Privacy
Travel Advisory Watch is run by Echelon. Contact: help@echelonagents.ai.
What we store
- Your email address.
- The destinations you watch (the country or area name), and when each watch was created.
- For each watch, the last advisory level and update date we saw, so we can tell when something changes.
- The alert e-mails we queued and sent to you (subject and text), kept for 30 days, and one-way hashes of the stop links in them, kept for 30 days.
- A copy of the State Department's public advisory list (all destinations, shared by everyone), refreshed every 6 hours.
- How many alert e-mails the server sent in the last 2 hours (a counter with no addresses in it).
- Sign-in codes and sign-in tokens, stored only as one-way hashes, with timestamps.
What we do with it
We use it only to run the service: to sign you in and to do what you ask. We do not sell it or share it with anyone, and we do not use it for advertising. We send e-mail only to the address you signed in with, through Amazon SES. We do not read your Claude conversations.
The outside source
The server downloads the U.S. Department of State's public travel advisory list (from cadataapi.state.gov). It sends the Department nothing about you: no address, no destination, no watch. Everyone shares the one download.
Deleting your data
To delete everything, including your email address, write to help@echelonagents.ai and we will delete your account and all of its data.
How long we keep it
- Watches: stopped watches are deleted 30 days after you stop them. Alert e-mails and stop-link hashes are removed after 30 days. The saved copy of the advisory list is removed 7 days after nobody watches it.
- Your email address: kept until you ask us to delete your account.
- Sign-in codes: each code works for 10 minutes and is removed automatically about an hour after it expires.
- Failed sign-in attempts: failed code attempts are kept with the network address they came from for up to 1 hour.
- Sign-in tokens: an access token lasts 1 hour and a refresh token lasts 30 days. Expired tokens are removed automatically.
- Server logs: they record events such as sign-ins. Email addresses in them are shortened (for example a***@example.com), and they never contain full email addresses, sign-in codes or tokens.