Privacy Policy

Last updated: 24 October 2026

Afterglow turns the photos from a trip you've already taken into a travel diary — and, if you want, a printed book. This page explains, plainly, what happens to your data along the way.

The short version

Your photos are read on your own device. Two switches decide what leaves it, and each works on its own. Use AI features decides whether your photos and the words you write or speak ever reach an AI provider. Back up my trips to my account decides whether your trips — photos, journals and the conversations you record — are copied to your private cloud diary. Both are on when you start, and either can be off while the other stays on. Maps and place names keep working whatever you choose, because Afterglow cannot draw a map or name a stop without them. We sell books and subscriptions, not data. No ads, no tracking pixels, and we never sell your data.

The two switches

Both live in your privacy settings, and both are on when you first use Afterglow, so everything works. They govern different things, so turning one off leaves the other exactly as it was. There is no third switch that turns everything off at once. Sharing a trip and ordering a book cannot work without sending something, so a switch that promised otherwise would be lying.

Use AI features. Off means your photos and the words you write or speak never reach Anthropic, OpenAI, Google or Replicate.

Back up my trips to my account. Off means the automatic backup after each save stops — and so does the full-resolution archive. We will ask whether to delete the conversations already in your account; your recordings on this device are kept either way.

Either switch takes effect the moment you touch it. An AI request already in mid-air is cancelled rather than allowed to finish. A backup already running stops at the photo it is on: nothing after that photo is uploaded, and the copy of your trip itself is not sent. Work waiting in a queue — a backup that was about to run, photos lined up to be enhanced — is dropped rather than sent later.

Nothing goes quiet on you. When a feature is off, Afterglow says which one, which of the two switches did it, what it would have sent and to whom, and how to do the same thing by hand instead.

What turning a switch off stops

Each of these sends something of yours today, and sends nothing at all once the switch that governs it is off. Everything that would show your photos or your words to an AI provider belongs to Use AI features; the two that copy your trip to our storage belong to Back up my trips to my account.

• Interview — sends the answers you type or speak, plus your trip title, stop names and dates, to Anthropic.
• Write my whole book — sends your whole interview, your trip outline and small copies of your photos to Anthropic.
• Speak instead of typing — sends the recording of your voice to OpenAI to be turned into text.
• Fix my trip — sends the sentence you wrote and your list of stops to Anthropic.
• Pick my best photos — sends small copies of your photos to Anthropic to be looked at.
• Guess where a photo was taken — sends small copies of the photos that have no location, and your list of stops, to Anthropic.
• Photo repair — sends the full photo to Replicate (Boost for print) or Google (Fix blur).
• Design a cover — sends the landmark or motif you typed to Google to be drawn.
• Back up to my account — sends a copy of every photo, plus your journals, captions and the conversations you record, to Afterglow’s private cloud storage.
• Archive my originals — sends the full-resolution original of every photo to Afterglow’s private cloud storage.

What keeps happening either way

Maps and place names still come from our map provider — that is how the map draws and how a stop gets its name. Two small things go with the map: each photo’s file name, and a place name you type into the search box — that one goes to Google, and to our map provider for anything Google does not answer. Your photos, videos, journals and captions are never sent to the map provider.

We would rather be plain than flattering: these keep running whatever your switches say, because without them there is no map, no stop names and no way to sign in — and, in the case of the two counting entries on the list, because counting how many people opened a book is not the same as reading what they wrote in it.

• Usage counts — sends eleven event names, some carrying one to three small figures, a yes-or-no or which product was bought (rounded into ranges where an exact number could describe one particular book), with no photos, no words, no cookies and nothing that names you, to Vercel Analytics.
• Maps — sends which square of the world you are looking at to our map provider — never your photos.
• Place names — sends one pair of coordinates to our map provider, to turn it into a place name.
• Place search — sends the place name you typed into the search box to Google, with a rough area to search near.
• Building your journey — sends each photo’s file name, its coordinates and the time it was taken to Afterglow’s server, which asks the map provider for the place name — the photos themselves never leave.
• Weather — sends a date and a pair of coordinates to Afterglow’s server, which asks Visual Crossing about that day.
• Road routes — sends two pairs of coordinates to Afterglow’s server, which asks Geoapify for the road between them.
• Page counts — sends a cookieless page count to Vercel Analytics — no content, no identity, no tracking across sites.
• Signing in — sends your email address to Google or Resend so you can sign in — never your trip.

