Cookies and storage

Last updated: 19 September 2026

Cookies we set

If you never sign in: none. Planning a trip, sharing a plan and reading this site set no cookies of any kind — not for analytics, not for advertising, not for sessions.

If you sign in: one, the session cookie that keeps you signed in between pages and visits. Its name begins with sb-; it holds a signed token that identifies your account and nothing about your trips. It is set by us, sent only to this site, never read by anyone else, and it goes when you sign out or delete your account. Under privacy law this is a strictly necessary cookie: it cannot be declined because it is the only thing that makes being signed in work, and it is not used for any other purpose.

You can check this yourself: open your browser’s developer tools on any page of this site and look at the cookie list for this domain. It should be empty until you sign in, and hold only the session after.

What we do store on your device

One thing, in local storage rather than a cookie. Local storage is not sent with every request the way a cookie is — it stays in your browser until something removes it.

• trailfuel.draft.v1 — the planner form as you last left it, so a refresh or a closed tab does not lose your progress. It holds what you typed: body figures, route, gear weights and any dietary restrictions you selected. It is written by the page in your browser, it is never transmitted to us, and it is overwritten each time you edit the form.

This is storage you asked for by using the planner, and it exists to deliver the thing you came for. That is why it needs no consent banner — but it is your device, so you can remove it whenever you like.

Clearing your browser’s site data for this domain does the same thing, as does using a private window, where nothing survives the session.

What we do not store

• GPX files. A route you import is read in your browser and discarded when you leave the page. A GPS track says exactly where a person walked, and we would rather not hold that.
• Generated plans. A plan lives in the address of its results page, not on your device and not in a database of ours.

Other people’s cookies

Nothing on this site loads a third-party script, embed, font or pixel, so no other party can set a cookie while you are here. Two cases are worth knowing about anyway:

• If you follow a product link. Retailers we link to — Amazon among them — set their own cookies once you are on their site, including the ones that attribute a purchase to us. That is their storage under their policy, and not following the link avoids it.
• Trail search. The beta trail search calls OpenStreetMap services through our own server, so your browser never contacts them directly and they cannot set anything in it.

Do Not Track and global privacy signals

There is nothing here to honour or ignore: we do not track you across sites, so a signal asking us not to changes nothing about how the site behaves.

If this changes

Analytics, saved profiles and a paid tier are all planned, and each one would introduce storage this page does not currently describe. If anything non-essential arrives, it ships with a consent mechanism and a rewrite of this page, not after one. The date at the top is how you can tell.

Contact

Questions about any of this: ctm313@gmail.com. Our privacy policy covers what reaches our server, which is a separate question from what is stored on your device.