Privacy policy

PlanWild keeps your gear, your lists and your trips so you and your crew can plan a trip together. It's free, and one person runs it.

There's no advertising here, no analytics, and nothing that tracks you. Nothing about you is sold, and nothing is handed to anyone beyond the companies named below and whatever mail provider carries Mark's email. PlanWild never sees your password and never takes a payment.

Two things become readable outside the app, and only when an organizer turns them on: a trip brief, and an open trip's bringing list and who's coming. Anyone holding either link can read it without an account.

Other people on a trip see your display name and what you're bringing. They don't see what you paid, the links you saved, or your notes.

Want to see what PlanWild holds about you, correct it, get a copy of it or have it gone? Write to privacy@planwild.net.

What PlanWild is and isn't — a planner, not a safety service — is in the terms of service.

PlanWild is run by Mark Onofrio LLC, a one-person company in the United States. There are no staff and no support desk, and the one person is Mark. That's worth saying plainly, because it sets what you can expect from the response times further down.

PlanWild is built for and offered to people in the United States. It's hosted in the US and everything it holds is stored there. There's no separate set of rules by country: whoever you are and wherever you live, you get the same rights, listed under what you can ask for.

Anything about this page goes to privacy@planwild.net.

Grouped by what you did, rather than by where it ends up.

• Your account. Your email address, your display name and your profile photo. Your account really lives at Clerk (below); PlanWild keeps a copy of those three things so a trip can say who's on it.
• Your gear. For each thing: a name, a category, what kind of shared item it is, what it weighs, what you paid, a link to it, and a note of up to 2,000 characters. Plus whether you'll lend it, and to whom.
• Your lists and kits. Their names and descriptions, the headings you use, and how many of each thing is on them.
• Your pets, if you save one. A name and whether it's a dog, a cat or another animal, nothing else, and which of your trips each one is coming on and whether they carry a pack there. A pet's things are a list of yours like any other: the people on a trip see a pet's name and kind, and only you see the list.
• Your trips. A name, a description, a place, the dates, whether it's a backpacking trip or a casual one, and a note of up to 300 characters on where to park and where the trail starts, if the organizer writes one, and the area a casual trip's brief shows everyone, if the organizer gives one.
• A route, if someone uploads a GPX file. PlanWild measures the file and keeps the distance, the climb, the high point, the shape of the climb, a start coordinate, the box the route sits inside, the file's name, and the track itself simplified to at most 1,000 points. The file isn't kept, and the per-point timestamps most GPX files carry are dropped when it's read.
• Bringing lists, on a casual trip. What's on the list, any note beside it, and who said they'd bring it. If you tick something off as packed, when you did, which only you see.
• Lending. Who asked whom for what, and the message of up to 500 characters attached to the ask.
• Friends. Who you've asked and who's asked you. Both ends have to agree, and turning one down deletes it rather than filing it. For a request made by email, the address that was typed with its name part hidden, until the request is answered or cancelled.
• Packing ticks. What you've ticked off for one trip.
• Feedback. What you wrote, and the page you were on when you wrote it — the path only. The form leaves out the query string and fragment, and the server rejects page paths that include either. Anything you type or paste into the feedback text is still part of your report.

• Sign-in cookies, set by Clerk. See cookies.
• Preferences kept in your own browser and never sent anywhere: light or dark, which headings you folded on a list, whether the weight breakdown was open.
• Error reports, when something breaks on the server. Each one carries the route it happened on, the error, up to fifteen frames of the stack, and PlanWild's internal id for your account. Before any of it is written down or emailed, anything shaped like a link token and anything shaped like an email address is replaced — and if the finished text still looks like it holds one, the whole body is thrown away and only a headline goes out.
• Request logs from Fly.io, which hosts PlanWild. They include your IP address, the way every web host's logs do. PlanWild's own code never reads or stores an IP address or a browser user agent. Clerk does, for each sign-in session — see the companies.

What isn't here is worth saying out loud, because most products can't say it. There's no analytics of any kind. No advertising. No tracking pixels or beacons. No profiling, and nothing that follows you to another site. Even the fonts come from PlanWild's own server rather than a font service. The only things a browser fetches from somewhere else are Clerk's sign-in script, on every page, and the map tiles on a signed-in trip page or on a brief whose organizer chose to show the map — both named under the companies that help run PlanWild.

This is the part worth reading twice.

