Privacy Policy

Your trip. Your people. Your privacy.

Last updated October 14, 2026 · We Are So · weare.so

We Are So is operated by Brandon Klein as an individual. It is an invitation-only pilot for families, with a public signup request and fictional preview. For support, privacy questions or a data removal request, email brandon.klein@gmail.com or visit Support.

The public preview

The preview uses fictional people and plans. Demo replies, ideas, and selected photos remain in the page on your device and reset when you reload. The preview does not connect to Gmail, send messages, or upload the photo you select. Public pages load fonts from Google Fonts and media from our Cloudflare hosting.

The private family app

Private trip records require family membership and either Cloudflare Access sign-in or a verified, linked phone session. Parents choose visibility per item; passport-vault entries have separate owner-only protection. Your family can share saved ideas, day plans, comments, and reviewed travel details. Organizers manage connections and approvals. The app distinguishes a proposed plan from a confirmed booking; it does not purchase travel on your behalf.

Optional Gmail connection

Gmail is an optional organizer connection. Google’s read-only Gmail permission permits access across the authorized mailbox; it is not limited by Google to travel mail. The app first examines message metadata such as sender and subject to identify likely travel confirmations, then requests the body of those matching messages. The filter can make mistakes. This permission does not allow the app to send, delete, or change your email.

Connection tokens are stored encrypted. The app processes full message bodies and uploaded confirmation files without saving them in its import storage. Reduced extracted fields normally remain in the private inbox for 30 days and in a scoped parse cache for 7 days. An active review can keep its import until the review is resolved. Minimal message IDs can remain for 180 days to prevent repeat imports; pending processing and retry jobs remain until resolved or disconnected. Imported confirmations remain private to the connected account’s owner until reviewed and shared with the family trip. Extracted travel details may include passenger names, dates, locations, reservation references, and prices. Review them before saving. Email contents are treated as evidence to extract, not instructions to execute. Unrelated email bodies are not intentionally requested.

Google user data is used to provide the travel features you choose, not for advertising or sale. We do not use Google user data to train general-purpose AI models. We Are So’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements.

Optional Gmail draft preparation

Gmail imports remain read-only. A parent may separately connect optional Gmail draft preparation. Google’s compose permission can manage drafts and send email at the provider level; We Are So implements draft creation for your review and has no email-send action. The optional connection uses a separate encrypted, short-lived access token without a stored refresh token. You may need to connect it again after about an hour. Removing draft access from We Are So deletes that local credential; revoking We Are So in Google can also remove your other Google connections.

After your explicit review, this feature creates a draft in your connected Gmail account, addressed only to the authenticated requesting sender and linked to the original conversation. It can include only the vault copies or fields you selected. Google stores the resulting draft and attachments until you remove or send them there. Preparing a draft does not send it, book anything or submit a supplier form. Minimal delivery receipts help prevent duplicate drafts; they do not contain passport values, file contents or the prepared message.

Optional travel conversations and memory

Organizers may separately enable travel-conversation discovery. On regular Gmail checks, the app first checks a bounded set of recent sender, subject and date metadata for active-trip terms or providers already saved with a trip. Only qualifying messages are requested for transient processing of a bounded latest reply. The app skips attachments and trims quoted history and signatures. Sensitive-data filters remove recognized identity, health, credential and payment-account information before extraction; filters can miss information or reject useful text. When rules leave ambiguity, a bounded amount of sanitized travel text may be processed by Cloudflare Workers AI for source-checked classification. The app keeps minimal structured travel facts, source identifiers, a reduced subject and a Gmail link privately for up to 30 days, without retaining the full reply body. Turning discovery off deletes those private matches. Discovery does not send email, make bookings or automatically change the shared plan or Calendar. Requests and offers remain distinct from source-reported confirmations, and you should review the original reply before acting. Browser research and communication signals are tentative interests, not automatic family-wide preferences.

