Privacy Policy

Effective / last updated: October 26, 2026

This Privacy Policy explains how Alex Journeys, operated by Fernandes Transports LLC (a New Jersey limited liability company using the registered alternate business name Alex Journeys), collects and uses information when you browse travel content, use planning tools, create an account, book through travel partners, join Premium, or contact the site.

Questions or requests: contact@alexjourneys.com · Site: https://www.alexjourneys.com.

Who we are

Alex Journeys combines travel stories, destination guides, planning tools, and access to travel partner booking services. Travel partners process booking payments; Alex Journeys processes Premium membership and store payments through Stripe. See Free travel account and booking for how booking information is used.

Business operator and controller for Alex Journeys site data: Fernandes Transports LLC, doing business as Alex Journeys · New Jersey, United States. Alex Fernandes is the founder and publisher. Email: contact@alexjourneys.com. Travel partners may act as independent controllers of information they collect to process their bookings.

Public browsing (no account needed)

You can read stories, browse destinations, and use most of the site without creating an account or signing in. Public browsing does not require Google Sign-In, X, or an email/password account.

Depending on how you use the site, we may still process:

• Anonymous or aggregated analytics (when enabled) — visit timing, approximate region, pages viewed — to see what is useful. We do not sell individual browsing profiles.
• Language and currency choices — saved on this device in local storage and a preference cookie so your selections carry between pages.
• Affiliate / advertising cookies — when you click outbound partner links (for example from /tools) or view ads, partners may set their own cookies. See the Affiliate disclosure.
• Newsletter email — if you subscribe, we collect the email you submit (and any optional form fields) to send travel dispatches.
• Contact form messages — if you write via the contact form, we receive what you send so we can reply.

We do not sell personal information. We do not use Google Sign-In, X sign-in, or account data for advertising.

Reader accounts

Optional reader accounts let you save posts to a personal list on /account. You can create or sign in with:

• Google Sign-In (OpenID Connect scopes openid, email, profile) — we typically receive your email, display name, profile picture URL, and a stable Google account id for the session. We do not request Drive, Gmail, Contacts, Calendar, or other sensitive scopes.
• X sign-in — we receive your X display name, a profile picture URL when X provides one, and a stable X user id. X’s sign-in does not usually share an email address. We do not post to X or read your timeline for the journal.
• Email and password — passwords are stored only as bcrypt hashes in Firestore. We never store plaintext passwords.

Account profile data may include your display name and profile photo (from Google, X, or a photo you set). Saved posts are stored in Firestore and tied to your user id so you can view or remove them later.

Change email

You can request an email change from Account settings. We send a verification link to the new address (via Resend), and a notice to the old address. The email on your account updates only after you confirm the new address.

Password reset

Forgot-password and reset flows send transactional email through Resend. Reset links expire; choosing a new password updates the hashed password in Firestore.

Cloudflare Turnstile (forms)

Spam-prone forms — including newsletter, contact, signup / register, and forgot-password — may show a Cloudflare Turnstile challenge. When configured, we verify the Turnstile token with Cloudflare before accepting the submission. Turnstile helps reduce bots; it is not used to build advertising profiles for us.

Email & newsletter providers

• Resend — transactional email (password reset, email-change verification and notices) and, if you use a forward address, inbound booking confirmations you send there.
• Mailchimp — newsletter subscriptions when Mailchimp API credentials are configured on the server. Your email (and any merge fields on the form) are sent to Mailchimp so we can send The Traveler's Journal dispatches. Unsubscribe via the link in each email or contact us.

Cookies & sessions

• Essential / session cookies — Auth.js session cookies (authjs.session-token / __Secure-authjs.session-token) when you sign in. Optional CMS passcode cookies for admin unlock of /cms. Theme preference may live in localStorage (not a cookie).
• Analytics — anonymous or aggregated usage when analytics are enabled.
• Advertising / affiliate — partners may set cookies when ads or outbound affiliate links are present.

You can block non-essential cookies in your browser. Blocking essential session cookies will prevent Sign-In and CMS unlock from working.

CMS admin / allowlist

The private content management system at /cms is only for the site owner and any emails listed in a server allowlist. Admins may sign in with Google (or GitHub where configured). A reader session alone never unlocks the CMS, and signing in with X never does either. Misuse of admin tools is prohibited.

Google Sign-In / OAuth app

The Google Cloud OAuth application named Alex Journeys powers Google Sign-In. Home page: https://www.alexjourneys.com. This privacy policy: https://www.alexjourneys.com/privacy. App purpose: /app.

Google Sign-In is used for optional reader accounts, saved travel, member booking access, and allowlisted CMS access. It is not used as a social network.

Revoke Google access anytime at Google Account → Third-party access, then sign out here. To delete account-associated data we control, email contact@alexjourneys.com.

Third parties we rely on

We use trusted processors to run the journal:

