What is collected, why, who can see it, and how to get it back or have it deleted. Written under the GDPR, which applies because the service is published from France.
Version 1.18, published 23 September 2026
The data controller is Julie Cortes, Entrepreneure individuelle (sole trader, France), SIREN 104 036 710.
For anything on this page, write to contact@alsogoing.com. It reaches one person, and that person is the one who wrote the software.
When you create an account: email address, first name, and a password you choose. Last name, telephone number, nationality and a photograph are optional, and you decide whether to add them.
If you sign in with Google: no password is created at all. Google gives us your email address, your first and last name, and your account photograph, which is copied into our own storage once. After that, showing it never asks Google for anything again. Signing in this way also tells Google that you use this service.
When you use the service: the trips you post (places, dates, times, number of seats), the seat requests you send or receive, and the messages you exchange with other members.
After a trip: what you said about the people you travelled with (a rating out of five and, if you wrote one, a note) and what they said about you. Also whether a review was replied to, and whether it was reported or removed.
When something breaks: what went wrong, the page it happened on and what browser you were using, so that a fault can be found and fixed. It is sent to Sentry, named below. Anything in an error that looks like an email address or a telephone number is removed before it leaves.
When we email you: the day, which message it was, the address it went to, and what became of it: whether your mail provider accepted it, or refused it, or told us the address does not exist. Not whether you read it beyond the fact that it was opened, and never anything you replied.
This exists for one reason. A notification only reaches a phone that has added this app to its home screen, so email is how somebody learns their seat was accepted or their trip was called off. When that fails, the person it fails for is the last to know, because they simply hear nothing. So we keep the record that says it failed. An address a provider tells us does not exist is added to a list and not written to again, because continuing would stop our messages reaching everybody else.
When a limit stops you: the day, which kind of thing you were doing (sending messages, asking for seats, posting trips, reporting something) and how many times you were stopped. Not what you were trying to send, and not the message itself. There are limits on how much of any one of those a person can do in an hour or a day, so that nobody can flood the service; the record exists because without it we cannot tell a limit set too tight, which has stopped somebody with a genuine reason to be in a hurry, from somebody hammering it on purpose.
If you turn on notifications: a subscription issued by your browser, which lets a message be delivered to that device. It identifies the browser, not you.
When you accept these documents: which version you accepted, when, and the address and browser the acceptance came from. That last pair exists for one reason: being able to show, if it is ever disputed, that an agreement was actually given.
If you install the app on your home screen: the date, once a day, on which it was opened that way, and whether the device is an iPhone, an Android or a computer. It is recorded against a random identifier created on that device, which is linked to your account once you sign in. Nothing about what you looked at or did is recorded, only that the installed app was opened, and on which day.
When the app looks up an address or draws a map: the date, which outside service was asked (Google or Mapbox), which of their services it was, which screen it happened on, and your account when you are signed in. It is recorded so that we can see what this service costs to run. What you typed is not recorded, nor the address itself, nor the page address. When an account is deleted, these records stay as a count and stop carrying the account.
When you open any page: the address of that page, the site you arrived from if you followed a link, the country your connection appears to be in, and whether you are on a phone or a computer, together with how long the page took to become usable. This is collected by Vercel, who run the servers this site is on. It is counted rather than followed: no cookie is set, no identifier is kept between visits, and nothing joins one page view to the next, to your account, or to you. It exists so that we can tell whether people can find the service at all, and whether it is fast enough on a phone on a mobile connection in Sri Lanka.
While you are signed in, the pages you open, against your account: the address of each page (without anything after a question mark in it) and the moment you opened it. This one is not anonymous: it is a list, per member, of which pages they looked at and when, and the person who runs this service can read it. It is not asked about in the cookie banner because nothing is written to your device for it, and it is recorded whatever you answer there. No IP address and no description of your browser are kept with it. Nothing is recorded while you are signed out.
Each time you sign in: the moment, and whether it was with Google, an emailed link or a password. Each time you sign out: the moment. Also kept against your account, also readable by the person who runs this service, and also without an IP address or a description of your browser.
Each time you change your profile: the moment, and which parts changed (your name, photograph, nationality, a few words about you, languages or telephone number). Only which parts, never what they said before or after.
If you agree to it, and only then: the same page addresses and referring sites again, this time to Google Analytics, which does keep a cookie on your device so that a second visit can be told from a first one. Advertising features are switched off in its configuration rather than merely unused, so nothing here can be turned into an audience.
With the same agreement, a recording of how the screens were used: where you tapped, how you scrolled, and what the page showed while you did, sent to PostHog so that we can see where somebody gets stuck. Anything you type is hidden before it leaves your device, conversations and the administration pages are never recorded at all. If you are signed in, the recording carries your account's internal number so that we can find it if you write to us about a problem, and nothing else about you: not your name, your email address or your telephone number. PostHog keeps an identifier on your device so that the pages of one visit can be put together.
These two are the only things on this site that write anything to your device for measurement, which is why they are the only thing you are asked about. Say no, or say nothing, and neither is loaded: no cookie, no request, nothing sent to Google or to PostHog.