In the trip menu under Preferences & decisions, each member can save, edit and forget travel preferences. Personal and trip-specific memories are private to their author. Parents may explicitly share a family memory. Saved memories remain until forgotten; private Ask conversations may still contain earlier wording, so ask support to remove related conversation history if needed. Memory is not used to train general-purpose models.

Personalized next steps

The Trip feed shows a small set of sourced actions based on the details you are allowed to see. Parent and family-member permissions apply before selecting or displaying cards. Cloudflare Workers AI may rank eligible actions using fixed-vocabulary travel and preference tags, role and trip-phase categories, and opaque item identifiers. This ranking does not receive email bodies, passport details or the raw text of your saved memories, and cannot invent facts or actions. Source facts are displayed separately from ranking. Short-lived ranking caches are scoped to the member and current source versions; changed permissions are checked again before results are returned. Opening or ranking a card does not send messages or change a booking.

Optional browser research

The experimental Chrome extension requires installation, pairing and permission for supported sites. It recognizes travel searches and visited travel pages on those sites, then records a reduced title, sanitized URL, search query and time. It does not read your entire browsing history, incognito tabs, email bodies, WhatsApp chats, form fields or payment details. Filters can make mistakes; you can pause capture and remove receipts. Captures wait locally for up to 7 days and sync through your signed-in family app tab. Synced research is private to you and expires after 30 days. Revoking a paired browser also removes its saved research. Safari packaging and store distribution are not available yet.

Optional Google Calendar connection

Each member can connect their own Google account and choose an owned calendar, including their primary calendar. Calendar list permission displays calendars you can select. Calendar events owned permission permits event management across calendars you own, while this app limits its writes to its mapped trip events in the calendar you explicitly enable after previewing the changes. Confirmed or paid records with sufficient date and time information can sync automatically. The app checks for conflicting Google edits, preserves personal descriptions and reminders, and sends no invitations. You can link a matching existing calendar entry after reviewing it. Manual entries receive time updates while their titles, notes and reminders are preserved. Google does not allow us to change the times of Gmail-created events. When you choose “Just fix it for me,” the app can remove an exact Gmail-created flight duplicate of a current, linked event after checking its flight number, route and times. Uncertain matches, unrelated entries and events with other guests are preserved for review. We retain a minimal repair receipt to avoid repeating an action and show its outcome. Removed events can be recovered through Google Calendar Trash while Google makes recovery available.

Refresh credentials are stored encrypted. Disconnecting Calendar removes the stored connection and stops sync; events already created in Google remain. Because Google permissions share an OAuth client, revoking the app in Google may also disconnect Gmail or Photos. Reconnecting does not silently resume event writes: review and enable the target again.

Ask and processing

The private app runs on Cloudflare Workers and stores trip records in Cloudflare D1. Ask may send your message and relevant saved trip context to Cloudflare Workers AI to understand a request, answer a question, or draft a change. When travel parsing rules leave missing fields, selected confirmation text may also be sent to Cloudflare Workers AI to suggest those fields. The app limits the source text and daily calls, checks suggestions against the source, and leaves the final decision to you. Uploaded confirmation PDFs may use Cloudflare text extraction. Messages and action receipts can be retained with your private account so you can return to a conversation and review what changed. Proposed changes to bookings and plans require the appropriate organizer review.

Photos you choose

Family members can share device photos or select images through Google Photos Picker. The app requests access to selected media, never a background library scan. Selection access is encrypted and usable for at most 20 minutes. The app removes it after sharing or ending the selection, and routinely removes expired sessions. No Photos refresh token is stored. Sharing creates a smaller private copy, up to 1600 pixels and 2 MB, with embedded location metadata removed. Originals remain in your phone or Google Photos. Shared copies stay until you remove them.

Instagram integration is marked Coming soon and is not connected. Personal Instagram accounts do not have an import connection here. You can upload your own original image and attach its Instagram post link. Private photos are not copied to the public preview.

