Privacy Policy

Version: 2026-10-22

1. Introduction

This Privacy Policy explains how SoundsGood ("we", "us", or "our") collects, uses, and protects your personal data when you use our travel planning application. We are committed to protecting your privacy and complying with the General Data Protection Regulation (GDPR), the UK GDPR, and other applicable data protection laws including the California Consumer Privacy Act (CCPA).

2. Data Controller

The data controller responsible for your personal data is:

SOUNDSGOODAPP LIMITED, trading as SoundsGood
Registered in England and Wales, company number 17151974
Registered office: 30 Arundel Grove, York, England, YO24 2RZ
Correspondence address:
61 Bridge Street
Kington, HR5 3DJ
United Kingdom
Email: SoundsGoodOfficial@proton.me

3. Personal Data We Collect

We collect the following types of personal data:

3.1 Information You Provide

Account Information: Email address, username, first name, last name, password (encrypted)
Profile Information: Bio, location, profile picture
Travel Preferences: Destination choices, liked and disliked places, trip duration preferences
Planning Data: Liked places grouped by city, personal notes, visited markers, manual day assignments, and previously saved trip archives
Social Data: Follow/following relationships, collaboration memberships, group chat messages, shared itineraries
Payment Information: Processed securely through Stripe (we do not store card details)

3.2 Automatically Collected Data

Authentication Tokens: Short-lived access tokens stored in app memory, refresh sessions stored in secure HttpOnly cookies, and a readable session status cookie that contains no token or personal data
Guest Session Data: A random, server-hashed session identifier, monthly usage allowance, rewarded-credit balance and one-time reward challenge records, keyed non-reversible identifiers derived from network and browser data for abuse prevention, swipe choices, and generated itineraries retained from the former free planner and attached to an account only after Premium checkout succeeds
Technical Data: IP address, browser type, device information (collected through server logs for security purposes). We also use a local IP-country lookup to show subscription prices in your connection country’s currency; this lookup does not send your IP address to a geolocation provider.
Usage Data: Session information, timestamps of activities
Product Analytics Data: First-party service events such as account creation, email verification, checkout progress, subscription status changes, searches, and liked-place library activity.

4. Legal Basis for Processing

We process your personal data on the following legal grounds, mapped to each processing activity:

Processing Activity	Data Involved	Legal Basis
Account creation and authentication	Email, name, password, tokens	Contract (Art. 6(1)(b))
Storing optional data in your browser (localStorage)	Preferences	Consent (Art. 6(1)(a))
place discovery and liked places	Destination, saved places, notes, visits, manual days	Contract (Art. 6(1)(b))
Subscription billing	Email, name, payment details (via Stripe)	Contract (Art. 6(1)(b))
Social features (follows, collaboration, chat)	Profile info, messages, relationships	Contract (Art. 6(1)(b))
Service emails (verification, password reset)	Email address, name	Contract (Art. 6(1)(b))
Retired rewarded-ad integration; no advertising requests are made	Cookie identifiers, device data, IP address, consent signals	Consent where required (Art. 6(1)(a))
Product analytics and service reporting	Account, checkout, subscription, search, and itinerary event data	Legitimate Interest (Art. 6(1)(f))
Security, fraud prevention, and logging	IP address, user agent, timestamps, and keyed identifiers used for guest allowances and trial-claim controls	Legitimate Interest (Art. 6(1)(f))

5. How We Use Your Data

We use your personal data for the following purposes:

To create and manage your user account
To authenticate your access to the application
To provide place discovery and individual place details when requested
To save your liked places, notes, visits, and manual day assignments
To enable social features (following users, collaborating on trips, group chat)
To process subscription payments
To confirm subscription access through secure checkout
To prevent automated abuse and protect account access
To send service-related emails (email verification, password reset, collaboration invites)
To improve our services and user experience
To ensure security and prevent fraud
To understand whether key service flows are working, including Premium account creation, checkout, subscriptions, search, and liked-place collections

6. Third-Party Services and Data Sharing

We share your data with the following third-party service providers:

6.1 Google Places API

We use Google Places API to provide location data, photos, and ratings for travel destinations. When you search for places, your destination queries are sent to Google.