Two of those deserve their small print, because they are the only places on that list where something you typed or named can travel with both switches off: building your journey sends your photo file names to our server (never the photos themselves), and searching for a place sends the words you type into that search box. Everything else there is coordinates, dates, and which square of the map you are looking at.

The usage counts, spelled out. Eleven moments are counted: photos_imported when photos are accepted into a trip, flyover_played when the guided flyover starts playing, book_opened when the travel book is opened, order_started when the order wizard is opened, placement_needed when photos arrive with no location on them, signed_up when an account has just been created, share_created when you create a new share link, share_cta_clicked when someone reading a shared story presses its button to make their own, checkout_opened when you are sent to a payment page, purchase_completed when you come back from one and the purchase is confirmed, and voice_fakedoor_clicked when you press Add your voice to this book. Neither switch covers these. Each one carries its name, and here is everything else they carry. photos_imported carries two counts — how many photos arrived, and how many of those had no location. flyover_played carries a count of how many stops it visited and a yes-or-no for whether it started on its own or because you pressed play.

order_started carries three rounded figures — roughly how many pages the book has, roughly what share of its photos are flagged as printing below the printer's recommended 300 DPI standard, and roughly how many photos are placed in it. It never sends the exact numbers, and that is deliberate: an exact page count, photo count and flagged count together would come close to describing one particular book, and the page count also goes to Stripe and to our printing partner alongside your name when you buy. Rounded into ranges, they still tell us whether the printing warning is set honestly, while describing a kind of book rather than yours.

We will not pretend that makes a single order untraceable — anything you do in one visit happens at one moment in time, and while Afterglow is small that alone narrows things down. It means we are not the ones holding the detail that would do it. placement_needed carries a count of how many photos need a location, and sometimes a yes-or-no for whether that happened before your journey could even be built. book_opened, signed_up, share_created and share_cta_clicked carry nothing beyond their names. checkout_opened and purchase_completed carry one word: which product it was — the PDF, the printed book, Plus or a credit pack. That is the whole of it: no photos, no words, no cookies, and no way to tell one person from another. Page views are counted the same way whatever your switches say. Turning these off would tell us less about which steps work without telling you anything more about your own privacy.

Three things that still send — after they ask you

Sharing a trip, ordering a printed book and paying for one are things you do on purpose, by pressing a button. Neither switch takes them away — a Share button that refuses to share is not privacy, it is a broken diary. Instead, while either switch is off, each one tells you exactly what it is about to send and waits for you to agree:

• Share a link — sends your trip’s title, your photos, journals and captions, each stop’s name, coordinates, dates and weather, and the route between stops, to a web address anyone with the link can open; on the page it makes, no photo carries its own file name or the minute it was taken.
• Order a printed book — sends the finished book — every photo, journal and caption — as a PDF to our printer, Peecho.
• Checkout — sends your email address to Stripe, to take the payment, and when you are buying a book its title and page count as well.

What the switches do not do

They do not reach backwards on their own. Turning one off stops new sending; it does not delete what was sent while it was on. Turning Back up my trips to my account off does one thing more: it asks whether to delete the conversations already in your account, and deletes them only if you say so. For anything else, delete your account — see Your rights below.

They are remembered per browser, on this device. Turning one off on your laptop does not turn it off on your phone. Set them once on each device you use.

They never quietly change your mind. If you had already turned off the older AI photo assist option, Afterglow starts you with Use AI features off, and tells you on screen that it did.

Signed out (try before an account)

You don't need an account to try Afterglow. When you add photos, we read their EXIF data — location and time — directly in your browser. The coordinates, timestamps and file names we extract are sent to our server, so we can reconstruct your route (the stops, the order, the journey). This is the place-name lookup listed above: it keeps working whatever your switches say, because without it a stop has no name. Signed out, the photo files themselves stay in your browser's local storage, on your device — unless you choose to share a trip, which uploads screen-quality copies to power the link (see Sharing below).

