Privacy
Pond Hopping · last updated 18 October 2026
Pond Hopping is a personal travel log. It holds what you put into it and shows it to you. There is no advertising, nothing is sold, and nothing is shared for marketing or tracked across other apps and sites.
Two things it is worth being blunt about, because they are the ones people would mind: we record which screens you use, so we can tell what is broken or ignored; and to write your trips up, we send your photographs, places and words to OpenAI. Both are explained below.
What is stored
Your Eend Account is one sign-in for Eend's apps, Pond Hopping and Pushback. Each app keeps its own settings.
- Your email address. You sign in with a code we email to it, or with Apple or Google, who tell us your address (with Apple it can be a relay address Apple makes for you). There is no password.
- What you write — trips, dates, journal entries, flights, wishlists and plans.
- What you spent, if you record costs: the description, amount and currency.
- Your activities, if you log them: distance, pace, elevation and — where your watch recorded it — your average and maximum heart rate.
- Booking emails you forward, including the original text of the message and your booking reference. See Emails you forward below.
- Email addresses of people you invite, so their invitation is waiting when they first sign in.
- Photos you upload, along with the date and, where the photo carries one, the location recorded by the camera that took it. Photos are resized on your device before they are uploaded.
- Places you stopped, and the route between them, but only if you switch that on. See below.
- A notification token for your device, if you allow notifications, so we can tell you when something arrives.
- Which screens you opened and what you tapped. This is how we find out that a button nobody presses is broken rather than unloved. It is held in our own database and it is also sent to PostHog, an analytics service — see the table below. It is not sent to an advertising network and you are not tracked across other apps and sites. Anything that looks like an email address is removed from the detail of an event before it is sent, and anything long enough to be something you typed is cut short.
- Crash and error reports, including what the app was doing at the time, so faults can be fixed without waiting for somebody to describe them.
- Earlier versions of what you wrote. When you edit or delete a journal entry you wrote yourself, the previous version is kept, so a story rewritten by the app can never lose words you typed. The same is done for a trip's story before it is rewritten, and for who has what standing on a trip. These archives are readable only by us, are never shown to another hopper, and go when your account does.
Stories we write
We write each of your trips up as a story once there is something in it to write from, and we write each day of a running trip after it ends. We start this ourselves; you do not have to ask. To write it, we send OpenAI:
- the trip's photographs — a small copy of each, and a larger copy of the few that look as if they show a name worth reading — with when and where each was taken;
- the places you stopped and the route between them, if you record places, and those of the people on the trip who have offered theirs;
- the trip's flights, runs, stays and other bookings;
- what you and the people on the trip wrote in its journal, the names of the people on it, and your answers to the questions a story asks.
Where you took several photographs in one spot and nothing names the place, we send Foursquare (or Google, if Foursquare cannot answer) the position of that spot, to find the places within 100 metres, and then ask you which one it was. At most three spots each time a story is written.
In your own voice. When we write, we also send OpenAI things you have written before, on that trip and on your other trips, so the story sounds like you rather than like a brochure. Only your own writing, never anybody else's. This is on by default.
To stop it, turn off Let us write my trips up in Settings › Notifications. While it is off we write no story of yours and send none of the above for one; stories already written are kept. In my own voice is under it. On a trip somebody else owns, the owner's setting is the one that counts, because the photographs and the words are theirs.
Emails you forward
When you forward a booking confirmation to bookings@eend.app, this is what happens to it:
- It arrives through CloudMailin, which passes it straight to us.
- We work out whose it is from the address it was sent from. If no account has that address, we keep it against the address and email that address to say how to claim it. Nobody else can see it.
- Its text is sent to OpenAI to read the flights, stays and other bookings out of it. OpenAI does not use it to train its models.
- We keep the text of the message (up to about 12,000 characters, plus the names of any PDFs attached) and what we read from it, including your booking reference. The text is kept so a booking can be re-read if the first reading was wrong. The reference is kept because it is how we notice the same email forwarded twice, match a cancellation to the booking it cancels, and show you the reference at the airport when you need it.
- It is visible only to you, the owner of the address it came from. It is never shown to other people on a trip, only the bookings you choose to add are.
- Nothing is added to a trip until you confirm it in the app.
- If you would rather we did not hold your booking reference, delete it from the email before you forward it. The flights still come through.
- To have your forwarded emails deleted, email hello@eend.app. Deleting your account deletes them too.
Location
Recording places is off until you turn it on, and it can be turned off again at any time in Settings › Your trips. When it is on:
- What is recorded is where you stopped and roughly how long you stayed, and the route between those stops: while a trip is running, your phone notes where it is every couple of minutes, and that line is saved against the day.
- Nobody watches it live. It is saved in batches to draw each day's map and write the trip's story, not to show where you are right now.
- Your stops are visible only to you. The route of a day is filed against the trip that was running and is shown on that trip to the people on it. It is not included in a public or shopfront link.
- A trip you are travelling on can use your stops to write its story, and may name you ("David walked up to the fort"). You can turn that off for any trip in its travellers sheet.
- A day no trip covers stays on your phone and is not uploaded.
- Background location is used so a day you never opened the app still gets recorded. That is the only reason it is requested.
- Turning it off stops the recording. Ask and everything recorded is deleted.
If you import a Google Timeline export, the file is read on your device. Only the trips you tick are ever sent anywhere; the rest of the file is never uploaded.
