Effective September 24, 2026. This policy explains how Disco Media handles information for Detour.
Information you provide
Detour receives your name and email address when you create or manage an account. It stores the maps and locations you choose to save, including titles, coordinates, categories, notes, descriptions, addresses, saved hours, source URLs, and Google Maps place links.
If you contact support, we receive the name, email address, and message you submit. The contact form sends that message to support@discomedia.co through DiscoMail. Detour does not store contact-form submissions in its product database.
Authentication and operations
Detour processes password credentials, sessions, OAuth grants, authorization codes, refresh tokens, account lifecycle requests, audit records, request metadata, abuse-prevention data, and operational logs as needed to provide and protect the service. Passwords are stored by the authentication system in hashed form; Detour does not send or store your password in email.
Destination data and map previews
Coordinates and addresses submitted through the plugin describe destinations you explicitly choose to save or a map viewport. They are not a request for your current GPS location, home address, or workplace. Detour does not receive your full conversation history. Only the map data you or your connected assistant intentionally submit is stored.
To render a map preview, our server sends a computed map center, zoom, image size and style to LocationIQ using our service credential. A center calculated from a single saved place can identify that destination. We do not send LocationIQ your account identity, map title, notes, or a list of markers; we draw the pins and title ourselves. Preview generation can occur when you read a map or change its contents.
Signed-out example
The iPhone app includes a fixed example map that you can browse without a Detour account. Its places are bundled with the app, kept only in memory while you browse, and are not saved to your account or sent to our backend. The Research in ChatGPT link opens a separate service; ChatGPT handles that conversation under its own terms and privacy policy.
Device location
The iPhone companion may use your device location, with your permission, to center the map on your current area. That location is used on the device and is not uploaded to Detour or tracked by Detour.
Service providers
Detour uses Railway to run the backend, Neon to store product data, DiscoMail to deliver account and support email, Cloudflare to serve and protect the website, and LocationIQ to supply preview basemaps. Our support mailbox provider receives messages sent to support. Your connected assistant provider receives the tool results needed to carry out your request; its own privacy policy governs its conversation records. These providers process information only as needed for the services they provide to Disco Media.
Retention and deletion
- Account and saved maps: we keep these until you permanently delete them or your account. Archiving a map does not delete it. Confirmed account deletion removes your identity and owned product data from the active database in the deletion transaction.
- Mutation audit and retry records: these remain for the account lifetime, including after a particular map is deleted. Retry records can contain earlier tool-result snapshots. They are removed with account deletion; there is no separate automatic age-based purge.
- Sign-in and account records: sign-in links work for 15 minutes, OAuth continuations for 20 minutes, and reset, email-change and deletion links for one hour. Access tokens last one hour; browser sessions and refresh tokens last up to 90 days and may renew with use. These are validity periods, not promises that database rows are erased when a token expires. Account-associated records are removed on account deletion; unlinked expired continuation records currently have no scheduled purge.
- Preview cache: rendered images are eligible for reuse for up to 48 hours in a bounded server-memory cache. Entries can remain in memory until replacement, eviction or process restart. They are not saved to the product database. Every preview request checks current map ownership before accessing this cache.
- Database recovery: our production database is configured with a six-hour point-in-time recovery window. Deleted data can remain in that recovery history during the window. This describes our configured recoverable history, not a guarantee about a provider's underlying storage erasure.
- Operational logs: hosting providers retain operational and security records under their own retention schedules. Railway documents log-access windows of 3–90 days depending on plan and may make older logs available after a plan upgrade; these windows are not guaranteed erasure deadlines. See Railway's log retention. Detour does not operate a separate application log archive.
- Support and email: support correspondence and delivery records have no automatic expiration in Detour's current support process. You can request their deletion through support. Records required for a specific legal obligation or an unresolved security incident are retained until that obligation or investigation ends.
Removing a plugin connection does not delete your Detour account or copies already held in your assistant's conversation history. Use account deletion for Detour data and the assistant provider's controls for conversation copies.
Your choices
You can update your account information, sign out, request a password reset, change your email, or permanently delete your account using the iPhone app's Delete account link or the hosted account settings. You can also contact us with privacy questions at support@discomedia.co.
Changes
We may update this policy when Detour’s data practices change. The effective date above identifies the current version.