Privacy

What Longcut keeps, and why.

Last updated: 4 November 2026

Longcut is a trip planner for small groups, on iPhone and the web. This page explains what it stores, what it reads on your phone, and which other services it uses.

What we store

• Your account: your email address, which is how you sign in. If you add them, your display name and a payment link (such as monzo.me or PayPal.Me) that people you share trips with can see.
• Your trips: destinations, expenses, stops and their locations, ideas, votes, check-ins with notes, checklists and settle-up payments, plus who added or changed each item.
• Files you add: documents, receipt scans and photos you attach to expenses or check-ins.
• Sharing and the trip log: the email addresses and roles of the people a trip is shared with, and the last 50 changes on each trip, so the party can see what’s new.

We don’t collect device identifiers, we don’t use analytics or advertising, and we don’t sell or share your data.

What the iPhone app uses, and when

• Location: to centre the map on you and to suggest places nearby when you tap Pin here. Checking in that way saves your current position as the stop’s location (or the place’s, if you pick one from the list). Your location isn’t tracked or saved at any other time.
• Calendar: to add your route as calendar events, and to look for flight and hotel events within your trip dates. That search happens on your phone. Only the bookings you choose to add become expenses.
• Photos: to find photos taken during your trip, using their date and location, on your phone. Only the photos you choose are uploaded. They’re resized and re-saved first, which removes the location and other details stored in the original file.
• Camera: to scan receipts. The text is read on your phone to fill in the expense, and the scan is uploaded and attached to it.
• Notifications: trip-log alerts and reminders are created on your phone. Longcut doesn’t use push notifications.

Other services

• Cloudflare: hosting, storage and sign-in (Cloudflare Access, which receives your email address when you sign in). See Cloudflare’s privacy policy.
• Apple Maps (iPhone): place search, directions and addresses. What you search for is sent to Apple.
• OpenStreetMap (web): maps and place search. What you search for is sent to OpenStreetMap’s Nominatim service.
• Open-Meteo: weather forecasts, using the destination’s city name and coordinates. See Open-Meteo’s terms.
• ExchangeRate-API: currency rates. No personal data is sent.
• Unsplash: trip cover photos. Our server looks them up by city name; your device then loads the image from Unsplash.
• Images and fonts on the web app: country flags from flagcdn, placeholder photos from Picsum, fonts from Google Fonts, and code libraries from cdnjs and the Tailwind CDN. Like any web page loading files from these services, your browser connects to them directly.

Apart from the searches and city names described above, these services don’t receive your trip data.

Storage and security

Your data is stored on Cloudflare’s infrastructure and sent over HTTPS. You have to sign in to use the app, and a trip is only visible to its owner and the people it’s shared with.

Keeping and deleting your data

• Your data is kept for as long as you use Longcut.
• Deleted trips, expenses, stops, photos and documents are kept for 30 days in Recently deleted so you can restore them, then removed. A deleted trip’s log of changes isn’t removed automatically; it’s deleted along with your account.
• A backup of your trips is taken every night and kept for 7 days.
• To delete your account and everything in it, email longcut@papado.me. Backups that include it expire within 7 days.

Children

Longcut isn’t aimed at children under 13, and we don’t knowingly collect data from them.

Contact

For privacy questions or deletion requests, email longcut@papado.me.