Privacy Policy

1. Scope

This policy covers all of VietRoute - the Journey tool, its sharing feature, and user accounts. By creating an account or opening a shared link, you agree to how data is collected and used as described below.

No account is needed to view a shared journey or browse public content - this policy only applies once you actually provide personal data (registering, signing in, paying).

2. What we collect

Account info: email, display name, and either a password (never stored in plain text - only a PBKDF2-HMAC-SHA256 hash, 210,000 iterations, per-account salt) or a Google account identifier if you sign in with Google.

Journey data: the routes you draw and save (stops, vehicle, journey name), tied to your account so you can reopen and edit them later.

Payment data: when you upgrade to a paid plan, we store an order code, its status, and when it was paid, for reconciliation. We never store card numbers, bank account numbers, or any sensitive payment credentials - that is handled directly by our payment partner, SePay.

Usage data: when Google Tag Manager is enabled, some on-page actions (e.g. clicking Share, clicking Export video) are logged anonymously so we understand which features get used. These events do not carry your email or name.

3. Why we need it

• Running your account: signing in, restoring your session, showing you your own journeys.
• Saving and syncing the journeys you create, so you can reopen them from any device.
• Processing and confirming payment when you upgrade to a paid plan.
• Sending a payment confirmation email (via Resend) - never used for marketing unless you separately opt in.
• Understanding which features get used, based on anonymised usage numbers, to improve the product.

4. Sharing with third parties

We do not sell your personal data. Data is only shared with the processors needed to run the service:

• Google - if you choose to sign in with Google (identity verification) and/or if Google Tag Manager/Analytics is enabled (anonymised usage metrics).
• SePay - processes payment when you upgrade to Pro. SePay has its own privacy policy for the payment data it collects directly.
• Resend - sends the payment confirmation email on our behalf.
• OpenFreeMap/OpenStreetMap - used only to render the map background in your browser; these services never receive your account data.

5. Cookies & tracking

VietRoute uses a session cookie (required, so you don't have to sign in again on every page load) and, when enabled, Google Tag Manager for anonymised product-usage measurement. You can block tracking cookies via your browser settings without affecting sign-in.

6. Retention

Account and journey data is kept until you ask us to delete it. Sign-in sessions (JWT) expire automatically after 7 days and never carry your plan entitlement - your plan is always re-checked from our system on each use, never trusted from an old token.

7. Your rights

Under Vietnam's Decree 13/2023/NĐ-CP on personal data protection, you have the right to access, correct, or delete your personal data, and to withdraw consent you've given. Contact us at the address below to exercise these rights.

8. Children

VietRoute is not directed at, and does not knowingly collect data from, children under 16.

9. Changes to this policy

We may update this policy as the product changes. The most recent update date always appears at the top of this page.