Privacy Policy

Operated by Vantage Rewards Inc. ("we," "us," or "our")
Effective date: August 26, 2026

1. Introduction

This Privacy Policy explains how Vantage Rewards Inc., a corporation incorporated under the Canada Business Corporations Act, collects, uses, discloses, and protects your personal information when you use Farrow (the "Service"), including our website and applications.

By creating an account or using the Service, you consent to the practices described in this Policy. If you do not agree, please do not use the Service.

We are a Canadian company and handle personal information in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and other applicable Canadian and United States privacy laws.

2. Information We Collect

2.1 Information you provide

• Account information. When you register, we collect your name, email address, username, password credentials, and optional profile photo. Authentication is handled by our service provider, Clerk (see Section 5).
• Trip and journal content. Entries you create, including trip names, dates, descriptions, ratings, captions, and the places you log (hotels, restaurants, activities, sights, and flights).
• Photos and media. Images you upload to your journal entries. We automatically remove embedded location metadata (EXIF GPS data) from photos you upload before they are stored or displayed.
• Location information you enter. Places you pin or log are location data you actively choose to provide. We do not collect continuous or background device location, and we do not track your real-time whereabouts.
• AI trip planner inputs and plans. When you use the trip planner, we process the trip details you provide (destination country and cities, or "surprise me"; either specific travel dates or rough months plus a trip length; pace; interests; an optional budget range with its currency; and who you are travelling with, including optionally how many of you there are) together with a short summary of your top-rated journal places (place name, city, country, category, and rating) to personalize suggestions. Most of these are chosen from fixed options, but two fields are free text you write yourself: an optional interests note, and any change requests you type when asking the planner to refine a generated itinerary. We store your selections, your free-text planner inputs, and the trip concepts and itineraries generated for you with your account so you can revisit them (see Sections 4 and 8).
• Communications. Messages you send us, such as support requests or feedback.

2.2 Information collected automatically

• Technical and log data. IP address, browser and device type, operating system, request timestamps, and error logs, collected through our hosting infrastructure (Cloudflare) for security, debugging, and service operation.
• Usage data. Basic information about how you interact with the Service (e.g., pages viewed, features used) for the purpose of operating and improving the Service.
• Approximate location at signup. We derive an approximate country from your IP address at signup to set a default currency for your account, which you can change.

We do not use third-party advertising trackers and we do not sell your personal information.

2.3 Information we do not collect

• We do not collect continuous GPS or background location from your device.
• We strip GPS metadata from uploaded photos.
• We do not collect payment information (the Service is currently free; this Policy will be updated before any paid features launch).

3. How We Use Your Information

We use personal information to:

1. Provide, maintain, and operate the Service, including displaying your journal entries and shared content according to your visibility settings;
2. Authenticate your account and secure the Service;
3. Provide AI-assisted trip planning when you use that feature;
4. Respond to your inquiries and provide support;
5. Monitor, debug, and improve the Service, including detecting abuse and enforcing our Terms of Service;
6. Comply with legal obligations.

We do not use your personal information for targeted advertising, and we do not use your journal content to train our own or third-party machine learning models.

4. AI Features

When you use the trip planner, the trip details you provide (listed in Section 2.1) — including your free-text interests note and any free-text change requests, if you write them — and a summary of your top-rated journal places (place name, city, country, category, and rating) are sent to Anthropic, PBC, our artificial intelligence service provider, to generate personalized trip concepts and itineraries. No other journal content, and none of your account details (such as your name or email address), is included. Anthropic processes this data as our service provider under commercial API terms which provide that customer API data is not used to train Anthropic's models. We store the resulting concepts and itineraries with your account; when you revisit a stored plan, it is served from our own systems and is not sent to Anthropic again. If you ask the planner to revise an itinerary, the current itinerary and your change request are sent to Anthropic to generate the revision.

Do not include sensitive personal information (such as health, financial, or government identification details) in trip planner requests.