• Only you. What you paid for something, the link you saved and your notes, on every item in your gear library. Your kits, and your lists until you put one on a trip. Which items you've ticked off packing.
• Everyone on a trip you're on. Your display name and photo. Once you attach a list to the trip: each thing on it by name, what it weighs, how many, what kind of shared item it is, and what your share of the crew's weight comes to. Not what you paid, not the link you saved, not your notes — those stay on your side. Anything you marked as lendable is listed for someone to ask to borrow — its name, category and weight — even when it's on no list, and who sees it is the choice you made on the item: everyone on the trip, or only friends who are on it. How far through packing you are: your name, a bar and a count like 3/12, never which items. They also see who's lending what to whom, though the message attached to a lending request only reaches the two people in it. On a casual trip: what's on the bringing list and who said they'd bring it.
• Someone who knows your email address. Whether it has a PlanWild account. Adding a friend is done by email, and PlanWild says when no account uses the address typed, so the answer tells them. If there is one, the request they sent shows them the address they typed with its name part hidden, like b•••@example.com, and not your name, until you accept. Anyone on a trip with you sees your name there already, so their request shows it too, and that tells them the address is yours. A request sent before PlanWild began keeping the typed address still shows your name and photo, because there is no typed address to show in its place. If they're already your friend, or have asked you already, PlanWild says so instead, which narrows it to the people they've befriended or asked. It works the other way round too. Anyone PlanWild has given an id for you, such as everyone who has been on a trip with you, can type an address and then ask you by the id. If the address is yours, PlanWild says they've asked already. Turn a request down and it disappears from their list. PlanWild limits how many addresses one account can try in an hour.
• Anyone holding a brief link. See the brief.
• Anyone holding an open trip's link. Who's coming, and who said they'd bring what. See open trips.
• You and the administrator. What you sent as feedback. Nobody else sees it, and a private note an admin writes on it isn't shown back to you.
• An administrator. Today that's Mark. The admin section lists every account's display name, email address and join date, counts of its lists, gear, trips and feedback, and every piece of feedback with its author's name and email beside it. It shows no gear, no lists, no trips and no briefs. And the honest half: he runs the database, so there's nothing in it he couldn't reach if he went looking. Nothing in the app puts your gear or your trips in front of him.
• Nobody else. Other people never see your email address: every screen that names someone is given at most an id, a display name and a photo. An account with no name set is shown as “Crew member”, numbered on a trip with more than one, never by its address. An address comes back in two places, both to the person who typed it: an invite you sent, where you see the address you typed, and a friend request you sent by email, where you see it with its name part hidden.

A trip brief is one of the two things PlanWild makes readable outside the app (the other is an open trip's link). An organizer publishes it, it lives at a long random link, and anyone holding that link can read it with no account. That's the point of it: it's for the people at home.

What's on it: the trip's name and description, the dates, when to expect the crew back, the place, the organizer's note on where to park and where the trail starts, the display name of everyone on the trip, and the name and kind of any pet coming. If there's a route, its distance, climb, high point and the shape of the climb. If the organizer turns it on, who's carrying which communal item and what it weighs.

A casual trip's brief — a cabin, a beach weekend — shows less to whoever holds the link: the name, the dates, when they're back, who's going, and an area the organizer chooses to give (“Near Stowe, VT”), but not the exact place, the directions or the plan, because together they say which house stands empty and when.

Someone on the trip who opens the same link while signed in sees the crew's version: on a casual trip, the exact place, the directions, the plan, who's bringing what and who's on each plan; on any trip, the route map and who's carrying the shared gear even when the organizer kept them off the public brief. PlanWild checks that they're on the trip before it shows any of it. Anyone else, signed in or not, sees the public version.

And if the organizer turns the map on, the route itself, drawn on a topographic map. That is the whole line, so it shows anyone holding the link where the crew will walk and where they'll camp. It's off until the organizer chooses it, and the switch says so before it's pressed. A brief with the map also has the reader's browser fetch map tiles from the US Geological Survey. A casual trip's brief never shows a route or a map.

What's never on it without the map: coordinates or the route line. What's never on it at all: anyone's email address, any internal id, the invite list, anyone's pack weight, and anything from a pet's list. The brief is assembled one field at a time on the server, and there are tests that fail if an email address, an id or a token reaches it, or a coordinate does while the map is off. An account with no name on it appears as “Crew member” rather than by its email address, numbered (“Crew member 1”, “Crew member 2”) when a trip has more than one.

Now the honest part. A brief link works for whoever holds it, and the page can be saved, printed or forwarded. Turning the brief off, or replacing the link, stops anyone opening it from then on — it can't take back a page somebody has already read or saved. And a published brief says that a named crew is somewhere else and when they'll be home. That's worth a thought before the link goes any further than it needs to.

Search engines are asked twice to keep briefs out of their results, by a header and by a tag on the page. That's a request, not a wall.

