Your privacy, while you plan.
PandaWander sends your trip messages to Cloudflare Workers AI when the assistant is available. Chat history stays in page memory; the application does not store message text on the server. Daily usage limits use a rotating IP hash. Analytics is optional and requires consent, and no account is needed to plan.
Updated · Author: PandaWander Editorial Team
Trip messages and Cloudflare Workers AI
When you submit a message, the application sends your current conversation to its Worker and Cloudflare Workers AI to arrange a route from our city collection. Do not include passport information, card details or other sensitive personal information. Chat history and the displayed route stay in page memory and clear when you reload or choose Start a new plan. Application logs do not record your message text or model output, and there is no server-side chat history or user profile. Cloudflare processes requests as our hosting and AI provider under its own service terms; our application cannot describe provider-level processing as local-only.
Usage limits and retention
To limit AI use, the Worker turns your network IP into a keyed hash that changes each UTC day. D1 stores the hash, request counters, a UTC day or minute bucket, and expiry; no raw IP or message text is stored. The limits are five requests per UTC minute and thirty per UTC day. Minute records expire at the end of their minute; daily records expire at the next UTC midnight. Expired rows are removed on planner requests and by hourly cleanup, normally within one further hour while the Worker is running. Interrupted cleanup can delay physical removal. The optional platform limiter uses the same daily hash.
Booking-click records
The redirect Worker and click endpoint can record a timestamp, an enumerated partner, page identifier, placement and a country code supplied by the hosting platform. Click records contain no IP address or full user agent. The separate planner-usage tables store only the daily hash described above. The same interaction can produce a beacon record and a redirect record, so these are raw events rather than a count of unique people. Cloudflare may process request data under its own service terms; application-level limits do not describe every hosting log. Booking-click records expire after the configured retention period and are removed by hourly cleanup or subsequent click requests; interrupted cleanup can delay removal.
Optional analytics and consent
Google Analytics is completely omitted from preview builds. In a production build with an analytics ID, the footer asks before loading the analytics script. Analytics storage starts denied. Advertising storage, advertising user data and advertising personalisation remain denied. You can revisit analytics preferences in the footer and decline future collection. Declining also attempts to remove accessible first-party Google Analytics cookies. Browser restrictions may limit which cookies the page can remove.
External services and privacy requests
Opening a booking link takes you to another provider, whose privacy terms apply there. Any optional Stay22 map loads only after a click; no map is currently shown. Contact the editorial team to ask about application records or request deletion. Avoid sensitive attachments. The team may need limited information to identify a record, and cannot identify past daily hashes without the relevant request context. Mandatory privacy and consumer rights remain applicable. Cloudflare’s own processing is governed by its service terms.
Travelpayouts Drive on articles
Guide indexes and articles and itinerary lists and articles load Travelpayouts Drive automatically, in both preview and production. The script is supplied through emrld.ltd and may read the page URL and content, adapt booking links, and set or access cookies for attribution or related services. Its providers may receive browser and network information. This is separate from optional Google Analytics consent. Home and the planner, About, legal pages and error pages do not load Drive under the normal configuration. A temporary sitewide connection-check setting can extend it to those pages. Do not enter personal details into the planner. See Travelpayouts’ privacy policy for provider processing and cookie information.
About this edition
| Item | Current state |
|---|---|
| Release status | Editorial edition · 2026-10-25 |
| Author & legal operator | PandaWander Editorial Team · PandaWander (operated by an individual publisher) |
| First-hand travel testing | Not claimed · Our method |
Privacy contact: hello@pandawander.com. Operator: PandaWander (operated by an individual publisher).
Provider details: Travelpayouts privacy policy and cookie policy.
A few things you might be wondering
Are my trip messages sent to an AI service?
Yes, when the assistant is available, your current conversation is sent to Cloudflare Workers AI. The application does not store message text on the server. Avoid including personal or sensitive information.
What is stored for usage limits?
A keyed IP hash that rotates daily, UTC day and minute buckets, request counts and expiry. Expired rows are removed on planner requests or by hourly cleanup; interrupted cleanup can delay physical removal. No message text is stored.
Is Google Analytics running in the preview?
No. Preview builds omit the analytics component even if an analytics ID is supplied. Future production analytics requires an explicit opt-in through the footer.
Does a guide load third-party booking scripts?
Yes. Guide and itinerary pages load Travelpayouts Drive automatically, separately from Google Analytics consent. It may read page content, change booking links and set or access cookies. Home, legal and error pages exclude it by default; a temporary sitewide connection check can change that scope.