Privacy
Privacy policy
In short. This website uses no cookies and no analytics. If you join the waitlist, we keep your email address only to tell you when the app launches. The app keeps your trip on your phone; it only leaves your phone when you choose to sync it with a trip code. We don't sell data and we don't show ads.
Who we are
Shu Shu Travel is a trade name of VVDS Beheer B.V., Plantage Muidergracht 99 C 12, 1018 TN Amsterdam, the Netherlands, registered with the Dutch Chamber of Commerce (KVK) under number 94083223. We are the controller for the personal data described here. Questions or requests: info@shushutravel.com.
This policy covers the website shushutravel.com, the waitlist and the Shu Shu app, which is a prototype today. Where something will change when the app is in the App Store and Google Play, we mark it Later.
This website
- No cookies, no analytics, no tracking. That is why there is no cookie banner.
- No third parties. Fonts, images and scripts are served from our own server. Your browser does not contact Google or any other service when you visit.
- Server logs. Our hosting provider, Strato AG (Berlin, Germany), processes technical data when you visit: your IP address, the time, the page requested and your browser type. This is needed to deliver the site and keep it secure (legitimate interest, Article 6(1)(f) GDPR). Strato acts on our behalf and keeps these logs for a short period only.
The waitlist
| What | Your email address, the month you plan to travel (optional), the time you signed up and which version of the consent text you agreed to. |
|---|---|
| Why | To send you one email when Shu Shu is available in the App Store and Google Play. We use the travel months only as a total count, to see when people travel. |
| Legal basis | Your consent (Article 6(1)(a) GDPR), which you give with the checkbox. You can withdraw it at any time. |
| How long | Until we have sent the launch email, and never longer than 12 months after you signed up. Then we delete your address. |
| Where | In a file on our server at Strato, outside the public part of the website. We also receive a notification email with your address in our mailbox, info@shushutravel.com, which we delete together with the list. |
| Deleting | Email info@shushutravel.com from the address you signed up with and we delete it, within one month and usually much sooner. |
We don't send a confirmation email when you sign up. That means someone could enter your address without you knowing. If you get our launch email and never signed up, reply and we'll delete your address straight away.
To stop automated sign-ups, the form limits how often one connection can submit it. For that we store a scrambled code (a one-way hash) of your IP address for at most one hour. We can't turn it back into your IP address and it is never linked to your email address.
The app (prototype)
The Shu Shu prototype runs in your browser as an artifact on claude.ai, a service of Anthropic. To open it you use claude.ai, so Anthropic's privacy policy also applies to that visit.
Your trip stays on your phone
Your trip is stored in your browser's local storage on your own device: route and dates, your swipes, the day plan, notes, expenses, booking references, the packing list, and how many free swipes you have left. We don't receive any of this unless you use a trip code.
Sync with a trip code
If you enter a trip code, your trip is copied to a shared database so that another phone with the same code sees the same plan. This copy includes your choices, dates, notes, "Something's off" notes, booking references, expenses, whether the trip is unlocked, and the name you enter for sync messages.
- Anyone who knows the trip code can see and change that trip. Choose a code that is hard to guess and share it only with your travel companions.
- In the prototype, this database is provided by Anthropic as part of claude.ai.
- As the maker of the prototype we can read the synced trips. We use them, and especially the "Something's off" notes, to fix information and improve the app.
- Legal basis: providing the sync you asked for (Article 6(1)(b) GDPR) and our legitimate interest in improving the app (Article 6(1)(f) GDPR).
- To delete the synced copy, email us the trip code. "Clear everything and start fresh" in the app removes the trip from your phone.
What the prototype does not do
- No analytics, no advertising, no tracking tools. (claude.ai may collect its own usage data; see Anthropic's policy.)
- No real sign-in. The "Continue with Apple / Google / email" buttons in the prototype don't do anything yet.
- No real payments. Unlocking a trip in the prototype is a test and costs nothing.
Things your browser loads from others
- Fonts. The prototype loads its fonts from Google Fonts, so your browser contacts Google's servers and Google receives your IP address. Later the app has its fonts built in.
- Links you tap. Route buttons, booking sites and official sources open in another service (for example Google Maps). Nothing is sent until you tap, and then that service's privacy policy applies.
When the app is in the stores Later
Before the app launches we will update this policy. These are the changes we expect:
- Accounts. You'll be able to save your trip with Sign in with Apple, Google or an email code. We'll then store an account ID and, where you share it, your email address, so your trip is safe on a new phone.
- Sync. Synced trips will move from claude.ai to our own storage or a hosting provider in the EU where possible.
- Payments. The €19.99 purchase runs through the Apple App Store or Google Play. They process your payment details; we only receive a confirmation that the trip is unlocked.
- Deleting your account will be possible in the app itself.
Who else receives data
- Strato AG, Germany: website hosting and email.
- Our email provider for info@shushutravel.com (Strato, and Google Workspace once we move our mailbox).
- Anthropic: hosts the prototype and its sync database.
- Google: fonts in the prototype (see above).
Anthropic and Google may process data in the United States. Such transfers rely on the EU–US Data Privacy Framework or the European Commission's standard contractual clauses. We never sell personal data and we don't share it for advertising.
Your rights
You have the right to access, correct and delete your data, to restrict or object to processing, to receive your data in a portable format, and to withdraw your consent at any time. Email info@shushutravel.com; we reply within one month. If you think we handle your data incorrectly, you can complain to the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens, or to the authority in your own EU country.
Children
Shu Shu is not meant for children under 16. Don't join the waitlist if you are under 16.
Security
The website is served over an encrypted connection. The waitlist file is not reachable from the web and only we have access to it. We keep as little data as we can and delete it when we no longer need it.
Changes
We will update this policy when the app or the site changes, and always before the app launches. The date at the top shows the latest version.