A trip is private unless its organizer makes it open. Private means people need an account to join. An organizer of a casual trip can make it open instead, for the relative who will never sign up: the trip gets one link, and whoever opens it types a name and is in. They can claim things on the bringing list, say how many they're bringing, and add things of their own. No password and no account.

What an open trip's link shows: the trip's name, dates and place, who's coming — the display name of everyone on the trip and the name of every guest — and the bringing list with who is bringing each thing and how many. An account with no name on it appears as “Crew member” rather than by its email address. It doesn't show anyone's email address, invites, the brief, or anything from a pack list.

An email address, if a guest gives one. It's optional, and it's used for one thing: PlanWild sends one message to it through Resend, with that guest's own link back to the list, so they can get in from another phone. It isn't shown to anyone, isn't used to sign anyone up, and nothing else is sent. PlanWild's database doesn't keep it: once that message has gone, or couldn't go, the address is dropped. Resend is a different matter. To send the message it gets the address, the guest's name, the trip's name and the link, which works as the guest's key, and it keeps its copy for thirty days, as it does an invite's (see the companies).

Because anyone can type an address in, these emails are limited. Each guest is emailed once at most, and one mailbox gets at most 3 an hour and 10 a day, counted across every trip. An address with a +tag counts as the same mailbox, and so does a Gmail address written with dots or at googlemail.com. One trip's link can send at most 20 an hour, all the trips one person organizes at most 40 an hour between them, and the whole site at most 200 an hour. Past a limit the guest still joins; they just aren't emailed. To count, PlanWild keeps a record of each send it allows: when, which trip, the organizer's account (by PlanWild's internal id), and a fingerprint of the address instead of the address. The fingerprint can't be turned back into the address, but someone who could read the database and already knew an address could check whether it had been sent one. The record isn't tied to the trip or the account it names, so that removing a guest or deleting a trip can't reset the counts: deleting either leaves it in place. Records more than a day old are deleted the next time a guest who hasn't had their link yet asks for it by email, whether or not that email then goes, so after a quiet spell one can be kept longer than a day.

What PlanWild keeps about a guest, on that trip only: the name they typed, what they claimed or added, and when PlanWild last tried to email them their link, if it has. It goes when the organizer removes the guest or deletes the trip; what the guest added stays on the list without their name, the way a member's does when they leave. A guest who makes an account can move what they're bringing into it, and then they're an ordinary member of the trip.

Each guest gets a key of their own, kept in their browser's storage and in the link emailed to them, and PlanWild stores only a scrambled form of it. That's what stops somebody holding the trip's link from acting as another guest. The honest part is the link itself: anyone holding it can see who's coming and add their name, and anyone with an account who holds it can join the trip. The organizer can make the trip private or replace the link at any time, which stops it working for everyone who has it, and search engines are asked to leave it out of their results. Losing the key just means adding your name again, or opening your emailed link.

If you invite someone. You type their email address. PlanWild stores it on the trip and sends one message to it through Resend, and caps how many invites one account can send in an hour. The link in that message only works for an account signed in with that address.

If someone invited you and you have no account. Somebody who knows your address typed it into PlanWild. It's stored on that trip so the invite can be matched if you sign up. You can ignore the message — the invite stops working after fourteen days either way. What PlanWild doesn't do is clear the address when that happens: there is no timer, so it stays on the trip until the trip is deleted, or until the person who invited you deletes their account. If you'd rather it were gone now, write to privacy@planwild.net and it will be.

An organizer's own join link is a different thing, and it does work for whoever holds it: anyone with an account who opens it joins the trip. The organizer can turn it off or replace it at any time.

Five of them run PlanWild, and here's what each one gets.

• Clerk — sign-in and accounts. Your email address, name and photo, and the sessions that keep you signed in. Clerk records your IP address and which browser you're on with each session, so it can spot a session that isn't you. Your account really lives there and PlanWild holds a copy. If you sign in with Google, Google tells Clerk your email address, name and picture, and Google learns you signed in to PlanWild. United States.
• Resend — email. For an invite: the address it's going to, the trip name, who invited them, and the join link. For a guest's link back to an open trip: the address the guest typed, their name, the trip name, and their own link, which works as their key. Also the error alerts that go to Mark. United States, and Resend keeps message content and delivery logs for thirty days. PlanWild not keeping a guest's address doesn't change Resend's copy.
• Fly.io — hosting and the database, in Chicago. Everything above sits on machines Fly runs, and Fly's own logs record requests your browser makes, including your IP address.
• The US National Weather Service — the forecast on a trip page. It's sent the route's start coordinate rounded to four decimal places and nothing else: no name, no address, nothing about whose trip it is. PlanWild's server asks, not your browser.
• The US Geological Survey — the topo map on a trip page, and on a brief whose organizer turned the map on. Besides Clerk, this is the only third party your own browser talks to: fetching map tiles tells USGS your IP address and roughly where the route runs. It happens on the signed-in trip page, and for anyone who opens a brief that shows the map — the brief's link itself isn't sent. Someone reading a brief without the map contacts nobody but PlanWild and Clerk.

