Privacy Policy

1. Information We Collect

We collect information you provide directly, including your name or display name, email address through Firebase Authentication, your reviews, emoji reactions, one-line notes, ratings, saved places, route or experience requests, mood selections, dish recommendations, social outcome feedback, and any receipt photos or related submission details you upload for verification.

We may collect optional current location data if you allow GPS access. Current location is used to generate nearby recommendations, ETA, route, weather, public context, and map handoff features. We do not intentionally infer or store your home, workplace, personal relationships, or sensitive-location profile from your location.

We also collect device, browser, log, cookie, and security information used to operate the site, maintain security, prevent abuse, and understand service performance.

• Account information: email address and basic authentication identifiers.
• User content: reviews, emoji reactions, one-line notes, ratings, dish recommendations, saved places, saved routes, moderation or support communications, and feedback you send us.
• Experience routing data: prompt length, detected intent, selected route type, selected mood, selected settings, selected candidate, source rows, map handoff events, receipt-loop events, social outcome signals, and similar product interaction metadata. We do not use raw full prompts as long-term learning data.
• Receipt verification data: receipt photos and raw OCR text for short-term processing; extracted merchant, place, date bucket, time bucket, amount bucket, item category, purpose tag, verification status, OCR confidence, fraud signals, duplicate hash, and user-confirmed outcome fields for longer-term service use. Payment card numbers, cardholder names, approval codes, membership numbers, QR or barcode contents, delivery addresses, and other unnecessary personal or payment details may be masked, discarded, or excluded from long-term storage.
• Visit signals without receipts: for receipt-less places, Planets may process lower-strength signals such as voluntary check-ins, route completion, selected place, coarse time bucket, coarse location area, user note, or user-confirmed outcome. These are labeled and weighted differently from receipt-verified data.
• Technical data: IP address, device and browser type, operating system, access logs, cookie identifiers, and similar usage information.
• Location data: approximate or precise current location information only if you choose to share it. Long-term records use city, region, distance band, time bucket, or other coarse features rather than exact location history.

2. Why We Use It

• To create and secure accounts and authenticate users.
• To publish, moderate, and display reviews, ratings, and dish recommendations.
• To verify receipts, detect fraud, and generate public verification indicators such as a Verified Receipt Card.
• To provide map, search, geolocation, place-detail, route, traffic, weather, public context, Data.gov source discovery, and Google Maps or Apple Maps handoff features.
• To personalize experience routing, mood-aware route selection, social outing planning, date course planning, roadtrip stops, errands, price expectations, receipt memory, and recommendation quality.
• To provide free code-based route previews and paid AI interpretation, including daily receipt notes, weekly pattern reports, monthly reports, deeper source-backed route explanations, and advanced trip planning.
• To operate payments, customer support, analytics, abuse prevention, and legal compliance.
• To improve Planets using structured, de-identified or pseudonymized learning signals such as intent, place category, price bucket, distance band, receipt verification status, social outcome labels, and fraud labels.
• To produce anonymized, aggregated insights such as regional price trends, meal cost benchmarks, place-context fit, social route outcomes, and dining or local experience statistics. These insights are derived from de-identified or aggregated data and are not intended to identify individual users.

3. Retention, De-Identification, and Sharing

We keep personal information only for as long as reasonably necessary for the purposes described in this Policy, including product operation, personalization, fraud prevention, moderation, security, payment support, and legal compliance. We may delete, aggregate, or de-identify information when it is no longer needed.

Raw current location, raw route traces, raw receipt images, raw OCR text, and raw full prompts are not intended to be long-term learning records. We use them as operational inputs where needed, then delete, avoid storing, or convert them into structured fields such as city, region, distance band, time bucket, amount bucket, place category, purpose tag, verification status, and outcome labels.

Structured receipt facts and private daybook entries may remain in your account so you can see your calendar, spending memory, and visit history. Original receipt images and raw OCR are not the intended long-term record after extraction unless a specific operational, security, fraud, or legal hold requires temporary retention.

De-identified or aggregated receipt, visit, route, and outcome data may be retained long term for service improvement, recommendation quality, price accuracy, trust and safety, and benchmarking. We do not sell personal information, exact location histories, or individual movement records to third parties.

We share information only with service providers and partners that help us operate Planets, subject to appropriate contractual or operational safeguards.

