Data Practices & Privacy

Privacy Policy

Effective Date: October 6, 2026 · Last Verified: October 2026

1. Our Core Privacy Philosophy

Cruise Promenade is designed from the ground up as a zero-login, friction-free planning utility. You do not need to register a user account, provide a password, or submit sensitive identity credentials to create or view a cruise itinerary.

2. Data Collection Across Application Surfaces

A. Local Draft Itineraries (Organizer)

When you build a plan in /planner, draft data (ship selection, travel dates, custom days, activity titles, and traveler first names) is initially stored in your browser's local storage (localStorage and sessionStorage). This draft remains on your device until you choose to share it or clear your browser storage.

B. Shared Planners and Server-Side Storage

When an organizer publishes a plan to create a share link, the complete organizer record is stored server-side in our key-value store and database, secured by a high-entropy organizer authorization token. When invited companions visit the passenger link (/p/[shareCode]), a sanitized shared record is delivered.

Sensitive Booking Fields Filtered: Organizer-entered confirmation numbers, provider direct telephone numbers, and provider contact emails are stored only on the organizer record and are stripped by server-side code before delivering shared links to companions.

⚠️ Shared Notes Notice: Activity titles, locations, and shared traveler notes are displayed directly to anyone holding the passenger link. Do not include confirmation codes, cabin numbers, or private contact details in shared notes.

C. Group Concierge Inquiries (/group-cruises)

When organizers submit an intake form for large parties (20+ travelers), we collect: organizer full name, email address, optional contact phone number, sailing details, estimated guest count, desired activities, and mobility notes.

Inquiry data is transmitted over HTTPS, stored in our database, and dispatched to our operations inbox (concierge@cruisepromenade.com) using the Resend email service and transaction webhooks. It is used solely to respond to your group request and coordinate arrangements. We never sell or rent inquiry records to marketing brokers.

3. Analytics, Cookies, and Authentication

We distinguish clearly between cookie-free analytics and functional session cookies:

Vercel Web Analytics (Cookie-Free): We use Vercel Analytics to monitor site performance and aggregate visitor counts. Vercel Web Analytics is documented as cookie-free; it does not set tracking cookies or log personally identifiable information.
Organizer Session Cookie (cp_org_session): When an organizer manages an existing shared plan, an HTTP-only functional session cookie (valid for up to 30 days) may be set to preserve editing authorization without requiring a user login or password. This cookie is strictly functional and is never used for behavioral advertising or third-party tracking.
Custom Application Telemetry: We record aggregated, non-personal event metrics (such as plan created, activity added, or booking link opened) to understand feature usage and improve navigation.
GetYourGuide Partner Integration: The GetYourGuide partner script (widget.getyourguide.com) is loaded to power the excursion availability calendar. When interacting with partner booking links, partner attribution identifiers (partner_id=F2MMUUH) are passed, and GetYourGuide may set cookies in accordance with its privacy policy.

4. Data Retention, Unpublishing, and Deletion Controls

Shared planners remain stored in our application database until modified or deleted by the organizer. Shared URLs do not have an automatic time expiration, but organizers have direct self-service controls:

Unpublish Shared Link:Organizers can unpublish a plan at any time. Unpublishing immediately disables passenger access (the public link returns 404 Not Found), while preserving the organizer's private plan on the server for continued editing or future re-publishing.

Delete Plan:Organizers can permanently delete their plan. Deleting removes the plan across all active server backends (key-value store and relational database), revokes all active organizer sessions, and deletes the local draft on that device.

Limits on Recalling Downloaded Copies: Unpublishing and deletion immediately terminate live web access. However, if a passenger previously printed a physical pocket itinerary, saved a PDF, or stored an offline browser snapshot on their device prior to deletion, our servers cannot remotely delete or recall that already-downloaded file.

You may also request manual deletion of your shared itinerary, inquiry submission, or contact information by emailing:

Privacy & Deletion Inquiries: concierge@cruisepromenade.com

5. Service Contact & Questions

Cruise Promenade operates as an independent digital planning tool. Questions or privacy concerns regarding this policy may be directed to concierge@cruisepromenade.com.