And one that doesn't run anything: whatever mail provider carries Mark's email. An error alert lands there, and so does anything you write to the addresses on this page — the same as any email you send anyone.

None of them is an advertiser, and none of them is given anything about you to use for their own purposes. PlanWild doesn't sell personal information, doesn't share it for anyone's advertising, and has nothing to gain by doing either.

The exception every service has: if a law or a court order required something to be handed over, it would be, and you'd be told unless telling you was forbidden.

In the United States. The app and its database run in Chicago, and every company above is a US one. If you're somewhere else and use PlanWild anyway, what you put in is stored and handled in the US.

A list rather than a paragraph, because PlanWild doesn't run a tidy expiry schedule and it would be easy to write this as though it did.

• Your account and everything on it: until the account is deleted. Nothing expires on its own.
• Feedback you sent: kept after your account goes, with your name taken off it. The text you wrote stays as you wrote it.
• Things you added to someone else's bringing list: they stay on that trip, with no name on them.
• An email address someone was invited at: until the trip is deleted, or the person who sent the invite deletes their account. Write to privacy@planwild.net to have one removed sooner.
• A record of each try at emailing a guest's link: at least a day, and then until the next time a guest who hasn't had their link yet asks for it by email, whether or not that email goes, when every record more than a day old is deleted. It holds when, which trip, the organizer's account id, and a fingerprint of the address, never the address. Deleting the trip or that account doesn't delete it.
• Error reports: seven days in Fly's log search, which is Fly's own retention. The alert email sits in Mark's mailbox until he deletes it.
• Resend's copy of an invite, or of a guest's link email: thirty days.
• Database backups: Fly takes a snapshot of the database's disk once a day and keeps five days of them, and on 18 September 2026 one of those snapshots was restored and read in a basic database recovery rehearsal. Two things follow. A copy of something deleted can sit in a snapshot for up to five days after it's gone from the app. And because the snapshots are daily, a bad enough failure could lose up to a day of everyone's changes.

Open your account from the menu in PlanWild and choose to delete it. That goes through Clerk, the same place your name and email address live. If anything gets in the way, write to privacy@planwild.net and Mark will do it by hand.

What it's meant to do: remove your account, your gear, your lists, your kits, your packing ticks, your friendships, and your place on every trip you're on. A trip you organized isn't deleted out from under everyone else — it passes to whoever has been on it longest. Its join link is turned off, and so is its open link if it's an open trip: the guests already on it stay, and opening it again is the new organizer's choice. Its brief keeps its existing link and stays published or paused as it was. A trip with nobody else on it is deleted.

What stays behind, by design:

• Feedback you sent, with your name removed and the text intact.
• Things you added to a bringing list on somebody else's trip, with no name on them — an open need is still a need.
• A trip you organized, with its description, its dates and its route, now under someone else.
• Invitations other people sent to your email address. Deleting your account does not remove those records; they remain until the trip or sender's account is deleted. Write to privacy@planwild.net to ask for removal sooner.
• If a trip you organized was open, the record of each guest-link email it sent: it names the trip and your account by PlanWild's internal id, isn't deleted with either, and goes when it's pruned (see how long things are kept).
• A copy in a database snapshot, for up to five days.

And the part a policy usually wouldn't admit. Deletion runs on a message Clerk sends PlanWild when an account goes. On 18 September 2026 one of those messages was watched arriving on the live site and answered, so the path is connected — but no real account has been deleted through it yet. So treat deletion as something to confirm rather than assume: delete the account, then write to privacy@planwild.net and Mark will check it actually happened. The same message carries a change of name or email address, so the same caveat applies there.

You won't find the words “permanently deleted” anywhere on this page. A snapshot holds a copy for a few days, and the honest version of that sentence is the one above.

There's no download button yet. Write to privacy@planwild.net and Mark will put together what PlanWild holds about you and send it within thirty days. It will leave out other people's personal information — the addresses on invites you sent, the other people on a trip — because that part is theirs.

One thing you can export yourself today: a single pack list, as a CSV, from that list's own page. That's a list, not a copy of your account.

