Last updated: August 2, 2026
[Legal entity not yet incorporated — update with entity name, registration jurisdiction, and registered address once formed] ("we", "us") operates Lancong (the "App"). Contact for privacy inquiries and data subject requests: privacy@lancong.app.
| Data | Why |
|---|---|
| Username, password (hashed), email (optional) | Account creation and login |
| Trip data — expenses, itinerary stops, packing lists, ratings, photos | Core app functionality |
| Home country/currency, display name, bio, avatar | Personalization |
| Friend connections, trip invitations, notifications | Social features |
| Uploaded receipt/trip photos | Expense tracking, trip memories |
Guest accounts store the minimum needed to join a trip and cannot save photos, receipts, comments, or ratings.
The App relies on the following infrastructure providers, each processing a narrow slice of data needed for their specific function:
| Provider | Purpose | Data involved |
|---|---|---|
| Neon | Production database hosting | All app data (encrypted at rest by the provider) |
| Vercel | App hosting (frontend + API) | Request/response traffic |
| Resend | Transactional email (password reset, notifications) | Email address, message content |
| Cloudflare R2 [or local disk — depends on deployment config] | Uploaded photo storage | Uploaded images |
| Anthropic (Claude) | AI receipt scanning, itinerary suggestions | Receipt images, itinerary preferences (sent for processing, not used to train models per Anthropic's API terms) |
| Google Sign-In (optional) | Name, email, profile picture, per Google's OAuth consent screen | |
| Google Places | Fallback photo/link lookup for AI itinerary suggestions | Destination/place names you have in your itinerary (not linked to your identity by Google) |
| Pexels | Destination cover photos | Destination/country names |
| GeoNames / OpenStreetMap Nominatim | City search, geocoding | Place-name queries you type (not linked to your identity by these services) |
| Sentry | Error tracking and performance monitoring | Error events, device/browser info, IP address, app usage traces (not advertising or marketing analytics — operational monitoring only) |
Passwords are stored hashed, never in plain text. Sessions are authenticated via signed tokens. The production database is encrypted at rest by our hosting provider. Administrative actions are logged. No system is completely secure, and we cannot guarantee absolute security of your data.
Several of the providers listed in Section 3 (Neon, Vercel, Resend, Anthropic, Google, Sentry) are based in or process data in the United States. If you are located in Malaysia, the EU/UK, or elsewhere, your data may be transferred to and processed in these countries. [Confirm whether Standard Contractual Clauses or an equivalent transfer mechanism are in place with each processor before publishing, if serving EU/UK users]
We process your data on the basis of contractual necessity (to provide the App's core features) and, for optional features like email notifications, your consent.
If you are in Malaysia: under the Personal Data Protection Act 2010 (PDPA), you have the right to access your personal data, request correction of inaccurate data, withdraw consent to processing, and request that we stop processing your data where it is likely to cause you damage or distress. You may lodge a complaint with the Department of Personal Data Protection (Jabatan Perlindungan Data Peribadi) if you believe we have not complied with the PDPA.
If you are in the EU/UK or California: you may additionally have rights under the GDPR or CCPA, including the right to erasure ("right to be forgotten"), data portability, and to object to certain processing, and to lodge a complaint with your local supervisory authority.
Regardless of which of the above applies to you, we offer account and data deletion as a feature open to every user — see Section 8 below. Contact privacy@lancong.app to exercise any of these rights.
Trip data is retained for as long as the trip or your account exists. When you delete a trip, its data is removed from the database. When you delete your account, your account and the data directly tied to it are deleted immediately — see Section 8 for exactly what that covers. A deleted record may persist in routine database backups for a limited period before being purged in the ordinary backup rotation. [Confirm our backup retention window with Neon before publishing]
You can delete a trip at any time (Settings → Danger Zone). You can delete your whole account at any time, with typed-username confirmation. Account deletion is immediate, not queued or reversible, and removes your login credentials, profile, settings, friend connections, notifications, saved payment methods, and any AI provider keys you added. Two exceptions, mirroring what already happens when you leave a trip while other members remain on it: your name stays attached, as a plain label, to trip history you were part of, and any destination templates you published stay live — in both cases no longer linked back to your deleted account.
The App uses browser local storage (not third-party tracking cookies) to keep you logged in and remember your last-viewed trip. We use Sentry (Section 3) for error tracking and performance monitoring — this is operational, not advertising or marketing analytics. No advertising trackers are integrated.
Lancong is not directed at children under 13. If you are under the age of majority in your jurisdiction, you may only use the App with the involvement of a parent or legal guardian, consistent with our Terms of Use.
We may update this policy. Material changes will be reflected here with an updated "Last updated" date.