Nothing else, and nobody else. There is no advertising network anywhere in this site, and nothing here follows you across other people's websites. Apart from the Google and PostHog identifiers you may have agreed to and the list of pages kept against your account described just above and the records of your sign-ins, sign-outs and profile changes, nothing written above carries an identifier of any kind, and every other measurement in this section is our own, stays on our own servers, and is never shared or sold.
Worth knowing before you post a trip. When you create one, or when your seat request is accepted, your first name, your photograph and your nationality appear on that trip, and trips are visible to anybody browsing the site, including people with no account.
This is deliberate: knowing who is already in the car is the point of the service, and requiring an account to see it would keep out exactly the people deciding whether to join. But it does mean the information is public rather than shared within a closed group.
Once you have travelled, so are the reviews. What the people you travelled with wrote about you is published on your profile, with their first name and photograph, and can be read by anybody, signed in or not. So are two figures counted from them: how many people rated you highly, out of how many rated you at all. The individual ratings are never shown as a number or an average.
Your email address, your telephone number and your messages are never public. Messages are visible only to the people in the conversation, with one exception, which only somebody in it can make. If a member reports another from inside a conversation (a private one, or a trip's group), a copy of its latest messages (up to a hundred) is sent with the report, and the people who handle reports read it. In a group that includes what everybody else in it wrote, with their first names, but never anything written after the person reporting left it. The copy is kept with the report. Neither is a review before it is published: until both of you have answered, or a fortnight has passed since the trip, the other person cannot see what you wrote.
If you would rather not appear, leave the photograph and nationality empty (the service works without them), or close the account. A review cannot be hidden on request; what answers an unfair one is the right of reply, set out in the Terms.
A suspended account is shown to nobody. While a suspension lasts, that person's profile is not served, and their name and photograph are replaced by “A traveller” wherever they appeared: in trips, in conversations and beside reviews they wrote. Nothing is erased by it, so lifting the suspension puts all of it back.
To provide the service: your account, your trips, your messages. Basis: performance of the contract between us, which is these terms.
To send notifications about a reply or an accepted request. Basis: your consent, given when you turn them on, withdrawn whenever you turn them off.
To keep the service safe: investigating a report, closing an abusive account, and keeping the record of a limit having stopped somebody. Basis: our legitimate interest in members not being harmed here.
To know whether the installed app is used: a count of openings per day, nothing more. On iPhone a notification can only reach an app added to the home screen, so without this we cannot tell how many people are reachable at all. Basis: our legitimate interest in understanding our own service. Write to us and we will stop counting your device.
To know whether the site is found and whether it is fast: a count of page views with no identifier attached, and a measure of how long pages take to become usable. A service nobody can find, or one that gives up on a slow connection, fails silently: nobody writes in to say they left. Basis: our legitimate interest in understanding our own service. It sets no cookie and cannot be tied to you, which is also why there is nothing here to switch off.
To see how members use the service: the list of pages each signed-in member opened, when they signed in and out and when they changed their profile, described in section 2. It shows where somebody gives up, what they come back to, and whether an account is still in use. Basis: our legitimate interest in understanding and running our own service. You may object by writing to us, and we will stop recording your account.
To understand how the service is used: page addresses and referring sites in Google Analytics, and recordings of the screens in PostHog, if you agreed when asked. Basis: your consent, given by pressing yes, withdrawn from section 10 of this page or by clearing this site's storage in your browser. Nothing depends on it: the service behaves identically whichever you choose.
To hand the service on if it is ever sold or passed to somebody else, in the circumstances set out in section 6. Basis: our legitimate interest in being able to transfer what was built here without shutting it down on the people using it.
Supabase: database, authentication, and storage of profile photographs. Data is held in the European Union.
Vercel: hosting and delivery of the site itself, and the page counts and loading times described in section 2. It receives the page address, the referring site, the country and the kind of device. It sets no cookie, keeps no identifier between visits, and never receives your account.
Google: when you type a place into a search field, what you type is sent to Google Maps to suggest and locate it, and to estimate how long a journey takes. Google receives those place names. And if you choose to sign in with Google rather than with a password, it is told that you are signing in here, and it gives us your address, your name and your photograph. Nothing after that asks Google for them again: the photograph is copied into the storage named above, so drawing your face on a page, or in an email somebody else receives, never reaches Google.
Google Analytics, separately and only with your agreement: the addresses of the pages you open here, the site you arrived from, and an identifier held in a cookie on your device. Google is an American company and this data may be handled outside the European Union. Refusing means it is never loaded at all, so there is nothing to transfer.
PostHog, with the same agreement and only then: recordings of how the screens were used, with everything typed hidden, and an identifier held on your device. Data is held in the European Union. Refusing means it is never loaded.
Mapbox draws the map on a trip page and the line between its two ends. It receives the two points of that trip, and the fact that a map was drawn. It does not receive your account.
Your browser's push service (Apple, Google or Mozilla, depending on the device) delivers notifications if you turn them on. It receives the notification, not your account.