• Vercel — hosting and edge delivery
• Cloudflare — Turnstile bot protection on forms
• Google — Google Sign-In / OAuth, Google Analytics 4 when configured, and optionally AdSense if ads are shown
• X — optional reader sign-in (display name, profile picture URL, and user id). We do not post to X or read your timeline.
• GitHub — source repository; CMS publish commits; GitHub OAuth may be available for allowlisted admins
• Firebase / Google Cloud Firestore — reader profiles, hashed passwords, saved posts, saved trips, and forwarded-booking suggestions
• Resend — transactional email
• Stripe — processes Premium membership and digital-store payments for Alex Journeys and supplies secure card-entry technology for Nuitée hotel payments under Nuitée's separate payment integration. The relevant Stripe payment configuration depends on what you buy. Alex Journeys does not receive or store your full card number. See Stripe's privacy policy.
• Nuitée (LiteAPI) — hotel search, availability, prebooking, payments, reservation confirmations and related support. When you attempt a hotel booking, Nuitée receives the necessary traveler, contact and selected room details and uses its payment integration (including Stripe payment fields) to handle payment authentication. Selected hotels receive the details needed to fulfill confirmed reservations. Hotel payments and bookings are subject to live-service availability; a prebooking is not a completed reservation.
• Viator — experiences and tours. When you click out to book, you go to Viator's site, which may set its own cookies and handles the booking and payment under its own terms. Alex Journeys uses Viator's product data to show tours here.
• Upstash — a fast data store used for rate limiting (which briefly keeps IP addresses or hashed email addresses to block abuse), caching translations, and holding search results for a short time.
• Open-Meteo — weather forecasts for your trip. The Alex Journeys server sends the destination name or coordinates, not your account details.
• HeiGIT (openrouteservice) — place search, routes, and travel times on trip maps. The Alex Journeys server sends the place names or coordinates on your map, not your account details.
• Google Gemini — used only in private CMS admin tools to help draft destination facts. No visitor or account data is sent to it.
• Mailchimp — newsletter (when configured)
• Unsplash — if you open a trip with a destination photo, we search Unsplash using the destination name and load the photo directly from Unsplash. Your browser may send its IP address and basic request information to Unsplash when the image loads. We do not send your account details. See Unsplash’s privacy policy.
• Google Cloud Translation — translates public, published travel stories when a reader chooses a supported language. We send article text, not account details, bookings, private itineraries, or payment information. Translated stories are cached to reduce repeated processing.
• Affiliate partners — may set cookies when you follow outbound booking or product links

Each provider processes data under its own privacy policy. We only share what is needed to operate the features above.

Children

Alex Journeys is a travel journal for a general audience. It is not directed at children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided data, contact us and we will delete it.

Forwarded booking emails

If you sign in and copy a forward address from an itinerary, you can send hotel, tour, or car confirmation emails to that address. Resend Inbound receives them. We read the message only to suggest itinerary items. Nothing is added until you choose Add to itinerary. Dismiss removes the suggestion. You can turn the address off or replace it; the old address stops accepting mail.

We store those suggested fields and the inbound message id in Firestore under your account or that trip. We do not keep the full raw email HTML, and we do not scan your Gmail mailbox.

Free travel account and booking

A free Alex Journeys account lets you save hotels, tours, trip notes, packing lists, and itineraries. Saved travel data is stored in Firestore under your account so you can return on another device. An unsigned-in planning session is temporary; older browser-only drafts may be offered for one-time import into your account. Newsletter signup and paid Premium are separate choices.

When you start a booking, the travel partner receives the traveler and booking details needed to fulfill it. Hotel reservations made through the site are handled by Nuitée (LiteAPI), which uses its payment integration, including Stripe, to process hotel charges; the hotel provides the stay. Live hotel checkout may be limited to authorized testers until launched more widely. You may add travel plans and confirmations from providers used elsewhere to your trip, without purchasing them through Alex Journeys. Experiences are booked and paid for on Viator's site under the Alex Journeys affiliate arrangement. Each partner's terms and privacy notices apply to the booking and payment it processes. Alex Journeys does not receive your full card details. Booking details are stored in your account so you can find and manage your reservations. When you contact Alex Journeys for booking support, those details are used to review your request and, when necessary, shared with Nuitée and the relevant hotel to help resolve it. Viator supports experience bookings.

We use limited analytics events for the member journey, such as when a booking gate is opened or a hotel booking completes. These events contain a product or destination category, not payment card details, passport numbers, names, or email addresses.

Retention

• Sessions — until you sign out or the Auth.js session expires.
• Saved posts & profile — until you remove them or request deletion.
• Newsletter — until you unsubscribe or we remove the list record.
• Contact messages and support requests — as long as needed to reply and keep a reasonable record of correspondence. For store support this includes the product and order reference you give.
• Store purchases — what you bought, the amount, date and order reference are kept with your account so you can download again and so we can help with support and keep tax and accounting records.
• Hotel booking attempts and confirmed reservations — we keep essential supplier references, booking status, traveler and contact details, payment-attempt state (but not complete card details), and support correspondence as needed to manage bookings, reconcile uncertain payments, investigate disputes and meet applicable legal or accounting obligations. We restrict access and delete or de-identify records when they are no longer required.
• Email-change / password-reset tokens — short-lived; expire after use or timeout.
• Forwarded booking suggestions — parsed fields (title, type guess, confirmation, dates, link) and the inbound message id, until you add or dismiss them or turn the address off. The full email HTML is not stored. We do not scan a Gmail mailbox.

Your rights (GDPR / CCPA) & no sell

We do not sell personal information. If you are in the EU, UK, California, or another place with similar laws, you may have rights to access, correct, delete, or receive a copy of personal data we hold about you, and to object to certain processing. Contact contact@alexjourneys.com. We will respond within a reasonable time consistent with applicable law.

International processing

The business operates from New Jersey, United States, and the site is hosted on infrastructure that may process data in the United States and other countries (for example Vercel, Google/Firebase, Cloudflare, Resend, Mailchimp). If you visit from another country, your information may be transferred to and processed in those locations. Where required, we rely on appropriate safeguards offered by those providers.

Contact

Fernandes Transports LLC, doing business as Alex Journeys · New Jersey, United States.
Founder and publisher: Alex Fernandes
Email: contact@alexjourneys.com
Web: https://www.alexjourneys.com

Related: Terms of Use · Affiliate disclosure · Policies hub · About Google Sign-In.