Privacy Policy

InsideOut is operated by AI Story, Inc., a company incorporated in Delaware, United States, the data controller for the data described here. Contact: hello@insideout.guide.

We built InsideOut to need as little of your data as possible. There are no accounts, no advertising trackers, and we never sell data.

When you buy a guide

• The email address you enter for delivery, and the email Stripe collects during payment. We use them to send you your guide link and to handle a refund if you ask for one. We also use this address to tell you about changes to the product that may matter to you: a new city opening, new things you can do with your guide. You can unsubscribe from those in one click. Emails about the purchase itself (your guide link, a refund) always come through. We send nothing else, and we never pass your address on.
• Purchase details: what you bought (days, areas, categories), the price, and Stripe’s payment reference. We never see your card number.

When you use your guide

• The state of your guide: which places you marked as visited, your likes, your personal notes, and places you add yourself. This is stored so your guide works across devices and visits. Your notes are visible only in your guide.
• How many times the guide was opened and when it was last opened, so we know whether guides get used at all.
• When you search for a place to add, your search text goes to Google Places. Without it we cannot find the address and coordinates.
• If you asked to be told when you can add more of your own places, we remember that request so we can write to you once, when it becomes possible.

When you browse the site

• Standard technical logs (IP address, browser type) processed by our hosting provider Cloudflare to serve and protect the site.
• Anonymous, cookieless usage statistics (page views), if enabled. We do not use tracking cookies. The site stores your guide state in your browser’s local storage so it works offline; that data stays on your device and is not used to track you.
• Map tiles are served by Mapbox; loading them shares your IP address with Mapbox, as with any content delivery network.

• Delivering your purchase and keeping your guide working: performance of our contract with you.
• Fraud prevention, security, and minimal service statistics: our legitimate interest in running the service.
• Emails about changes to the product: our legitimate interest in telling someone who already bought a guide about services of ours. To object, unsubscribe from any email and we will not write again.
• The email about paid place-adding, if you asked to be told: your consent, which you can withdraw at any time.

Stripe (payments), Resend (transactional email), Cloudflare (hosting and database), Mapbox (maps), Google (place lookup when you add one yourself). They process data on our behalf under their data processing agreements. Some of them are in the United States; transfers are covered by the EU-US Data Privacy Framework or standard contractual clauses.

Purchase records: as long as required for accounting and tax law. Your guide and its state: as long as the guide exists. Emails: until you ask us to delete them (deleting your delivery email means we can no longer resend your guide link). If you unsubscribe, we keep the fact that you did, because otherwise we could not honour it.

If you are in the EU/EEA (or wherever similar laws apply), you can ask us to access, correct, delete or export your data, or object to processing: hello@insideout.guide. We answer within a month. If our answer does not satisfy you, you can take it to the data protection authority in your country.

Because guides have no accounts, include your guide link or delivery email in the request so we can find your data.

InsideOut is not directed at children under 16, and we do not knowingly collect their data.

If this policy changes materially, we will note the new effective date here.