Sentry tells us when something in this application breaks. When a page or a request fails, it receives the error, the address of the page it happened on, and a description of the browser. It does not receive your messages, your trips or your account. Data is held in the European Union, and the application removes anything that looks like an email address or a telephone number from an error before it is sent.
Nobody buys this data, and nothing is shared for advertising. Data may be disclosed to an authority where the law requires it.
AlsoGoing is run by one person. If it is ever sold, merged into another company, or passed on to somebody else, the accounts and the trips would go with it. A service without its members is not a service, and there is no honest way to hand over one and not the other.
Three things would hold, which is the reason for saying this here rather than leaving you to discover it. You would be told before it happened, not after. Whoever took it over would be bound by this policy as it stands, until they published their own and asked you to agree to it. And if you would rather not go with them, the Delete my account button works at that moment as at any other.
This is not the same thing as selling your data. What section 5 says stays true: nobody buys it, and nothing is handed to anybody for advertising. What would change hands in a sale is the whole service (the software, the name, and the accounts on it), not a list of people sold off on its own. Selling data as merchandise is a different act, and it is not one that will happen here.
Supabase stores the data in the EU. Vercel and Google are American companies and some processing takes place outside the EU, framed by the European Commission's standard contractual clauses and, for the American entities certified under it, the EU–US Data Privacy Framework.
Your account: as long as it exists. Ask for it to be closed and the profile is deleted.
Reviews: for as long as the profile they are on. They are what somebody else can read before agreeing to travel with a stranger, and a reputation that expires quietly is not one.
Trips and requests: up to three years after the journey, so that a dispute about a past trip can still be looked into.
Messages: as long as the conversation exists. Deleting your account removes your side of it; what you sent to somebody else may remain in their conversation.
Notification subscriptions: until you turn notifications off, or until the device stops accepting them.
Records of accepted documents: as long as the account, and deleted with it. They are the proof of an agreement, and an agreement with somebody who has left is not worth keeping.
Records of an email we sent you: as long as the account, and then the record stays with your name, your address and the message itself removed from it. What is left is that a message to some mailbox once failed, which is what stops us writing to a dead address for ever, and it no longer says whose it was.
Records of a limit stopping you: as long as the account, and deleted with it. They are only meaningful beside the person they are about, and there is nobody left to ask about them.
The pages you opened while signed in, when you signed in and out, and when you changed your profile: as long as the account, and deleted with it.
Counts of what an address lookup or a map cost us: two months in detail, then kept only as a daily total per service with no account on it. Closing your account takes your account off them straight away.
What Google Analytics holds, if you agreed to it: two months, which is the shortest Google allows and is set rather than left at whatever it arrives as. Clearing this site's cookies in your browser ends it for that device immediately, and refusing means there was never anything to keep.
What PostHog holds, if you agreed to it: recordings are deleted after thirty days.
Under the GDPR you may ask to see the data held about you, to correct it, to have it erased, to restrict or object to its use, and to receive it in a portable form. You may also withdraw consent to notifications at any time, without that affecting anything done before.
Erasing your account does not need us at all. There is a Delete my account button at the bottom of your profile. It takes effect immediately and cannot be undone: your name, email address, telephone number and photograph are erased, and you cannot sign in again. Any trip you were hosting that has not yet departed is cancelled, and the travellers who had a seat are told.
Some things survive it, and not by oversight. Messages you sent stay in the conversations you sent them to, and trips that already took place stay in the history of the people who travelled on them, shown as “Deleted account”. Removing them would tear holes in records that belong to other people as much as to you. Reports made about you are kept for the same reason, so that closing an account cannot erase them.
Reviews split in two, and the line between them is whose they are. What you wrote about other people stays on their profiles, with your name taken off it: the screens read it as “A traveller”. It is an account of how somebody else travelled, and letting anyone erase every word they have given by closing an account would leave nothing worth reading. What other people wrote about you is deleted with the rest: it is about you, and there is no longer anybody for it to inform.
For anything else (seeing what is held about you, correcting it, restricting its use, or receiving it in a portable form), write to contact@alsogoing.com. You will get an answer within one month. Correcting your own details is quicker from your profile.
If the answer does not satisfy you, you may complain to the French data protection authority, the CNIL (cnil.fr), or to the equivalent authority where you live.
One is set without asking, and it holds your session so that you stay signed in between visits. It is strictly necessary for the service to work, which is why you are not asked to consent to it.
Two are set only if you agree: Google Analytics's, and PostHog's for session recordings. They are the entire reason there is a banner on this site. Everything else we measure (the page counts and loading times in section 2) is done without writing anything to your device, so those need no question and are not asked as one. Refusing is a single tap in the same place as accepting, and after refusing nothing is sent to Google or to PostHog at all.
There are no advertising cookies, and none belonging to anybody else. Your answer is remembered by this browser on this device, so a different phone or a cleared browser will ask again.
This policy carries a version number and a date, at the top of the page. If it changes in a way that affects you, you will be told rather than left to notice.