Your account & cloud diary

Create an account and your diary comes with you. Trip snapshots, the conversations you record when you talk a chapter through, and screen-quality copies of your photos sync automatically to our private cloud storage, so your trips are backed up and available on every device you sign into. When you archive a trip, we also upload the original-quality photo files at full resolution.

With Back up my trips to my account off, that automatic backup stops. Your trips remain on the device you made them on, and Export my data in your account panel gives you a copy of your own. You can still sign in — signing in sends your email address, never your trip. Turn that switch back on and backing up resumes. Turn it off and we will ask whether to delete the conversations already in your account; the recordings on your device are kept either way.

Your photos are never public by default. They're served through authenticated requests tied to your login — not public URLs anyone could stumble on or share. We keep your backups until you delete them or your account. When you delete a trip, it is removed from this device, and from your other devices the next time they open Afterglow signed in to your account. We keep it in Recently deleted for 30 days, with its photos, words and conversations, so you can restore it, and then we delete all of it from your account for good. If you choose Delete now, for good, or turn on Delete straight away under Privacy in your account panel on the device you delete it on, we delete it from your account at once instead. A restored trip comes back with the photos in your account, at web quality. If the trip has full-size backup on, its full-size copies stay in your account. A trip that is not saved to your account, or that has changes or videos your account does not have yet, stays in Recently deleted on the device you deleted it on, and is deleted for good there if you sign out. Its public link stops working when you delete it, and a restored trip comes back without one. We keep the file we send to the printer until 30 days after its order is finished, so the book can be printed again if something went wrong. If an order never finishes, we delete that file 120 days after the order. A preview already sent in a chat or posted on a social site is kept by that app, and copies people saved stay with them. A share link made while you were signed out is not recorded on your account, so deleting the trip on another device cannot take it down; delete the trip on the device that made the link. If you delete a trip while you are signed out or offline, we finish deleting it from your account the next time you are signed in to that account on that device, within 30 days. If the trip was changed on another device after this one last saw it, the newer copy stays in your account and we tell you. While a printed book of the trip is still being made, deleting the trip leaves its copy in your account until the book ships, and then it goes to Recently deleted for 30 days. A book you made by combining trips has its own copy of their photos: deleting it leaves the trips it was made from as they are, and deleting one of those trips leaves the book as it is. Once a trip is deleted for good, we keep a note that it was deleted, with no title, photos or places, so your other devices remove it too. It goes when you delete your account. On iPhone, Safari can clear what a tab stores if you do not open it for 7 days, and a delete that has not reached your account yet goes with it. A photo you remove from a trip stays in Recently deleted on the device you removed it on for 30 days. A photo file that no trip in your account uses any more is kept until you delete your account. We are adding an automatic clean-up for these files. Turning off the full-size backup for a trip deletes its full-size copies from your account. Deleting your account deletes everything in it at once, Recently deleted included, as described under Your rights below.

Editing the same trip on two devices. Your words merge — a chapter you record on one device appears on the other next time it opens the app, alongside whatever that device recorded, as long as both devices still agree on the trip's shape. A trip's shape — its stops, renamed places, folded day trips — does not merge: change it on two devices before either one syncs and whichever device saves last is the one the account keeps, and the other device's words stay on that device, unmerged, until the shapes match again.

One account per browser. If someone signs in with a different account on this browser, trips saved to the earlier account are removed from this browser, including their full-size originals and video clips. That account keeps its screen-quality copies. Trips that aren't saved to any account are never removed without asking: we list them, and you choose to add them to the new account or remove them.

Where your data lives

Your account database and all of your photos — the screen-quality copies, the original-quality archives, and the images that power sharing — are stored in the EU (Frankfurt). Services like Stripe and Resend process the data we send them under their own terms, described below.

Sharing

We only create a share link when you tap Share; no account is needed to make one. Anyone with that link can view that trip's story: it sends your trip’s title, your photos, journals and captions, each stop’s name, coordinates, dates and weather, and the route between stops, to a web address anyone with the link can open; on the page it makes, no photo carries its own file name or the minute it was taken. Share links don't expire on their own. A share link can be turned off from the device that made it, which deletes the shared page and its photos from our servers, though a copy someone already has open can linger a little while. If you no longer have that device, write to hello@afterglow.travel with the link and we will take it down.

