Privacy Policy

What we collect

When you create an account, we store your email address and plan type (Basic or Pro). When you use the activity finder, we temporarily process your search inputs (age, location, mood, budget, etc.) to generate recommendations — these inputs are not stored long-term after the response is returned, though a short excerpt of your most recent request may be retained for support and abuse-prevention purposes as described below.

We store activity feedback (thumbs up/down) and your saved favorites so they persist across sessions. We also record the timestamp of your last generation to enforce usage limits on Basic accounts, a day-streak count and the date it was last updated (used to show your consecutive-day streak in the app), and basic technical data (such as IP address and request timestamps) for rate-limiting and security purposes.

If you upgrade to Pro, your payment is processed by Stripe. We store a Stripe customer ID in your profile to manage your subscription — we do not store your card number, expiry, or CVV at any point.

How we use your data

Your data is used solely to operate What2Do: authenticating your account, personalising your experience, enforcing plan limits, detecting and preventing abuse, and processing payments. We do not sell your personal information to third parties or use it for third-party advertising. We do not share it with anyone outside of the service providers listed below, except where required to comply with law, enforce these terms, or protect the rights, property, or safety of What2Do, our users, or others.

Sponsored listings

Alongside AI-generated recommendations, What2Do may show a sponsored listing from a business that has paid to appear — always visibly marked with a "Sponsored" label so it's never mistaken for an unpaid AI recommendation. Sponsored listings are selected using the same inputs you provide when generating results (such as your location, mood, age, and group type), matched by our own systems against criteria the advertiser sets in advance. This matching happens entirely within What2Do — we do not share your personal information, search inputs, or account data with sponsoring businesses.

Pro subscribers can turn sponsored listings off entirely from Settings; this preference is stored on your account. Basic accounts do not have this option and always see sponsored listings when a match applies.

Third-party services

Supabase — handles authentication and database storage. Your email and account data are stored on Supabase's infrastructure. See supabase.com/privacy.

Anthropic (Claude) — your search inputs are sent to Anthropic's API to generate activity recommendations. Anthropic processes this data per their API usage policy. See anthropic.com/privacy.

Stripe — handles all payment processing for Pro subscriptions. Your payment details are entered directly on Stripe's secure checkout page and are never transmitted to or stored by What2Do. See stripe.com/privacy.

Vercel — hosts the application and provides basic, aggregated traffic analytics. See vercel.com/legal/privacy-policy.

Umami — provides privacy-focused, cookieless website analytics (page views and traffic sources) so we can understand aggregate usage of the site. Umami does not use cookies, does not track you across other websites, and does not collect personally identifiable information. See umami.is/privacy.

Resend — delivers transactional emails (account confirmation, password reset, and usage notifications). See resend.com/legal/privacy-policy.

OpenStreetMap (Nominatim & Overpass) — for every generation, your location string is sent to Nominatim (OpenStreetMap's geocoding service) to convert it to coordinates, then to the Overpass API to look up real, nearby venues that may match your request — this helps recommendations reference places that genuinely exist rather than relying on the AI's memory alone. If weather-aware suggestions are enabled, your location is also sent to Nominatim and Open-Meteo to fetch current conditions. No account identifiers are attached to any of these requests.

Each of these providers processes data under its own privacy policy and terms, which we encourage you to review. We are not responsible for the privacy practices of these independent third parties.

Data retention

We retain account data for as long as your account is active. If you delete your account, your profile is removed from active use immediately, and a copy is kept for up to 90 days in a separate, restricted-access archive — used only to understand usage patterns among people who've left — before being permanently and automatically purged. This is in addition to records we're required or permitted to retain longer (for example, payment records needed for tax, accounting, or fraud-prevention purposes, which Stripe retains independently of What2Do).

Data security

We use reasonable administrative and technical measures intended to protect your data, including encryption in transit, access controls, and rate limiting. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your account password confidential and for promptly notifying us of any suspected unauthorized access at hello@what2do.me.

Your rights

Depending on your location, you may have rights to access, correct, delete, or receive a copy of your personal information, and to object to or restrict certain processing. You can exercise most of these rights directly from Settings, or by contacting us at hello@what2do.me. California residents may also have rights under the CCPA, including the right to know what personal information we collect and to request deletion; we do not sell or share personal information for cross-context behavioral advertising.

You can delete your account at any time from Settings. This permanently removes your profile, feedback history, saved favorites, and authentication record from our systems.

If you have an active Pro subscription, please cancel it before deleting your account to avoid further charges. Deleting your account does not automatically cancel your Stripe subscription.

For any privacy-related questions or requests, contact us at hello@what2do.me. We will respond within a reasonable time.

Children's privacy

What2Do is not directed to children under 13, and we do not knowingly collect personal information from anyone under 13. If you believe a child under 13 has provided us with personal information, please contact us at hello@what2do.me and we will take steps to delete it.

International data transfers

Our service providers may process and store data in the United States or other countries. By using What2Do, you acknowledge that your information may be transferred to, and processed in, jurisdictions with data protection laws that may differ from those of your own.

Cookies & local storage

We use browser local storage (not third-party cookies) to remember your dark mode preference, distance unit setting, and onboarding state. No third-party advertising cookies or tracking pixels are used on this site. Our analytics provider, Umami (see above), is also cookieless.

Accessibility

What2Do is committed to making our website usable by people of all abilities. We are actively working to align the site with the Web Content Accessibility Guidelines (WCAG) 2.1, Level AA — the standard commonly referenced for accessibility under the Americans with Disabilities Act (ADA) — including proper labeling for screen readers, keyboard navigability, and sufficient color contrast.

Accessibility is an ongoing effort rather than a one-time fix, and we continue to test and improve compatibility with screen readers, keyboard navigation, and other assistive technologies as the site evolves.

If you encounter a barrier that prevents you from accessing any content or feature on What2Do, please contact us at hello@what2do.me with the page and issue you experienced (and your browser or assistive technology, if relevant) so we can address it promptly.

Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be reflected on this page with an updated date. Continued use of What2Do after changes are posted constitutes acceptance of the updated policy. This Privacy Policy is governed by the laws of the State of California, consistent with our Terms & Conditions.