App: SIT ("Make the sit count"), a layover guide for flight crew and passengers
Web app: https://sitthelayoverguide.grok.me
Made by: David Christopherson, an individual developer ("we", "us")
Contact: [email protected]
Last updated: 20 October 2026

This policy explains what SIT collects, why, who helps us run it, and how long we keep it. It covers the SIT website and the SIT apps for iPhone and Android.

• No accounts. You don't sign up or log in. To use SIT we never ask for your name, email or phone number.
• No ads, no tracking, no selling. SIT has no ads and adds no analytics tools of its own. We don't sell your information or use it to track you across other apps or websites. Our hosting platform adds a few of its own scripts and sets technical cookies (see section 4).
• No GPS. SIT never asks for or reads your device's location. It finds places around the airport, city or hotel that you pick.
• Most of what you enter stays on your device. That includes your city, times, saved flights and pairings. The hotel you pick is the main exception: its name, location and address go to our server so SIT can estimate walking and driving times and get the weather (see section 3).
• Ride reports are public. Other SIT users can see any report you post. We store a random ID for your device with it, so you can delete your own posts and we can block abusive posters.
• Ask the desk uses AI, but only if you allow it. Nothing goes to the AI service until you tap Allow, and you can switch Ask the desk off on the Brief page.
• You can delete everything yourself. Delete my data, in the footer of every page (Privacy · Standards · Delete my data), erases what we hold for your device and clears what SIT stores on your device.

SIT saves these in the browser or app storage on your phone (local storage and session storage):

• Your settings and inputs: crew or passenger mode, city or airport, hotel, ride time, takeoff, van and report times, saved flights and pairings.
• A random device ID. This is a long random code your phone makes the first time you use Reports or the contact form. It isn't your name, and it isn't tied to your phone's hardware or advertising ID.
• Your choices: whether you agreed to the community standards, and whether you allowed Ask the desk.
• Place lists you loaded (names, hours, ratings). SIT keeps these for up to 6 hours, and only in that browser tab or app session.
• An offline copy of the app (pages, code and icons), so SIT can open without a connection. Place data from Google is never put in this copy.

We can't see any of this, except what you send us by using a feature in sections 2 and 3. You can delete it at any time with Delete my data (see section 7), by clearing the site's data in your browser settings, or by deleting the app.

These are stored in our database (Postgres, hosted by Neon). Each record carries the random device ID of the device that sent it.

Please keep names, employee numbers, phone numbers, email addresses and other personal details out of reports and messages. The community standards don't allow them, and we remove posts that include them.

Some features send information through our servers to another service so they can work. Our servers don't keep this information as a record about you, except where this section says so.

• Finding places. When you open a Food, Drink, Coffee or To do list, SIT sends a map point and the kind of place to our place service. It forwards them to Google and returns nearby places. It doesn't store the request or the results.
• Usually the map point is the airport, city or hotel you chose.
• For places worth a drive, SIT searches around a point in a nearby neighborhood or town instead, not your hotel's or the airport's exact location.
• Route timing. When you pick a hotel, SIT sends the hotel's name, location (map coordinates) and address to our server, which works out walking and driving times to nearby places. We don't store this in our database. Our server passes on:
• to match nearby places on foot: only the hotel's latitude and longitude, to Overpass (overpass.openstreetmap.fr), with no names. Our server caches these lookups by location rounded to 3 decimal places (about 330 feet);
• to find places Overpass didn't match: up to 48 place names, each with the hotel's coordinates, to Photon (photon.komoot.io). These are the names of the places in your lists, not your name or the hotel's name;
• for walking and driving minutes: coordinates only. Our place service asks Google Routes first. If Google doesn't answer, our server asks OSRM (routing.openstreetmap.de) and Valhalla (valhalla1.openstreetmap.de and valhalla.openstreetmap.de).
• Hotel search. The hotel name you type and the airport's location go through our place service to Google (Places Autocomplete and Place Details). The search is limited to about 30 miles around the airport. Only if Google finds nothing, or our place service can't be reached, does our server look the hotel up with other map services instead (see section 4).
• Ask the desk (only after you tap Allow). Before anything is sent, SIT tells you: "Your question, hotel name and location, airport code and city are sent to xAI (Grok) to answer." xAI's AI service (Grok models, with web search) writes the answer. In detail, we send:
• the city and airport code, and SIT's own notes about that city and its crew-hotel area;
• your selected hotel's name and address;
• the hotel's location, rounded to 4 decimal places (about 30 feet).