5. Service Providers and Disclosure

We share personal information only as described below:

• Clerk, Inc. — authentication and account management (processes your email, name, and login credentials).
• Cloudflare, Inc. — hosting, storage, content delivery, and security. Your data, including journal content and photos, is stored on Cloudflare's infrastructure.
• Anthropic, PBC — AI processing for the trip planner feature, as described in Section 4.
• Geoapify GmbH — place search. When you search for a place to log or pin, your search text is sent from our servers to Geoapify's geocoding API to return matching places. If you are logging the place into one of your trips, the country of that trip is used to limit results to that country, and places you have already logged in it rank nearby results first; if nothing in that country matches, the search runs worldwide. Nothing else is sent — no account details — and the request comes from our infrastructure, not your device.
• Legal and safety disclosures. We may disclose information if required by law, court order, or lawful government request, or where reasonably necessary to protect the rights, safety, or property of our users, the public, or the Service.
• Business transfers. If we are involved in a merger, acquisition, financing, or sale of assets, personal information may be transferred as part of that transaction. We will provide notice of any such change in ownership or control of your personal information.

We do not sell, rent, or trade personal information to third parties.

6. Your Content and Visibility Controls

The Service is designed to be private by default:

• Journal entries are visible only to you unless you explicitly share them.
• You may share content at the day or trip level. Shared content is visible to other users according to your account visibility setting (public or private/followers-only).
• You can change your account between public and private at any time.
• You control whether other users can follow you (private accounts require approval).

Please remember that content you share publicly can be viewed, and potentially copied, by others. Consider carefully before sharing location-identifying content, particularly in real time.

7. Cross-Border Data Transfers

We are based in Canada, and our service providers (Cloudflare, Clerk, Anthropic, and Geoapify) are based in the United States and Germany and operate global infrastructure. Your personal information may be stored and processed in Canada, the United States, and other jurisdictions where our providers operate. While in another jurisdiction, your information may be subject to access by that jurisdiction's courts, law enforcement, and national security authorities under applicable local law.

8. Data Retention

We retain your personal information for as long as your account is active or as needed to provide the Service. Trip planner history is retained for as long as your account is active so that you can revisit your plans. When you delete your account:

• Your journal entries, photos, and shared content are deleted from active systems;
• Your trip planner history — the parameters you selected and the trip concepts and itineraries generated for you, along with associated usage records — is deleted from active systems;
• Residual copies may persist in backups for a limited period before being purged;
• We may retain limited records (such as logs) where required for legal compliance, security, or dispute resolution.

9. Security

We use commercially reasonable technical and organizational measures to protect personal information, including encryption in transit, access controls, authentication safeguards, and removal of photo location metadata at upload. No system is perfectly secure, and we cannot guarantee absolute security. If a breach of security safeguards creates a real risk of significant harm, we will notify affected individuals and report to the Office of the Privacy Commissioner of Canada as required by PIPEDA.

10. Your Rights and Choices

Subject to applicable law, you may:

• Access the personal information we hold about you;
• Correct inaccurate information (most profile and content data can be edited directly in the app);
• Delete your account and associated content through the in-app account deletion feature or by contacting us;
• Withdraw consent to our handling of your information, subject to legal or contractual restrictions (withdrawing consent may require closing your account);
• Complain to a supervisory authority. In Canada, this is the Office of the Privacy Commissioner of Canada (priv.gc.ca).

Residents of certain U.S. states may have additional statutory rights (such as rights to access, delete, correct, and port personal information). We extend the rights listed above to all users regardless of location. To exercise any right, contact us at support@farrow-trips.com. We may need to verify your identity before acting on a request, and we will respond within the timelines required by applicable law.

11. Children

The Service is intended for adults. You must be at least 18 years of age to use the Service. We do not knowingly collect personal information from anyone under 18. If we learn that we have collected personal information from a person under 18, we will delete it. If you believe a minor has provided us personal information, contact us at support@farrow-trips.com.

12. Accountability and Contact

Vantage Rewards Inc. is responsible for personal information under its control and has designated a privacy officer accountable for compliance with this Policy.

Privacy Officer / Contact:
Vantage Rewards Inc.
support@farrow-trips.com

13. Changes to This Policy

We may update this Policy from time to time. If we make material changes, we will notify you through the Service or by email before the changes take effect, and where required by law we will seek your consent. The "Effective date" above indicates when this Policy was last revised.