Data shared: Destination names, search queries
Purpose: To retrieve place information and recommendations
Location: Google servers (may include transfers outside the EU)
Privacy Policy: https://policies.google.com/privacy

6.2 Former Itinerary Generation Provider

Automatic itinerary generation has been retired. New liked-place collections, notes, and day assignments are not sent to an itinerary generation provider. Previously saved itineraries remain in your account archive.

6.3 Stripe (Payment Processing)

We use Stripe to securely process subscription payments. We never store your full credit card details on our servers. Stripe is PCI-DSS Level 1 certified.

Data shared: Email address, name, payment card details (processed directly by Stripe)
Purpose: To process subscription payments
Location: Stripe servers (United States and EU)
Privacy Policy: https://stripe.com/privacy

6.4 Google Ad Manager (Rewarded Advertising Provider)

Rewarded advertising has been retired alongside free planning. The product does not request third-party ads.

6.5 Brevo (Email Delivery)

We use Brevo (formerly Sendinblue) SMTP to deliver transactional and service-related emails.

Data shared: Email address, name, email content
Purpose: To deliver account verification, password reset, and notification emails
Location: Brevo servers in the European Union
Privacy Policy: https://www.brevo.com/legal/privacypolicy/

6.6 Heroku (Database Hosting)

We use Heroku PostgreSQL to store your account information, preferences, and itineraries.

Data shared: All account and user data
Purpose: Database hosting and storage
Location: Heroku data centers (United States)
Privacy Policy: https://www.salesforce.com/privacy

International Data Transfers: Your data may be transferred to and processed in countries outside the European Economic Area (EEA) and United Kingdom, including the United States. The provider privacy policies linked above describe their locations and transfer arrangements. Stripe publishes a Data Transfers Addendum including EU standard contractual clauses and a UK Addendum. Salesforce/Heroku and Brevo publish their processor terms and transfer arrangements through their legal resources. The applicable mechanism depends on the receiving entity, the contract and the transfer. Contact SoundsGoodOfficial@proton.me for the applicable transfer basis and a copy of relevant safeguards.

7. Data Retention

We retain your personal data for the following periods:

Account Data: Retained while your account is active and deleted when you permanently delete your account, except records we must retain for legal compliance
Authentication Tokens: Access tokens expire after 15 minutes; secure refresh cookies expire after 7 days
Itinerary Data: Retained while your account is active, deleted upon account deletion
Social Data: Follow relationships, blocks, reports, collaboration swipes, and group chat messages deleted upon account deletion
Email Verification Tokens: Valid for 24 hours. Stored token hashes are cleared after successful verification; expired hashes are removed by daily cleanup, normally within 24 hours after expiry
Password Reset Tokens: Valid for 1 hour. Stored token hashes are cleared after successful reset; expired hashes are removed by daily cleanup, normally within 24 hours after expiry
Product Analytics Data: First-party service events retained for up to 18 months for service reporting, funnel analysis, and fraud prevention, then permanently deleted
Abuse Prevention: Guest usage counters, keyed network/browser identifiers, and historical hashed billing identifiers are retained only as long as needed to enforce allowances and prevent fraud

After account deletion, we may retain certain data for legal compliance purposes (e.g., fraud prevention, legal obligations) for up to 6 years where required by law.

8. Your Rights Under GDPR

You have the following rights regarding your personal data:

Right of Access (Article 15): Request a copy of your personal data we hold
Right to Rectification (Article 16): Correct inaccurate or incomplete data
Right to Erasure (Article 17): Request deletion of your data ("right to be forgotten")
Right to Restriction (Article 18): Request restriction of processing your data
Right to Data Portability (Article 20): Receive your data in a machine-readable format
Right to Object (Article 21): Object to processing based on legitimate interests
Right to Withdraw Consent (Article 7(3)): Withdraw consent for data storage at any time

To exercise any of these rights, please:

Use the "Delete Account" feature in your account settings (for right to erasure)
Use the "Export My Data" feature in your account settings (for data portability)
Contact us at: SoundsGoodOfficial@proton.me for other requests

We will normally respond within one calendar month. If a lawful extension is needed, we will explain it within that month. You also have the right to lodge a complaint with your local data protection authority if you believe we have not complied with data protection law. UK users can complain to the Information Commissioner’s Office (ICO) or call 0303 123 1113.

