Privacy policy

If you join the newsletter or ask for a sign-in link, we store your email address. Sign-in is a one-time magic link sent by email. There is no password. A sign-in link expires after 15 minutes and works once. A newsletter confirmation link lasts 14 days. We store a hash of the link, not the link itself.

With that email we may also store:

• whether you asked for the weekly newsletter
• a display name, if you set one
• where the signup started, such as the website or the app
• whether the address has bounced

On the website, a session cookie named __Host-sessionid keeps you signed in for about 30 days. It is HTTP-only. In production it is marked Secure. The app stores a short-lived access token and a refresh token of about 30 days on the device.

If you save a beach, restaurant, activity, event, or stay while signed in, we store that save with your account. Favorites and trip plans in the app stay on the device unless you send them to the guide, as described below.

If you allow notifications, we store an Expo push token and the platform (iOS, Android, or web). We use it to send notices you opted into, such as a new guide, and only while the newsletter preference is on and the account is active. Turning notifications off in the device settings stops delivery. Signing out of the app deactivates the push token it registered. Expo delivers the notification.

An inquiry asks a host about a stay. It includes your name, email, and message, and it can include a phone number, check-in and check-out dates, and a guest count. We store the inquiry and email it to the host, who then has your contact details so they can reply. OBX Things is the directory that passes the message. The host is the person who answers it.

If you list a home, we store the host profile and the listing: business name, contact email, phone, a short bio, website, title, town, address, the property's coordinates, size, rates, photos, and an availability-calendar address if you connect one. Those property coordinates describe the rental. They are not your phone's location.

On-platform booking is off unless it is explicitly enabled. When it is on, a booking stores the guest name and email, dates, guest count, the price quoted, and Stripe payment identifiers. Card numbers are entered with Stripe and are not stored by OBX Things. Host plan checkout and payouts, when those are enabled, also use Stripe. We then store Stripe customer, subscription, or connected-account identifiers for that host.

The guide answers only when it is enabled. The messages you send, and on the app the trip context included with them (the date, a home-base town, the day's plan, and saved spots), go to our servers and then to OpenAI to write the reply. We do not keep a transcript of that chat in our database. The app keeps the thread on the device. OpenAI may also be used to draft a listing imported from another page, or to make a day image, when those tools are enabled.

When a Google Tag Manager container is configured, the website records product events such as opening a listing, starting an inquiry, or applying a filter. Those events are written so they do not include email addresses, guide prompts, or the words you type into search. Tag Manager may set its own cookies.

The app sends crash reports to Sentry only when a Sentry DSN is configured for that build. That reporting is off otherwise, and it is set not to attach default personal information.

Maps plot published coordinates for places, events, and listings. If you tap Show my location and allow it, the app reads your position on the device to center the map. That reading is not uploaded to OBX Things. You can leave location off and still use the map.

Sign-in and account events store a hash of the IP address and a shortened user agent. A listing view, and a click through to a partner booking site, stores a hashed IP address and user agent. A partner click can also store a referrer. We do not sell personal information, and we do not use this information to track you across other companies' apps and websites for advertising.

• Replit hosts the website and API. Production data is stored in Postgres. Development can use a local database instead.
• Resend sends magic links, the newsletter, and inquiry mail, and reports bounces.
• Stripe processes payments when host billing or on-platform bookings are enabled.
• OpenAI writes guide replies, and the other model tasks above, when those features are enabled.
• Sanity stores and serves the articles, guides, and other editorial pages.
• Sentry receives app crash reports only when crash reporting is configured.
• Expo delivers push notifications to registered devices.

We send them the data needed for that job. Their own notices describe how they handle it.

Sign-in links expire after 15 minutes. Newsletter confirmation links expire after 14 days. The website session lasts about 30 days. The app refresh token lasts about 30 days.

Account, inquiry, listing, and booking records stay while the account or listing is in use, and as needed to complete a stay, keep a host's records, secure the service, or meet a legal duty. Guide messages are not stored as a transcript on our servers.

Email hello@obxthings.com from the address on the account to ask for a copy of your account data, or to ask us to delete a specific record.

You can also delete the account in the product:

1. On the website, sign in, open Account, and choose Delete account.
2. In the app, sign in, open Account, and choose Delete my account.

That request deactivates the account, replaces the sign-in email with a pseudonym, clears the display name, and turns the newsletter off. We keep a deletion record with a hash of the previous email and a purge date 30 days later. The security log of the request can still include the email address that was on the account. A booking, an inquiry already sent to a host, or a published listing may be kept or anonymized, because someone else relies on it. Email us if you need one of those removed.

OBX Things is a general-audience travel guide. It is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe we have, email hello@obxthings.com and we will delete it.

For the OBX Things iOS app, in addition to the sections above:

• Creating an account is optional. It uses your email and a one-time sign-in link.
• Data linked to an account can include the email, display name, saved items, inquiries, bookings, host listing contacts, and a push token if you allow notifications.
• Product analytics, when enabled, are not tied to your email. Crash reports, when enabled, are sent without default personal information.
• Location is optional, used only to center the map, and stays on the device.
• You can delete an account in the app, on the website, or by emailing hello@obxthings.com.
• We do not sell personal information.

If this policy changes, we will update this page and its effective date. Questions go to hello@obxthings.com.