Both live at Clerk. Change them from the account menu and the change follows through to your trips, your lists and any brief, because PlanWild keeps your name in one place and every screen reads it from there — there's no stale copy sitting on a trip or a list to go and fix. The caveat under deleting your account applies here too: the change reaches PlanWild by the same message.

One thing that fails quietly: an invite already sent to your old address won't match your new one. Ask whoever invited you to send another.

Wherever you live, you can ask to see what PlanWild holds about you, correct it, get a copy of it, delete it, or object to something PlanWild is doing with it. No thresholds, no forms, and nobody gets a worse service for asking.

Write to privacy@planwild.net. You'll get an answer within thirty days. One person answers them, so the answer may be short.

If you were invited and never signed up, you can ask for your address to be removed at the same place. You don't need an account to ask.

PlanWild's own code sets no cookies in production. The one cookie it can write is a development switch used for testing, gated twice so it can't exist on planwild.net.

Clerk sets the sign-in cookies, and they're what keeps you signed in. Signed out, they're two small flags saying nobody is. Signed in, a session cookie, a refresh cookie and a client cookie, plus two short-lived ones while a session refreshes. Clerk's script also stores a copy of its own configuration in your browser, and Clerk's own cookie list names one more, set by Cloudflare, which sits in front of Clerk. These are Clerk's to set and Clerk's to change.

Three things live in your browser's own storage and never leave it: whether you chose light or dark, which headings you folded on a list, and whether the weight breakdown was open.

Why there's no cookie banner: none of this is advertising, analytics or tracking. Nothing here profiles anyone or follows you anywhere, and a cookie that signs you in isn't something to ask permission for.

One thing to be straight about, though. Clerk's script loads on every page of the site, including a published brief and an open trip's link. A family member who opens one, has no account and never signs in still gets that script and those two signed-out flags. Nothing about them is tracked and nothing profiles them — but it would be truer to say nothing is put on your device unless you sign in. That is not how the brief page currently works.

No third party collects information about what you do across other websites on any PlanWild page. PlanWild doesn't sell or share personal information and doesn't use it for targeted advertising. So a Do Not Track or Global Privacy Control signal asks for something PlanWild already does, for everyone, all the time. PlanWild doesn't read the signal, because there's no behavior for it to change.

PlanWild isn't meant for children and isn't aimed at them. Don't make an account if you're under 13. There's no age gate and PlanWild holds nobody's date of birth, so this is a rule rather than a check — it isn't verified and this page won't pretend it is. If Mark learns an account belongs to someone under 13, he deletes it.

The practical version for a family trip: a child should be a name on the bringing list, added by an adult, rather than an account of their own.

What's true, and checkable:

• Everything runs over HTTPS.
• PlanWild never sees or stores your password. Clerk holds it.
• PlanWild takes no payments and holds no card numbers, no government ids and no social security numbers. No field anywhere asks about health — but a note or a bringing-list item is a free text box, so don't type anything medical into one.
• Brief and join links are 256-bit random tokens, and an organizer can turn either off or replace it.
• An emailed invite expires after fourteen days, works once, and works only for an account signed in with the address it was sent to.
• The brief is built one field at a time, with tests that fail if an email address, an id or a token reaches it, or a coordinate does while its map is off.
• Error reports are stripped of anything shaped like a link token or an email address before they're written or sent, and a report that still looks like it holds one is thrown away rather than sent.

And what isn't promised. No system is perfectly secure, and PlanWild doesn't promise that what you put in can't be lost or reached by someone who shouldn't. Fly takes a daily snapshot of the database and keeps five days of them. On 18 September 2026, Mark restored and read one snapshot; this checked basic database restoration, not recovery of the whole app. There is no point-in-time recovery and no backup copy stored outside Fly. Nothing here should be read as a promise that your lists will still be there. Keep anything you'd hate to lose somewhere else too.

Found something wrong with PlanWild's security? Write to security@planwild.net. The same address is in /.well-known/security.txt.

If Mark finds that someone reached information they shouldn't have, he'll work out what happened, email the people affected, and tell whichever authority the law requires. That's one person sending emails. There's no automated notification system behind that sentence, and saying otherwise would be exactly the kind of promise this page is trying not to make.

The current version always lives at planwild.net/privacy, with the date it last changed at the top. If something material changes — a new company handling your information, a new kind of information collected, something newly visible to someone else — that gets said rather than quietly edited in. A typo fix doesn't get an announcement.

privacy@planwild.net for anything on this page: a question, a correction, a copy, a deletion, or an address you were invited at and want gone.

support@planwild.net for everything else, and security@planwild.net for a security problem.

Mark Onofrio LLC, United States. PlanWild has no office to visit and no phone number to call. Email is the way in.