9. Your Rights Under CCPA/CPRA (California Residents)

If you are a California resident, you have rights under the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA):

Right to Know: You have the right to request information about the categories and specific pieces of personal information we have collected about you in the preceding 12 months, the categories of sources, the business purpose for collecting it, and the categories of third parties with whom we share it.
Right to Delete: You have the right to request deletion of your personal information, subject to certain exceptions.
Right to Correct: You have the right to request that we correct inaccurate personal information we hold about you. You can update most information directly through your account settings.
Right to Opt-Out of Sale or Sharing: We do not sell personal information. If personalised third-party advertising is enabled, information may be shared for cross-context behavioural advertising only after the applicable consent flow. You can opt out through Cookie Settings, an enabled provider privacy message, Global Privacy Control, or by contacting us.
Right to Limit Use of Sensitive Personal Information: We do not collect or process sensitive personal information as defined under CPRA (e.g., Social Security numbers, financial account credentials, precise geolocation, racial/ethnic origin, or biometric data).
Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA/CPRA rights.

To exercise your CCPA/CPRA rights, please contact us at SoundsGoodOfficial@proton.me or use the account management features in your settings. We will verify your identity before processing any request and will respond within 45 days of receiving a verifiable request, as required by CCPA.

10. Cookies and Local Storage

We use a secure HttpOnly cookie to maintain authenticated sessions, a readable session status cookie so the app can check whether a session may exist, and short-lived access tokens kept only in app memory. Browser local storage is used only for optional preferences after you have given consent.

10.1 Essential Storage (Necessary)

These are required for the application to function and cannot be disabled:

sg_refresh: Secure HttpOnly refresh cookie for maintaining your signed-in session (expires in 7 days)
sg_session: Readable session status cookie used to decide whether the app should check for an existing sign-in session. It contains no token or personal data (expires in 7 days)
sg_guest: Legacy HttpOnly guest identifier used only to attach existing trip data after successful Premium checkout
access token: JWT token for authentication, stored only in app memory (expires in 15 minutes)

Rewarded advertising is retired. Rejecting optional storage does not affect your subscription access. Checkout is required to use the planner.

For more details, see our Cookie Policy.

11. Data Security

We implement appropriate technical and organizational measures to protect your data:

Passwords are hashed using bcrypt with salt
Data transmission encrypted via HTTPS/TLS
Database access restricted to authorized personnel only
Regular security updates and monitoring
Automatic token expiration to limit exposure
Rate limiting on authentication endpoints
Input sanitization and validation

In the event of a data breach that poses a risk to your rights and freedoms, we will notify you and the relevant supervisory authority within 72 hours as required by GDPR Article 33.

12. Automated Processing

We use automated processing in the following ways:

Place Discovery: Search results are selected using your destination, categories, and budget preferences. You choose which places to like and how to organise them. Day assignments and notes are entered by you.

Under GDPR Article 22, you have the right not to be subject to decisions based solely on automated processing that produce legal or similarly significant effects. You retain control over which places to save and how to organise your travel plans. If you have concerns, contact us at SoundsGoodOfficial@proton.me.

13. Children's Privacy

Our service is not intended for children under 16 years of age. We do not knowingly collect personal data from children. Users must confirm they are at least 16 years old during registration. If you believe we have collected data from a child, please contact us immediately at SoundsGoodOfficial@proton.me and we will delete it.

14. Email Communications

We send the following types of emails:

Transactional emails: Email verification, password reset (these cannot be unsubscribed from as they are essential for account security)
Service emails: Welcome emails, collaboration invitations, follower notifications, message alerts

You can manage your email preferences or unsubscribe from service emails at any time through your account settings or by clicking the unsubscribe link included in every service email.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by email or through a prominent notice on our application. The "Last updated" date at the top of this page indicates when the policy was last revised.

16. Contact Us

For any questions about this Privacy Policy or our data practices, please contact:

Email: SoundsGoodOfficial@proton.me
General Support: SoundsGoodOfficial@proton.me
Address: 61 Bridge Street, Kington, HR5 3DJ, United Kingdom

17. Supervisory Authority

For EU/EEA Residents

If you are located in the European Economic Area, you have the right to lodge a complaint with your local data protection supervisory authority. A list of supervisory authorities can be found at:https://edpb.europa.eu/about-edpb/board/members_en

For UK Residents

If you are located in the United Kingdom, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

Information Commissioner's Office (ICO)
Website: https://ico.org.uk
Make a complaint: https://ico.org.uk/make-a-complaint
Phone: 0303 123 1113
Address: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF