Shangralachia
Privacy in a small room
Shangralachia is a private clubhouse. It holds real names and real travel plans, which means the honest version of this policy is longer than “we collect nothing.”
Last reviewed
The short version
No analytics. No tracking cookies. No advertising. Nothing sold, anywhere, to anyone. Accounts exist because access is invite-only — not so anyone can be profiled.
What the site does hold is the trip material members put into it, and some of that is genuinely sensitive. That's the part worth reading below.
Our standard
Contextual integrity
Information belongs to the setting it was shared in. A travel detail given to the group so someone can be met on arrival is for that. It isn't material for anything else, and it doesn't travel outside the group.
Privacy by design
The cheapest data to protect is the data that was never collected. Where a feature can work without storing something, it does.
What your account stores
Signing in creates one row about you. It holds:
- your email address, which is how invites and sign-in links reach you
- a display name and short bio, both of which you write and can change
- a role — member or admin — which only an admin can set, and which decides what you can open
- the date the account was created
There is no password in that row. Passwords are handled by Supabase Auth and are never visible to this site or to anyone running it.
Trip briefings
Trip briefings hold travel and booking details for the members going on a trip. It's the most sensitive material on the site, and it's the reason the members area is invite-only rather than merely unlisted.
Briefings, and every file attached to them, are served only to signed-in members. What that can't protect against is a member forwarding one onward. Treat another member's itinerary the way you'd want yours treated.
Cookies and browser storage
One kind of cookie, set for one reason: to keep you signed in. Those session cookies are HttpOnly and Secure, so they can't be read by scripts in the page and don't travel over plain HTTP.
There are no analytics cookies, no advertising identifiers and no third-party trackers. There's no consent banner because there is nothing here to consent to — the only cookie present is the one that makes signing in work at all.
Who else processes your data
Supabase, and a shared backend
Accounts and sign-in run on Supabase, in a project shared with earthsong.io, a separate site under the same maintainer. Your account details therefore live alongside another project's rather than on separate infrastructure, which is worth knowing even though access is restricted.
Vercel
The site is hosted by Vercel, which has to process a request when your browser asks for a page. That request can include your IP address and browser and device information. Handling and retention of that are governed by Vercel's own privacy policy, and requests about it should go to Vercel.
Supabase sends the transactional mail this site needs: invitations, magic sign-in links and password recovery. There is no newsletter and no marketing email.
Embedded tools
The Tools and Adventures pages embed applications hosted elsewhere. When you use one, you're using that service, and it sees what you do inside it under its own terms. Shangralachia doesn't receive anything back from them and can't vouch for their privacy practices.
Choices and rights
You can see everything stored about you: it's your profile plus whatever appears in trip material. Display name and bio are yours to edit directly. For anything else — a correction, a copy of your data, or deleting your account and its row — ask a TAG admin.
Deleting your account removes your profile and sign-in credentials. It doesn't retroactively strip your name from a briefing for a trip you went on, since that's the group's shared record — but say so and it can be edited.
Children
Shangralachia is a private site for an adult group and doesn't knowingly hold personal information from children.
Changes
Meaningful changes will be dated on this page. They won't be applied retroactively to data already collected under an earlier version.
Maintenance
This policy is maintained alongside the site itself, and is reviewed when a feature changes what the site collects. Questions go to any TAG admin.