With either switch off, Share still works, but it tells you first, and waits for you to confirm, that it is about to send your trip’s title, your photos, journals and captions, each stop’s name, coordinates, dates and weather, and the route between stops, to a web address anyone with the link can open; on the page it makes, no photo carries its own file name or the minute it was taken. If you would rather nothing left the device, export the trip instead and send the file to whoever you choose. No account is needed either way.

AI features

Everything in this section is governed by Use AI features, and by that switch alone — backing up to your account is a separate decision. All of it is on until you turn it off, and none of it runs on its own; each one happens because you asked for it.

Interview & writing. Afterglow uses AI (via Anthropic's API) to help write your journal entries. It sends your answers, your trip title and your stop names. When you ask it to write your whole book, small copies of your photos go with them, so it can write about what is actually in the picture. If you answer by speaking rather than typing, the recording itself goes to OpenAI to be turned into words; that is described under The microphone below.

Picking your best photos. When you ask Afterglow to choose, small copies of your photos are sent to Anthropic to be looked at, for that request only. You can always choose your own instead — every photo in the book is one tap to keep or remove.

The microphone. When you answer a question by voice, the recording is sent to OpenAI to be turned into words, and the text comes back to you. The audio itself is not stored by us and is not used to train anyone's models. The words it becomes are part of that chapter's conversation, which is saved on your device and, while Back up my trips to my account is on, backed up to your account. If you would rather no recording left your device, turn Use AI features off — the microphone stays on screen, greyed, and says why when you reach for it, and you simply type instead. Everything else works exactly the same.

Photo enhancement. Boosting a photo for print spends a credit and sends that photo to Replicate to be upscaled. Fixing blur spends a credit and sends that photo to Google. We don't use either to train anything, and you keep the original photo either way.

Cover art. Designing a cover spends a credit and sends the landmark or motif you typed to Google to be drawn. Your photos are not sent. The ready-made covers, Photo, Atlas, Your map and Retro, are drawn without AI. Atlas and Your map still load satellite map tiles from our map provider to draw their view (see Maps, above); Photo and Retro send nothing over the network at all.

Where AI processing happens. Your account and your photos are stored in the EU (Frankfurt), but these features send data to providers in the United States: Anthropic for writing and photo picking, OpenAI for the microphone, Replicate for boosting a photo, and Google for fixing blur and for cover art. Nothing is sent unless you use that feature, and nothing is sent at all while Use AI features is off.

Emails we send you

Signing in. When you sign in with your email address, we send you a link to click. That one is not optional — it is how signing in works.

Finishing your book. If you save a trip to your account and then leave it unfinished, we may send you up to three emails over your first week — three, and then that sequence is done. They are about your own saved work: that your book is safe, that it has no photos on it yet, that it has no words yet, or that it is finished and here is what printing one costs.

A trip you never made a book of. There is one more, and it only starts after you have actually ordered a printed book: if another trip is still sitting in your library with no book, we may mention it. Never sooner than three weeks after that order, never more than one a month, and never twice about the same trip. The same unsubscribe link stops it.

What decides which one you get. Only your own saved work — how many photos are on your trip, whether anything has been written in it, and whether you have ordered a book. In our emails we do not track what you click, what you look at, or how long you stay, and our visitor analytics are anonymous and are never joined to your email address. Ordering a printed book stops the reminders about finishing that book for good. Analytics, if you allowed them, are described in the section on cookies below and are never joined to your email address either.

Stopping them. Every one of these emails has a one-click unsubscribe link that works without signing in, and there is a switch in your account panel. Both write the same setting. Turning it off does not affect your sign-in links, and does not delete anything.

Receipts and order updates. When you buy something, we email you about it: that your PDF is ready, that your Plus plan or your credits are in place, that your printed book is ordered, and when it ships. They go out whatever your email setting says, because each one is about something you paid for.

Add your voice (coming soon). If you type your email under Add your voice to this book and tick the box, we keep that address to send you one email when voice notes are ready, and for nothing else. It is deleted 30 days after that email, or after 12 months if it was never sent, or when you ask us at hello@afterglow.travel. If you are signed in, we keep your account number with the address, so deleting your account deletes it too. The legal basis is your consent.