• Firebase: account authentication and sign-in services.
• Google Cloud: hosting, storage, and infrastructure services.
• Google Maps API: map rendering, places, routes, weather, and geolocation-related services.
• Stripe: payment processing, receipts, subscription billing, and billing support.
• AI and OCR providers: receipt processing, classification, summarization, and recommendation support.
• Security infrastructure providers: DNS, CDN, web application firewall, bot protection, challenge pages, rate limits, and abuse prevention.
• U.S. government and public data sources: weather, hazard, recreation, air quality, transportation, crime baseline, and dataset discovery context.

4. Location and Sensitive Data Limits

Planets may use your current location when you choose to share it, but current location is an input for a recommendation, not a permanent location-history product. We avoid intentionally creating profiles for home, workplace, school, medical, religious, shelter, correctional, political, union, or other sensitive-location visits.

We do not intentionally infer or store who you met, your dating partner, friend relationships, family relationships, or other person-to-person relationship graphs from your use of Planets.

Dating, friend, family, or social route labels are used as route-planning context. They are not intended to create a permanent relationship graph or infer sensitive personal relationships.

When long-term learning is useful, we prefer feature values such as distance band, travel time bucket, city or neighborhood-level area, purpose tag, place category, price bucket, and outcome label over exact GPS coordinates or raw event history.

5. Secure Data Hub

Planets routes external and internal data through a secure data hub before the data is used by map, AI, or recommendation surfaces. The hub records source, URL, source family, query hash, coarse region, retention period, sensitivity level, normalized fields, provenance, and access events where applicable.

The hub is designed to support provenance, retention limits, de-identification, redaction, and policy checks. It is not intended to store raw prompt text, exact current location, full route traces, raw receipt images, or raw OCR text as long-term learning data.

6. Public Reviews, Nicknames, and Private Daybook

Planets separates public contribution surfaces from private memory surfaces. A public review, nickname, rating, emoji reaction, or one-line note may be visible to other users if you publish it. A private receipt daybook entry is intended for your account unless you choose to publish or share part of it.

If nickname or real-name display options are available, the display choice affects how public reviews appear. It does not change our underlying need to keep account, fraud, moderation, and verification records where required for service operation.

7. International Processing

Planets is operated by stardusting for a US-focused product. Personal information may be processed in the United States, including on Google Cloud infrastructure in us-central1, and accessed only as needed by authorized personnel.

By using Planets, you understand that your information may be transferred to and processed in countries that may have different data protection rules from your place of residence.

8. Your Rights

You may request access to, correction of, or deletion of your personal information, subject to applicable law and our need to retain certain information for security, fraud prevention, transaction support, or legal compliance.

You may delete your account or request deletion of account-linked receipt, review, and profile data where legally deletable. De-identified aggregate records may be retained when they cannot reasonably identify you.

If you are a California resident, we will honor applicable California privacy rights as a matter of good practice, including the right to know, access, correct, delete, limit use of sensitive personal information where applicable, and opt out of any sale or sharing of personal information. Planets does not sell personal information and does not share personal information for cross-context behavioral advertising.

9. Children

Planets is not intended for children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us personal information, please contact contact@stardusting.net so we can review and delete it where appropriate.

10. California Notice

For California residents, the categories of personal information described above may include identifiers, commercial information related to payments or receipts, internet or electronic network activity information, geolocation data if provided, inferences used for recommendation preferences, and user-generated content.

We collect and use this information for the business purposes described in this Policy, including service operation, verification, fraud prevention, analytics, customer support, and legal compliance. We do not sell personal information and do not use personal information for cross-context behavioral advertising.

Planets does not sell personal information. We do not share personal information for cross-context behavioral advertising. If you wish to exercise your rights under the CCPA, contact contact@stardusting.net.

11. Cookies and Tracking

Planets uses essential cookies for authentication sessions and service operation. We may use limited analytics to understand aggregate usage patterns. We may use security technologies to protect the service from bots, scraping, attacks, and fraud. We do not use advertising cookies or sell data to third parties.

You can control cookies through your browser settings. Disabling essential cookies may affect site functionality.

12. Data Deletion

You can delete your account at any time from the Account settings page. When you delete your account, we permanently remove your profile, reviews, and account-linked receipt data within 30 days where legally deletable. Some anonymized, de-identified, or aggregated data may be retained for analytics, trust and safety, fraud prevention, or product improvement when it cannot reasonably identify you.

To request data deletion without signing in, email contact@stardusting.net with the email address associated with your account.