Other connections

SMS and live flight status require separate provider setup and eligibility. They are not connected in the public preview. If enabled in the private app, Twilio processes the phone number and message needed for SMS after a separate opt-in and phone-link step. Consent records and opt-out suppression are retained to honor your choice. We Are So (weare.so) does not sell or share your SMS opt-in data or personal information with third parties for marketing purposes. See SMS terms. For flight status, a flight status provider receives the flight lookup details. These connections do not grant access to your airline account or authorize buying or changing a ticket.

Disconnecting and correcting details

You can disconnect Gmail from the private app’s connection settings and revoke its permission from your Google Account. Disconnecting stops future imports and removes stored credentials, private Gmail imports, and their parse cache. It does not erase details already saved in a shared trip. You can also delete a single private import without changing shared bookings. Deleted database data can remain in Cloudflare’s automatic recovery history for up to 30 days; removal from the live app is not immediate erasure of provider backups. Encryption and private sign-in reduce exposure but cannot guarantee that a compromised running service could never access authorized data. Your family organizer can help correct or remove shared trip records. For an account or data removal request, email brandon.klein@gmail.com. Identify the account and the data you want removed, without sending passwords, verification codes, payment card details or full travel documents. We may need to verify account ownership before changing or deleting data. Read the support and removal instructions.

Back to the preview · Support · Family login

Passport vault

A parent can store passport details and an optional image or PDF in a separate private vault. Entries are visible only to the parent who added them, with a recent verified Cloudflare Access session. Phone sign-in does not unlock the vault. Passport fields and file contents are encrypted before storage with a separate key; the original filename is discarded. They are excluded from trip records, ordinary AI context, SMS and Calendar. A private document-request workflow can detect requests in qualifying travel email, show the original sender and conversation, and prepare only the copies or fields you explicitly select. A recent verified parent sign-in and a fresh review are required. The workflow can download a reply file or selected-field packet, or create a Gmail draft after the separate optional permission. It does not send supplier messages or submit provider forms. Selected documents are decrypted temporarily to prepare your approved packet; their contents are not stored in workflow memory. Entries remain until you delete them. Interrupted uploads are cleaned up after 24 hours; failed deletions are hidden and retried. Minimal audit records contain opaque account and entry identifiers, action and time. Copies you download and provider recovery backups are outside immediate live deletion.

Document-request metadata is encrypted and retained for up to 120 days from the source email. Approval previews expire after 10 minutes. Scan markers and preparation receipts are retained for up to 120 days. Disconnecting the source Gmail account or disabling travel-conversation discovery removes its request metadata and previews. Your document-handling preference records only the workflow rules you confirmed, not passport data. You can reset it; minimal preference history is retained for up to 180 days. Provider recovery copies may remain after live deletion.

Private preview availability list

You can leave your email without creating an account or verifying a phone. With your permission, we use it to email you when more families can join. The optional answers about travel planning needs and personal assistants help us understand what would be useful to your family; they do not connect those services or create a travel profile. We store the email and optional answers encrypted, a keyed email lookup for deduplication, and your dated consent. We do not verify mailbox ownership at this step or send an automatic confirmation email. Repeated submissions do not create duplicate entries or overwrite the existing request.

Availability requests expire after 180 days. To leave the list sooner or correct a request, email brandon.klein@gmail.com from the address you used. We may need to verify ownership. We use short-lived, keyed network identifiers to limit abuse; we do not store raw IP addresses in the signup database. Joining this list never grants family access or enrolls you in SMS. Provider recovery copies may remain for up to 30 days after removal.

Phone sign-in and invitations

Phone sign-in uses Twilio Verify to send a code when you request one. We store an encrypted phone number, a keyed lookup value, a permanent account ID, hashed session tokens, verification metadata and your consent choices. We do not store verification codes. Pending signup requests contain the family name and email you provide; that email is not connected or verified until you complete the separate account process. Pending requests without active membership expire after 90 days. Signing in proves phone control, not family membership. Each family needs an approved invitation and a separate workspace.

Authentication texts and recurring trip messages have separate choices. You can stop trip texts with STOP without losing ordinary website access. Phone numbers can be reassigned or compromised; contact support if your number changes. Passport information is excluded from text replies, AI context and Calendar events.