Cookies and analytics

We use cookies and similar technology, such as storage in your browser. There are three kinds.

Necessary. Keeps you signed in, keeps your work on this device and remembers your choices. Always on. These need no permission and are set by Afterglow alone.

Analytics. Only if you choose Accept all on the banner, or switch Analytics on under Cookie settings, we use PostHog to measure how the site is used: which pages you visit, where you click and scroll, and replays of a visit.

In a replay every word on the page is hidden, and every photo, every map and everything you type is blocked out. We cannot see your photos, your journals, your place names or your email in a replay.

With analytics on we also send PostHog these moments: a first page viewed on our site, starting a trip, a trip built from your photos, a share link, reel or picture made, a WhatsApp send opened, a shared trip opened, Make your own pressed, a guess in the trip game, a checkout opened, a printed book paid for, Add your voice pressed, and your answer to How did you hear about Afterglow, and the eleven milestones described above.

Each one carries a few tags, never your name: where your first visit came from (for example a shared trip, a QR code in a printed book, or a search engine), where this visit came from, which version of the share prompt this browser was shown, and your answer to How did you hear about Afterglow, if you gave one.

When a moment is about a shared trip it carries a short code made from the link that cannot be turned back into the link. It also says whether you made that trip yourself, which we read from this browser's own list of trips, and only after you allow analytics.

Before you answer the banner, where your visit came from and anything you did on the page are held only in this tab’s memory. Accept all sends them; Reject all deletes them; closing the tab forgets them. Nothing about them is written to your device until you allow analytics.

If you allowed analytics on this browser and then open a printed-book checkout, we keep a note of that order’s reference, the anonymous id PostHog gave this browser, the tags above and the book’s price before shipping. When Peecho tells us the order was paid, our server sends PostHog one book ordered moment and deletes the note. The note never holds your name, email or address. It is deleted after 30 days in any case, and at once if you turn analytics off on this browser.

We never tell PostHog who you are: no name, no email and no account number. The page addresses it receives have any share link or trip number taken out.

PostHog is our one analytics partner. PostHog (PostHog Inc., USA) stores this in its EU cloud, in Frankfurt, Germany. Replays are deleted after 30 days and usage events after one year.

The legal basis is your consent (article 6(1)(a) GDPR), and for storing anything on your device, article 11.7a of the Dutch Telecommunications Act. You can change your choice at any time under Cookie settings at the bottom of every page, with the Analytics switch under Privacy in your account, or here: Cookie settings

If you choose Reject all, or your browser sends Global Privacy Control, PostHog is never loaded.

Marketing. We use no marketing cookies and no ads. If we ever add them, the banner will ask you first, and nothing is set until you say yes.

Service providers (subprocessors)

Running Afterglow means a few trusted services handle data on our behalf, each receiving only what it needs to do its job. Where a provider only ever hears from us because of a feature one of the switches governs, it is noted:

• Vercel: hosting, storage, and privacy-friendly visitor analytics. The analytics set no cookies, follow nobody across other websites, and never record your photos, your journals, or anything you type. They count page views and the eleven anonymous milestones described above (photos imported, flyover played, book opened, order started, photos needing a place, account created, share link created, share page's Make your own pressed, checkout opened, purchase completed, Add your voice pressed), and all of them keep counting whatever your switches say.
• PostHog: analytics (usage events and replays of a visit), only after you allow analytics. PostHog is a US company (PostHog Inc.), and its EU cloud stores them in Frankfurt, Germany.
• Neon — our database, hosted in Frankfurt.
• Stripe — payments. It always receives your email address so it can take the payment, and when you are buying a book it receives that book’s title and page count as well; your card details never touch our servers.
• Resend — sends your login emails, receipts and order updates, and the reminders described above.
• Anthropic — powers the writing AI features and picking your best photos. Nothing is sent when Use AI features is off.
• OpenAI — turns your voice recordings into text when you use the microphone. Nothing is sent when Use AI features is off.
• Replicate — powers boosting a photo for print. Nothing is sent when Use AI features is off.
• Google — optional sign-in with your Google account; map tiles and the 3D globe, loaded directly by your browser; the place names you type into the place search, with a rough area to search near (your trip’s centre, or roughly where you are, to about 100 km); and, when you choose them, the photo you pick for blur repair and the words you type for cover art. Sign-in, maps and place search keep working whatever your switches say; the two AI features send nothing when Use AI features is off.
• MapTiler — map tiles loaded directly by your browser, turning coordinates into place names, and any place search Google does not answer. These keep working whatever your switches say; they never receive your photos.
• CARTO: backup map tiles, loaded by your browser only when our main map provider is unavailable. CARTO sees your IP address and the map area you view.
• Visual Crossing — the weather your stops had. It receives a date and a pair of coordinates from our server, never from your browser, and keeps working whatever your switches say.
• Geoapify — the road between two stops. It receives two pairs of coordinates from our server, never from your browser, and keeps working whatever your switches say.
• Peecho — fulfils printed books, based in Amsterdam. It receives the finished book as a PDF only when you order one. Its own checkout takes the payment and ships the parcel, so the name, delivery address and payment details you type there go to Peecho rather than to us.

