Last updated August 11, 2026

Privacy at Within

Within uses the minimum information needed to find time-aware recommendations and protect the service from excessive API usage.

Location and searches

Your selected location, activity, travel mode, and time budget are sent to Within’s server and Google Maps Platform to produce a result. Within does not save a guest’s precise location or search history in its database. For accommodation partnerships, Within stores the public business name and coordinates needed to keep that property’s QR link working. Infrastructure providers may process temporary network and request logs to operate and secure the service.

Accommodation QR campaigns

Property QR links contain a campaign code. Within counts aggregate link opens and successfully generated plans for each campaign so a participating accommodation can understand whether the flyer is useful. These campaign counters do not contain guest emails, precise guest locations, or individual browsing histories.

Guest usage limits

Guests receive a random, signed, HttpOnly device cookie. It does not contain your location, name, email address, or IP address. The cookie lasts up to one year and keeps your allowance separate from other people on a shared network. Clearing browser or app data removes it.

Google sign-in

Google sign-in is provided by Firebase Authentication. Within receives your Firebase user ID and may display the basic profile name or image supplied by Google. The server uses the immutable user ID—not your email address—to apply the signed-in allowance. Within never receives your Google password.

Usage and retention

Usage records contain a pseudonymous identifier, account tier, calendar month, search count, burst-control timestamps, and expiry time. They contain no precise location. Counter records expire automatically after approximately 400 days. Identity-free operational events such as completed searches, cache hits, and limit denials may be logged to diagnose reliability and abuse.

Sharing and sale

Within does not sell personal information. Data is processed by service providers needed to operate the app, currently including Google Firebase, Google Maps Platform, and Vercel, subject to their respective terms and privacy practices.

Your choices

You can use two guest searches without signing in, sign out at any time, clear the guest cookie by clearing app or browser data, or request deletion of your Firebase account and associated Within data by emailing frantommor@gmail.com.

Children and changes

Within is not directed to children under 13. This notice may change as the product grows; the date above will be updated when it does.