Privacy Policy

1. Who we are

Group Holiday Booking (“we”, “us”, “our”) is a group holiday planning service. We help groups of friends and family coordinate travel dates, compare flights, and vote on destinations. Our registered contact address is privacy@groupholidaybooking.com.

2. What data we collect

We collect the minimum data needed to run the service:

• Account information — your name and email address, provided by Google when you sign in with Google OAuth.
• Home postcode — optionally provided by you, used only to find your nearest airport and estimate ground travel costs. Never shared publicly.
• Availability dates — the busy/free dates you submit for a holiday group. These are visible to other members of the same group after the blind-reveal (once everyone has submitted).
• Preferences & votes — your destination preferences, trip-length preferences, and votes on destination candidates within a group.
• Usage data — standard server logs (IP address, browser type, pages visited) retained for up to 90 days for security and debugging.
• Feedback — star ratings and optional comments you submit through the in-app feedback button.

3. Google Calendar access

If you choose to sync your Google Calendar, we request read-only access to your calendar events for the sole purpose of identifying your busy dates within the holiday window. We do not store your calendar data on our servers — it is processed in your browser in real time and discarded when the page is closed. We never read, modify, or share your calendar events.

Our use of Google Calendar data complies with the Google API Services User Data Policy, including the Limited Use requirements.

4. How we use your data

• To provide the group holiday planning service.
• To send transactional emails (e.g. “everyone has submitted their availability”).
• To identify your nearest airport and estimate travel costs.
• To improve the service based on aggregated, anonymised feedback.

We do not sell your data, share it with third parties for marketing purposes, or use it for advertising.

5. Data sharing

We share your data only with:

• Other members of your holiday group — your display name, home postcode (truncated to district), and availability dates are visible to members of groups you join.
• Infrastructure providers — Supabase (database and auth), Railway (API hosting), Vercel (web hosting), and Resend (email delivery). Each processes data only as instructed by us.
• Google — when you use “Sign in with Google” or sync your calendar, subject to Google's Privacy Policy.

6. Data retention

Your account data is retained until you request deletion. Holiday rooms and their associated data are retained while the room exists. You or the admin can delete a room at any time, which permanently removes all its data. Server logs are retained for 90 days.

7. Your rights

Under UK GDPR you have the right to access, correct, port, or erase your personal data. To exercise these rights, email privacy@groupholidaybooking.com. We will respond within 30 days.

8. Cookies

We use strictly necessary cookies for authentication (Supabase session tokens). We do not use advertising or tracking cookies.

9. Changes

We may update this policy. Significant changes will be communicated via email to registered users. Continued use of the service after changes constitutes acceptance.

10. Contact

Questions about this policy? privacy@groupholidaybooking.com