige us to keep anything: Cursway takes no payments.

• The sign-in log — no longer than 12 months. The IP address and the user-agent string in each line go sooner: no longer than 30 days, after which the line keeps what happened, when, and the fingerprint of the address.
• Map events — no longer than 90 days.
• Messages you sent us — no longer than 24 months. A message belonging to a complaint that is still open can be held back from that clean-up until it is settled.
• Your account — for as long as you keep it. Deleting it works as in section 10.

Those are ceilings and not exact moments, and we would rather say so than round the corner. The removing is done by jobs that run on a schedule — the map events and the messages weekly, the sign-in log monthly, the IP addresses in it nightly — so a line reaching its term waits for the next run and can outlive the term by that much.

One thing the clean-up does not reach: a message you sent through the contact form also came to us as an email, and deleting the stored message does not delete that copy from our mailbox. It lives by the mailbox’s own clock.

What lives in your browser keeps its own clocks, in section 5.

You can delete your account yourself, from your profile page. We email you a code first, to be sure it is you asking.

Access closes straight away. After that you have 30 days to change your mind and keep the account; your profile shows the date. When that window ends the account goes and cannot be brought back, and what is tied to it is erased within 7 days of that. Those are two different clocks and we would rather name both: the first is how long you can still say no, the second is how long it takes us to finish.

What erasing means, place by place:

• the map events are deleted outright, rows and all — clearing the account from them would leave the session id, and that alone still strings your visits together;
• in the sign-in log the line and its time stay, while the IP address, the user-agent and the fingerprint of your address are cleared and the line stops pointing at any account. A security record has to survive as evidence of what happened; what it does not have to do is keep naming you;
• a message you sent us keeps its text and its map snapshot, because someone may still be answering it, and loses your name and your email address. The rest of what was stored with it stays: the salted hash of the IP address it came from, the language of the interface, the page you were on, which form you used, and — on messages old enough to have it — the browser’s user-agent string;
• your account itself goes, and with it the sign-in sessions and their records of where they were opened from.

If you cannot sign in, the button on the profile page is no use to you, and you are entitled to be deleted anyway: write to legal@cursway.com as in section 2.

These are limits of the mechanism. We would rather write them down than let you assume otherwise.

Lines in the sign-in log that never belonged to an account — someone typed an address and never finished signing in — have no account to be found by. We find them by the fingerprint of your address instead, and they are cleared along with the rest. That reaches one address: the one on your account. A line where you typed some other address of yours carries a fingerprint we have no way to recognise as yours, and nothing takes it out early — it holds that fingerprint until it reaches the age in section 9, while the IP address and the user-agent on it are wiped after 30 days, as on every other line.

A message you sent us from some other email address than the one on your account will not be matched either, for the same reason: that address is the only thing tying it to you.

What has already gone to another company lives by their clock and not ours: what you wrote to the chat, at the AI provider that answered it; an error report at Sentry; an email at Resend, including the copy of anything you sent through the contact form; a counter at Upstash; and whatever your requests left in our host’s own logs, which see the IP address they came from. Deleting your account here does not reach inside any of them.

The conversation in your browser is not ours to delete at all. It is yours, and section 5 says how to clear it.

Under the GDPR you can ask us to:

• show you what we hold about you;
• correct it, if it is wrong;
• delete it;
• restrict what we do with it;
• stop doing something we do on the ground of legitimate interest, if your situation weighs against it;
• give you a copy you can take elsewhere.

There is one way to ask, and it works whether or not you can sign in: write to legal@cursway.com with GDPR request in the subject. We answer within 30 days.

About that copy: there is no export button on Cursway. We put the copy together by hand when you ask for it, which is why we do not promise you a particular file format.

If you think we have handled your data badly, you can complain to the data protection authority of the country you live in. You do not have to speak to us first — though we would rather you did, because most of it we can simply fix.

Cursway is not meant for people under 16. We do not ask for your date of birth and we have no way of checking your age, so this is something you tell us rather than something we verify.

If you are a parent and your child has an account, write to legal@cursway.com and tell us which account it is. We delete it and what is tied to it, in the way section 10 describes.

Nothing on Cursway decides anything about you automatically. There is no profiling, no scoring and no automatic ban.

Two things do refuse a request without asking anyone: the usage limits and the anti-bot check. Both decide about one request rather than about you — your account is untouched either way, and the counter behind them expires on its own. Where access is limited or closed, as section 6 of the Terms of Service allows, a person decides it.

When this policy changes, we rewrite the text on this page and change the date under the title.

That is the whole procedure. We do not promise you an email, a banner or a fresh consent screen when it happens, because we have not built any of those, and a promise with nothing behind it is worth less than none.

About your personal data: legal@cursway.com, subject GDPR request.

About anything else — a question, a bug, a link that misbehaves — write to support@cursway.com or use the contact page.