These companies provide services to SIT:

• Google (Google Maps Platform: Places API and Routes API). Supplies place names, opening hours, ratings, phone numbers, websites, hotel search results, and walking and driving minutes. Google gets the map point, the kind of place, and any hotel name you type. These go through our server, not straight from your device, and the Google key stays on our server. https://policies.google.com/privacy
• xAI (api.x.ai). Powers Ask the desk (only after you allow it), reads pasted pairings, and is the backup for flight lookups. xAI handles this data for us as a service provider under its business (API) terms. It says it doesn't use API requests to train its models and deletes them automatically within 30 days, unless it must keep them longer, for example to investigate abuse. https://x.ai/legal/terms-of-service-enterprise
• Neon. Hosts our Postgres database of reports, flags, blocks and messages.
• Cloudflare. Runs our place service and helps deliver the website. Like any web host, it handles your IP address to deliver each request. It also sets a technical cookie, __cf_bm, to tell people from bots (see "Hosting scripts and cookies" below).
• Our place service uses your IP address only to limit each device to 30 requests a minute. That count stays in memory for about a minute and is never saved.
• The only thing the place service saves is a total of Google requests per day and per month across all users. Those totals say nothing about who made the requests.
• https://www.cloudflare.com/privacypolicy/
• Vercel and xAI (Grok Build). Host the SIT web app and its server functions.
• Hosting scripts and cookies. SIT is built and hosted with Grok Build by xAI, on grok.me. The hosting platform adds its own scripts to each page: grok.com/grok-app-builder/extensions.js, and a check from app-builder-deployer.grok.com on whether the app can be remixed. Your browser loads them from xAI's servers, which see your IP address when it does. The host and Cloudflare also set technical cookies:
• __cf_bm (Cloudflare, on grok.me and grok.com), for bot protection;
• __vdpl (a session cookie), to route your requests to the right version of the app.

SIT doesn't use GPS or your device's location services. It works from the airport, city and hotel you choose. Your selected hotel's location is used in these ways:

• to find nearby places, through our place service, which doesn't keep it;
• to estimate walking and driving times: the hotel's coordinates go to our place service, which asks Google. If Google doesn't answer, our server sends those coordinates to OSRM and Valhalla. Overpass and Photon still match a place name to a pin;
• for the weather: our server rounds it to about 0.6 miles before it goes to a weather service;
• with Ask the desk questions, once you've allowed them, rounded to about 30 feet.

For places worth a drive, SIT searches around a nearby neighborhood or town, not your hotel's location.

• On your device: until you use Delete my data, clear the site's data, or delete the app. Place lists last up to 6 hours.
• Ride reports: a report stays up until you remove it, you use Delete my data, or we remove it for breaking the community standards. A removed report disappears from the app at once. Its record, and any flags on it, are deleted from our database 30 days after removal.
• Contact messages and flags: deleted automatically 12 months after they were sent. (Our server runs this clean-up each time it starts, so deletion can happen a little after the 12 months.)
• Blocks: kept so that blocks keep working, until you use Delete my data.
• Delete my data: removes your device's records from our database straight away (see section 7).
• Ask the desk answers: kept in our server's memory for 30 minutes, then dropped. xAI deletes API requests and answers automatically within 30 days, unless it must keep them longer for legal or safety reasons, such as an abuse investigation.
• Place service: per-device request counts last about one minute and are never saved. The daily and monthly totals hold no personal information.
• Hosting logs: our hosting providers keep technical logs, which can include IP addresses, for security and delivery.
• Logs Cloudflare stores for our place service are kept for at most 7 days.
• Function logs Vercel stores for us are kept for at most 30 days, depending on the plan.
• Each provider may also keep its own network and security records under its own privacy policy.
• Grok Build (xAI) keeps hosting logs under xAI's own policies; it doesn't publish a fixed period.

• Delete my data: tap Delete my data in the footer (Privacy · Standards · Delete my data). SIT shows a warning first. When you confirm, it:
• permanently deletes, from our database, the ride reports, flags, blocks and contact messages tied to your device ID (including blocks made against your posts);
• clears what SIT stores on your device (local and session storage, saved offline data, and the cookies the page can reach);
• gives your device a new random ID, so nothing new is linked to the old one.

SIT isn't directed to children under 13, and we don't knowingly collect personal information from them. Our community standards say SIT is for people 17 and older, and the app discusses bars and drinks. If you think a child has sent us information, contact us and we'll delete it.

Every connection to SIT and its services uses HTTPS. The Google key stays on our server and never reaches your device. No system is perfectly secure, but we keep as little as we can.

When we change this policy, we'll update the date at the top. For a significant change, we'll also show a notice in the app.

David Christopherson, [email protected]