Privacy Policy

ODYSSEY's public beta is designed so that core trip-planning features remain available when optional analytics are declined. Google Analytics 4 is activated only after an explicit opt-in and is not used for advertising, retargeting, Google Signals, or ads personalisation.

Controller and contact

Afar Inc. is the controller for ODYSSEY. Privacy questions, withdrawal requests, and data-rights requests may be sent to kwonjihun@afarlab.com. Do not email passwords, payment data, or other unnecessary sensitive information.

What we process

Trip candidates, preferences, generated plans, notes, and photos are stored locally in your browser by default. Search terms, coordinates, schedules, budgets, and mobility preferences pass through the service only when needed to perform a search, calculate a route, check weather, or optimise a plan. The application is designed not to persist those request bodies after processing; minimal security and error logs may be kept for up to 30 days.

If you opt in to analytics, we may collect a random analytics identifier, consent state, country or broad region, device and browser category, language, a broad acquisition-channel category, feature events, candidate place category and broad region, counts, ranks, time or cost bands, the band of elapsed time you enter when requesting recalculation, and whether a journal entry was saved or an AI edit completed. ODYSSEY classifies acquisition in the browser and removes external referrer domains, URL query strings, campaign names, and click identifiers from its analytics events. Exact searches, place names, precise coordinates, complete itineraries, journal text or length, photos, email addresses, booking references, and payment information are excluded from GA4. Entered elapsed-time bands are not measurements of an actual visit or stay. The analytics do not collect actual movement trails, completed bookings, or actual spending. GA4 user-level and event-level retention is configured to two months. If Google Cloud BigQuery export is enabled, raw event tables expire after 60 days. Identifier-free daily acquisition-channel, funnel, quality, booking-link-click, and categorical-feedback aggregates may be retained separately until the analytics purpose ends or the operator deletes them; acquisition, booking, and feedback combinations with fewer than five daily users are excluded.

If you separately opt in to service-improvement research and voluntarily submit the structured prompts currently shown, we may analyse satisfaction, expected-spending bands, and the main adjustment reason. Any future prompts about interests, accommodation priorities, route-choice reasons, or itinerary changes require a corresponding interface and updated notice before collection. Each prompt can be skipped, and declining it does not affect core features. Exact spending, free text, place names, addresses, precise coordinates, journal content, photos, and payment data are excluded. A stated preference or link click is not treated as proof of an actual purchase, visit, stay, or booking.

Your choices

You may refuse or withdraw analytics consent without losing the core planning service. Clearing site data removes local data and analytics cookies on that browser but does not automatically delete events already sent to Google. Subject to applicable law, you may request access, correction, deletion, restriction, objection, consent withdrawal, an explanation of relevant automated processing, and a portable copy where applicable. Because GA4 and raw BigQuery events contain no name or email, a specific event may be technically impossible to locate without the analytics identifier from the relevant browser. Identifier-free daily aggregates cannot be separated into an individual's records.

Providers and international processing

Minimum data required for a requested feature may be processed by Vercel and by map, place, route, weather, transport, tourism, and event-data providers, including OpenStreetMap services, optional MapTiler map tiles, OSRM, Open-Meteo, Korea Tourism Organization TourAPI, TMAP, TAGO, and KOPIS. Leaflet files are bundled with ODYSSEY and loaded from the same origin. Map tiles are requested from the configured map provider. If analytics are accepted, Google may process coarse analytics data on infrastructure outside Korea. GA4 Enhanced Measurement is disabled so automatic outbound-link, site-search, form, and similar interaction events do not bypass ODYSSEY's event allowlist. Optional AI editing sends the submitted journal text and the selected record’s place, date and time to the OpenAI API only when the user invokes that feature.

External accommodation-search links and age

The public beta's accommodation-search buttons are ordinary external links to general search pages on Booking.com, Agoda, or Expedia. When you select a button, the chosen accommodation candidate name or area, check-in and check-out dates, and party size are placed in the search URL and sent to the selected external service. Journal text, photos, and precise coordinates are not included in that link. ODYSSEY does not receive booking-confirmation, payment, or revenue data from those services and does not treat a click as a booking or transaction. Afar Inc. may receive a commission only if an approved affiliate identifier is introduced for a completed transaction; the relevant notice and policy will be updated before that occurs. If you choose to open a daily route in Google Maps, that day's origin, destination, waypoint coordinates and travel mode are placed in the URL and sent to Google. This happens only after you select the external map link and is not continuous location tracking. The public beta is intended for users aged 18 and over.

Security and changes

We use measures appropriate to the scale of processing, including encrypted transport, restricted access, separated secrets, log minimisation, and security updates. No online service can guarantee absolute security. Material changes to purposes, analytics, or partner processing will be announced on the service or this page before they take effect, and fresh consent will be requested where required.