Peecho is the only company on this list that handles a delivery, and the only one that collects your address. What it does with what you give it is set out in its own privacy and cookie policy.

Our feedback board at afterglow.fider.io is run by Fider, under Fider's own privacy policy. Nothing reaches Fider unless you choose to use the board.

Why we are allowed to use your data

• Your account, your trips and your orders: we need them to give you what you signed up for or bought, so the legal basis is our contract with you (GDPR article 6(1)(b)).
• Cloud backup and the AI features: they are part of the service you signed up for (the Back up my trips to my account and Use AI features switches described above), so the legal basis is our contract with you (article 6(1)(b)). Each switch turns its feature off whenever you like.
• Visitor analytics: counting page views and the eleven anonymous milestones, with no cookies and nothing that names you, tells us which steps work; that is our legitimate interest (article 6(1)(f)), which is why no switch stops it.
• Analytics cookies (PostHog): your consent (article 6(1)(a)), given with the banner and withdrawn under Cookie settings or with the Analytics switch.
• Security logs and fraud prevention: keeping the service and its payments safe is our legitimate interest (article 6(1)(f)).

How long we keep it

• Order and tax records: 7 years, because Dutch tax law requires it.
• Your account data: until you delete your account.
• Backups and photo files: as described under Your account and cloud diary, above.
• Server logs: at most 30 days.
• Printed-book notes for usage events: until the order is counted, and at most 30 days.
• Printed-book files: the PDF Peecho prints your book from is kept until 30 days after its order is finished, and deleted within two weeks after that. If an order is never paid, it is deleted 30 days after you start it.
• Deleted trips and photos: 30 days in Recently deleted, unless you delete them for good sooner.
• Voice note emails: as described under Emails we send you.

Data sent outside the EU

Some of the companies listed above are based in the United States or may process data there: Vercel, Neon, Stripe, Resend, Anthropic, OpenAI, Replicate, Google, Visual Crossing and PostHog. When your data goes to one of them, the transfer relies on the EU-US Data Privacy Framework where that company is certified under it, and otherwise on the standard contractual clauses approved by the European Commission. MapTiler is in Switzerland, which the EU recognises as protecting personal data adequately.

Who Afterglow is for

Afterglow is not meant for anyone under 16, and we do not knowingly collect their data. If you think a child under 16 has given us data, write to us and we will delete it.

Your rights (GDPR)

Access & export. Every trip in your library can be exported as a zip file — photos and journey data together — whenever you want a copy.

Deletion. Delete account in your account panel permanently removes your account, your cloud backups, your credits, and every share link recorded on your account. A link we never recorded there stays up until it is turned off from the device that made it, or you ask us to take it down: one made before you signed in was never recorded, and now and then a link made afterwards does not reach us either. Trips you've already saved to your own devices stay yours. You never have to delete your account to take a shared page down — write to us with the link and we will remove it.

For rectification, objection, or anything else, contact us below.

If you are unhappy with how we handle your data, you can complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens, at autoriteitpersoonsgegevens.nl.

Changes to this policy

If we materially change how we handle your data, we'll update this page and change the "Last updated" date above.

Contact

Write to hello@afterglow.travel. A person reads it — there is no ticket system and no bot.