Privacy Policy

1. Who we are

ShareBucketList is operated by ShareBucketList.com ("we", "us"), which is responsible for the personal information described here. Contact: legal@sharebucketlist.com, 10 Weybridge Ct, Severna Park, MD 21146.

2. Information we collect

Information you give us

• Account: username, email address, name and password (stored only as a secure hash); optionally date of birth and phone number.
• Profile and preferences: profile details you choose to add, home location, travel preferences, and settings such as units, currency, language, time zone and theme.
• Trips and plans: itineraries, days, lodging, transport, meals, booking tasks, confirmation numbers, contacts, notes and comments, and the people you list as travelers.
• Traveler profiles: if you add them, travel documents and memberships such as passport number and expiry, trusted-traveler numbers, and loyalty-program numbers. These are visible only to you and to our authorised staff.
• Content: bucket-list items, activities, location submissions, reviews, photos and other uploads.
• Role requests: business details and any documents you submit when applying for a vendor or content-provider role.
• Messages you send us.

Information collected automatically

• Technical data: IP address, browser and device type, pages requested and timestamps, recorded in server logs for security and troubleshooting. To stop people guessing passwords or sign-up codes, or scraping the site, we also count sign-in, sign-up and password-reset attempts, and searches, per IP address for up to an hour. These counts are not linked to your account and are then discarded.
• Cookies: see section 6.

3. How we use it

• To provide the Service: your account, your trips and lists, and sharing with the people you choose.
• To send service emails such as account verification, password resets and important notices.
• To review content submitted for public display and to keep the Service safe, including preventing fraud and abuse.
• To maintain, secure and improve the Service.
• To meet legal obligations.

Where the law requires a legal basis, we rely on performing our contract with you, our legitimate interests in running a safe and useful service, your consent (which you can withdraw), and legal obligations.

4. Who can see your information

• People you share with: trips are private unless you give someone access. People you grant access to can see the trip at the level you allow, and everyone on a trip can see the names and roles of the others on it.
• Tickets and travel documents: a trip's editors can upload booking documents (such as boarding passes, e-tickets and booking confirmations) to a trip. They can contain names, booking references and travel details. They are stored privately, never at a public address, and can only be opened by people who have access to that trip. Removing a document, or the booking it belongs to, deletes it; copies in our backups are deleted as those backups expire (within about a year).
• Changes to a trip: we keep a record of changes made to a trip's plan (what changed, when, and by whom) and email the other people on the trip a daily summary, plus an immediate email when a journey's time changes in the week before it. Each person can turn these emails off for a trip from that trip's page, or all emails under Settings.
• Trip invitations: a trip's editor can invite someone by email address. We use that address only to send the invitation (and to give access straight away if it belongs to an existing account), keep it with the invitation so the editor can see it is waiting, and do not add it to any mailing list. If you received an invitation you didn't expect, you can ignore it; it stops working after 14 days.
• Public links: if a public link is created for a trip, anyone with the link can see a limited summary (destination, dates and an outline). Detailed sections, lodging, transport, confirmation numbers, traveler names and trip photos are not included.
• Trip photos: photos added to a trip's album can be seen by everyone the trip is shared with in the app, and show who added them.
• Other users: content you submit for public display, such as activities and locations, may show your username once approved. Reviews you post (including a rating and notes you choose to share when ticking off a goal) are public straight away and show your username; you can edit or delete them at any time.
• Our staff, where needed to operate, support and moderate the Service.

5. Service providers

We do not sell your personal information. We use service providers who process data on our behalf, including our hosting provider, our email delivery provider, and content-delivery networks that serve icons and scripts to your browser (which can see your IP address when your browser fetches those files). Some pages display images from third-party image hosts. Map pages load map images from OpenStreetMap's servers, which likewise see your IP address and the area of the map you view. To place a trip's stays on its map, the address of each stay (never who is staying) is sent once to OpenStreetMap's address search (Nominatim). To count visits, each page you open (its address without anything after a ?, the referring site, and your browser, device type, screen size, language and approximate location — country, region and city) is recorded by our own statistics service (Umami, run on our own server). It sets no cookies and stores no IP address, we use it only for overall numbers, and it does not count you if your browser sends Do Not Track. Shared-trip, invitation and password-reset links are never recorded. Providers may be located in other countries; where required we use appropriate safeguards for those transfers.

We may disclose information if required by law, to protect the rights and safety of our users or others, or as part of a business transfer such as a merger, in which case this policy will continue to apply.

6. Cookies

We use only the cookies the Service needs:

• sessionid: keeps you signed in.
• csrftoken: protects forms against cross-site request forgery.
• ui_theme: remembers your display theme.

We do not use advertising or cross-site tracking cookies. Our visit statistics (section 5) use no cookies at all.

7. How long we keep it

We keep your information while your account is active. You can delete your account yourself under Settings → Your data. It is hidden at once and deleted 30 days later (signing in before then cancels it). Deleting it removes your profile, travel profile and loyalty programs, bucket list, photos, notifications and calendar links. Some things stay because others rely on them, without your name: reviews you posted and notes you left on shared trips (shown as from "a former member"), places and events you added to the catalogue, and trips you started that other people are on (they pass to another member of the trip). Our backups keep copies for up to 12 months before they expire, and we never restore a deleted account from them. We may keep information longer where the law requires it, or for security or dispute-resolution reasons. Server logs are kept for a limited period.

8. Security

We use reasonable technical and organisational measures to protect your information, including encrypted connections (HTTPS) and access restricted to authorised staff. No system is completely secure, so please use a strong, unique password and think carefully before storing sensitive documents such as passport numbers.

9. Your choices and rights

You can view and edit most of your information in your account settings, and download a copy of all of it (a zip file) or delete your account under Settings → Your data. Depending on where you live, you may also have the right to access, correct, export or delete your personal information, to object to or restrict some processing, and to withdraw consent. To make a request, email legal@sharebucketlist.com. You may also complain to your local data-protection authority.

10. Children

The Service is not intended for anyone under 16. We do not knowingly collect personal information from children under that age; if you believe a child has given us information, contact us and we will delete it.

11. Changes to this policy

We may update this policy. If a change is significant we will give reasonable notice, for example by email or a notice in the Service. The effective date at the top shows when it was last updated.