The website
If you leave your email address on pondhopping.app, we keep it on a list in Supabase, with the page you left it on and the link that brought you there. We use it only to write to you about Pond Hopping, and never share it. To come off the list, email hello@eend.app and we delete it.
The website counts visits with PostHog: which pages were opened, where visitors came from, and taps on the install buttons and the sign-up form. It keeps an anonymous identifier in your browser so a return visit is not counted twice. It does not record sessions, does not know who you are, and is kept apart from the app's own analytics.
Who else is involved
| Service | What it sees |
|---|---|
| Supabase | Hosts the database and the photo storage. Everything above is held there. |
| Vercel | Hosts the website and the app's server functions. |
| CARTO / OpenStreetMap / Esri | Supply the map images. Drawing a map asks them for the tiles covering the area being shown, which tells them roughly where on a map you are looking. |
| Mapbox | Draws the globe and turns a place name into a point when you search for one. A search sends them what you typed. |
| PostHog | Which screens you opened and what you tapped, and — once you are signed in — your email address and your call sign, so that a tester who reports a bug can be found in the list. Nothing you write, photograph or record goes there: addresses are stripped out of event detail and long text is cut short before anything is sent. It is an analytics service, not an advertising one. |
| Foursquare and Google (Places) | Used to find a place you are looking for and to show a photograph of it: they are sent the name and the town you are searching for. Two things send them a position: writing a story, which sends the spot where you took several photographs to ask you which place it was (see Stories we write); and Explore on the Map, which sends where your latest day on that trip was, to find what is nearby. Neither sends your route or your history of places. |
| Flight data (Cirium, FlightLabs, AirLabs, AeroDataBox) | Sent a flight number and a date to look up a schedule, an aircraft or a delay. They are not told whose flight it is. |
| Wikipedia (Wikimedia Foundation) | Sent the name of a wish or a place to find a picture of it. No account, no identifier. |
| Open-Meteo | Sent a place and a date to fetch the weather for a trip. No account, no identifier. |
| Strava | Only if you connect it, to bring in your own activities. |
| Apple (APNs) | Delivers push notifications on iPhone and iPad, if you have allowed them. |
| OpenAI | Your photographs, places and words, to write your trips up — what is sent, and how to stop it, is under Stories we write. It also sees, each time you use the thing that needs it: the text you type into the planner's chat; bookings you paste in, forward, or bring in from Gmail; the receipts you ask us to read, for their amounts; and reports you send us from the app, to sort them before we read them. When a trip has a stay booked, the stay's address and its weather forecast are sent to write the weather note on the trip. OpenAI does not use what we send it to train its models. |
| Google (Firebase) | Delivers push notifications, if you have allowed them. |
| Google (Gmail) | Only if you connect it. It is used to find booking confirmations, and only those. |
| Google (Calendar) | Only if you connect it, to put your trips in a calendar of the app's own. It is not used to read the rest of your diary. |
| Google (Photos) | Only if you connect it, and only to bring in photographs you have picked yourself. The permission asked for cannot list your library — Google shows you its own picker and tells us about the ones you chose and nothing else. The key that fetches a chosen file lasts about an hour. We also keep a longer-lived key, on our server and never in your browser, so that bringing photographs in a second time does not send you back through Google's consent screen every time. It can only ever reach photographs you pick in a picker; it cannot list or read your library. Disconnecting Google in Settings deletes it, and revoking access at myaccount.google.com/permissions stops it working. |
| TripIt | Only if you paste in your TripIt calendar link. We read your trips, flights and stays from it to offer them to you. The link is kept on our server and never shown in the app. |
| Apple and Google (sign-in) | Only if you sign in with them. They confirm it is you and tell us your email address and, if you let them, your name. |
| Linear | Our issue tracker. A report you send us from the app is filed there, with which account sent it, so we can fix it and tell you when it is fixed. |
| CloudMailin | Your email address, to deliver sign-in codes and invitations. It also receives the booking emails you forward to bookings@eend.app and passes them to us. |
Sharing
Each trip has its own setting for who can see it, and you can change it at any time:
- Just us: you and the people on the trip.
- Your followers: also the Pond Hoppers you have accepted as followers, in the app. A new trip starts here. Nobody follows you until you accept them, unless you turn off "Ask me before anyone follows me".
- Anyone with the link: also anybody who has the trip's link, with no account. It is not listed in the app.
- Anyone with the link, and published: the same, and the trip is listed on your profile.
While you are on a trip your followers can see, they see on your profile which day of it you are on, the places it has reached so far, and your next flight on it.
Your stops, private notes and costs are left out of what others see unless you include them. The route of a day is shown to the people on that trip, and never in a link. A Share everything link opens your trips to whoever holds it until you turn it off in People › Links. A trip's own link stops working when you set the trip back to Just us or Your followers.
Keeping and deleting
Your data is kept until you delete it. You can delete individual trips, entries and photos in the app, and switch off place recording at any time.
To delete your account and everything in it, see how to delete your Eend Account. That includes the archives of earlier versions described above. There is no retention period afterwards and no archived copy; routine hosting backups are cycled out within 30 days.
Children
Pond Hopping is not intended for use by children under 13.
Changes
If this changes in a way that affects what is collected or who sees it, the date at the top of this page changes and we will say so in the app.