Privacy and analytics
Holiday Spend stores product usage analytics on its own server. Collection is enabled by default and can be disabled in Settings or on the sign-in page.
What we collect
We record page visits, identified controls, confirmed changes, timestamps, approximate device category and pseudonymous account or session identifiers. Operational records include request status, performance, error categories and LLM provider, model, timing, token usage and retry information.
API keys, passwords, authentication tokens, raw LLM prompts and responses, uploaded files, search text and expense descriptions are excluded from analytics. We do not record your screen or use IP addresses to identify you in the analytics dashboard. Analytics records are stored under a pseudonymous account identifier; administrators viewing the dashboard see the email address of the account the activity belongs to.
Private plan history
The app retains revisions of saved and active plans, including itinerary details, notes, costs and the prices used to calculate historical budgets. This history and necessary operational diagnostics continue when behavioral tracking is disabled.
Access and retention
Analytics and private plan history are available only to configured administrators. Records stay on our infrastructure with no scheduled expiry. Disabling collection stops future behavioral events; it does not erase earlier records. Administrators have tools to erase account analytics and history, including when handling a deletion request.
LLM requests still go to the provider selected by the user; self-hosting analytics does not change that processing. Private backups may retain deleted information until those backups are removed; restored backups must have deletion requests reapplied.
Manage analytics in Settings