Your data, clearly explained.

This technical disclosure describes the self-hosted PHP edition. The operator must adapt it to applicable laws, lawful basis and its real business details before launch.

Private browser workspace

Guest trips, original ticket files, local ZIP backups and free browser print views stay in this browser. Site administrators cannot silently see private guest trips. Clearing storage can remove these originals; keep independent backups.

Consented online copies and administrator access

Saving a text copy online uploads the selected destination, dates, activities, expenses, essentials/private notes and packing to MySQL, but not ticket files. Authorized administrators may view the complete saved text, make reasoned version-checked edits, and email a plan PDF to the account’s verified email address. These copies are not end-to-end encrypted. They do not automatically overwrite local browser trips. Previous online revisions are retained for 30 days by default.

AI drafts

When a signed-in user requests AI and confirms consent, trip name/destination/dates/travellers/budget and entered preferences are sent server-side to OpenAI. Existing activities, private notes and files are not sent. The request preferences and full returned draft are stored for administrator review/editing; original provider output is preserved separately from the editable version. Default retention is 90 days. Suggestions are unverified and not bookings.

Accounts and activity records

We store account name/email, a one-way password hash, role, email verification and suspension state. Administrator TOTP secrets and integration credentials are encrypted server-side. Online security/payment/support events are recorded with identifiers and timestamps. Signed-in online clients report trip create/update/delete, backup and print requests; these reports are not proof of every action. Guest/offline usage and actual browser PDF-save completion cannot be reliably identified. No keystroke/session-replay tracker is installed.

Email and SMTP

Verification links are account-bound, expire after one hour and can be used once. Administrators can queue legitimate service messages and selected plan PDFs to verified account emails. Mail queue payloads are encrypted at rest and passed to the configured SMTP provider; acceptance by SMTP is not guaranteed inbox delivery. Mail may contain private plan notes. Default terminal-job retention is 30 days. No bulk marketing relay is included. Password recovery remains an operator-reviewed process, not a fake reset-email screen.

Cashfree and PDF packs

Optional paid server PDF orders share account name/email/phone and order amount/reference with Cashfree. Card details are entered on Cashfree’s hosted page, not collected by this app. Cashfree SDK is loaded only on the dedicated checkout page. Orders store a fixed trip snapshot; paid generated PDF snapshots are encrypted in MySQL. Server export/download counts represent records and HTTP responses, not proof someone saved or opened a file. Free browser print remains separate.

Retention, deletion and host responsibilities

Default audit/activity retention is 90 days and redacted app-error log retention is 30 days. Cleanup requires the configured cron; disabling it does not magically delete records. Application logs omit passwords, keys and plan bodies. The hosting/SMTP/payment providers can keep their own operational records. Financial order/refund records and their snapshots are not automatically purged; the operator must define legal retention and deletion procedures. Accounts with financial records need reviewed deletion/anonymization, not a destructive one-click erase. Host backups must be encrypted and access-controlled separately.

Security boundary

The all-in-public_html edition depends on Apache 2.4 denying access to root config.php and the entire private directory. Verify HTTP 403 before entering real credentials. If the host ignores .htaccess or offers directory/PHP source exposure, do not use this layout; move private files outside the document root. No implementation guarantees 100% security or compliance certification.