Privacy

Navigator is a free public tool, maintained and funded by one person. This page lists what Navigator stores, why, how long it keeps it, and which services process it.

Navigator has no advertising and no advertising or cross-site trackers, and it does not sell personal data.

Last updated September 30, 2026.

Analytics

Cookies

Navigator sets only first-party cookies needed to run the site:

• sb-… (Supabase session): Keeps you signed in.
• navigator_anon_id: A signed, random browser id for the anonymous AI allowance and abuse limits. It is also attached to product events you trigger while signed in. Up to 12 months.
• nav_access: Remembers that an invite gave this browser access.
• nav_share_access, nav_share_context: Let a shared or gift link open the page it points to.

Your browser also keeps a few settings in local storage, such as the theme, list filters, dismissed notices, and recently viewed posts. They stay on your device.

Services that process data

• Vercel. Hosts the site. Web Analytics and Speed Insights count page views and measure page performance (see Analytics below).
• Supabase. Database and sign-in. Stores your account and everything listed under “How long we keep data”.
• OpenAI. Writes AI answers and summaries, and screens new and edited reviews. It receives your question, the conversation so far, the Navigator Data used to answer, your saved pay and household details when a calculation uses them, and the text of reviews being screened.
• LangSmith. Records a trace of each AI request so wrong answers can be investigated. A trace holds what was sent to and returned from OpenAI, as listed above. For signed-in AI-mode questions it also holds your saved pay and household details, if you have saved them, whether or not the answer used them. Keys and passwords are removed; the rest is stored as written, under the retention settings of Navigator's LangSmith account.
• Resend. Sends email: sign-in links, invites, account-deletion confirmation and recovery notices, and the newsletter if you subscribe.
• Cloudflare Turnstile. Checks for bots when you sign up, sign in, request an invite, or redeem one.
• Buy Me a Coffee. Handles optional support payments on its own site. Navigator links to it and receives none of your payment details.
• Photo and map hosts. Post pages load city photos directly from a third-party photo host, and some map pages load map tiles and country outlines from third-party hosts. Like any web request, those hosts receive your IP address and browser details. Navigator sends them nothing about your account.

How long we keep data

These are Navigator's retention rules. The daily job that deletes expired data is not switched on yet, so some records older than these periods still exist.

Your account

Sign-in email, account type and access state, and settings you choose.

Kept while your account exists. When you delete your account it is removed after a 30-day recovery window; a deletion record without your email remains.

Saved work

Posts, schools, comparisons, routes, calculations, and travel history you save.

Kept while your account exists and deleted with it.

Reviews, votes, and shares

Reviews and Q&A you publish, votes and flags, feature requests, and share links you create.

Kept while your account exists. When you delete your account, published reviews and Q&A stay without any link to you; votes, flags, requests, and share links are deleted.

Feedback

Ratings and comments you send about answers and pages, so problems can be fixed.

Open items are kept until handled. Handled feedback on AI answers is deleted 12 months after it was resolved. Everything you sent is deleted with your account.

AI debugging traces

Short-lived records of AI requests, used to investigate wrong answers. Recorded only while the maintainer has debug logging turned on.

Deleted after 14 days.

Usage limits

Rate-limit records keyed by account, a hashed IP, or a hashed email address, and the anonymous AI allowance keyed by a signed browser cookie.

Rate-limit records are deleted after 2 days. Each use of the anonymous AI allowance is deleted after 12 months, the length of the allowance, and the allowance record 12 months after its last use.

Product events

Counts of feature use (for example, invite sent or module shown) used to improve Navigator.

Deleted after 12 months, and deleted with your account.

Invites

Invite requests and codes, and which invites were redeemed.

Unredeemed codes are deleted 90 days after they expire. Requests that were denied or never activated are deleted after 12 months. The rest is deleted with the account.

Newsletter

Your email and confirmation status, if you subscribe.

Deleted 30 days after you unsubscribe, or 30 days after signing up if you never confirm.

Operator records

Admin access, data corrections, moderation decisions, and audit logs.

Kept for operating Navigator. If you delete your account, your email and id are removed from them.

Public reference data

Public contact addresses of embassies and missions shown on place pages.

Kept as reference data. These are institutional addresses, not personal data.

Your choices

• Download your data: Profile → Account & security → “Download my data”.
• Delete your account: Profile → Delete account. A 30-day recovery window comes first; after it, your account and the data tied to it are removed. Published reviews stay public with no link to you, and operator records keep the entry without your email or id.
• Stop the newsletter with the unsubscribe link in any newsletter email.
• Turn on Global Privacy Control or Do Not Track in your browser to skip page analytics.

Privacy requests: info@82forge.com. See also the terms of use and disclaimers.