Privacy Policy

1. Introduction

TravelTrek is a portfolio demonstration project built by Nurudeen Abdul-Majeed to showcase a full-stack travel booking platform. It is not a travel agency and sells no real travel. Because trying the demo can involve creating an account, this policy explains plainly what data the demo handles, what happens to it, and how to remove it.

By using the demo you agree to the practices described here. If you would rather not share anything, the public demo board and the shared demo sign-ins let you explore without entering personal information at all.

2. Who runs this project

This project is built and operated by a single developer:

• Developer: Nurudeen Abdul-Majeed
• Portfolio: manuru.dev
• Email: abdulmajeednurudeen48@gmail.com

3. Ways to try the demo

You can browse the public demo board without any account. To go further you can use the shared one-click demo sign-ins (a demo customer and demo staff roles), or create your own test account with an email address or phone number, or with Google sign-in. The less personal the details you use, the better; a made-up name and a throwaway contact are perfectly fine here.

4. Information the demo collects

4.1 Account data. A name, an email address and/or phone number, and an optional address. Passwords are stored only as one-way bcrypt hashes; the demo never sees or stores a password in readable form. If you use Google sign-in, the demo stores the name, email address, and account identifier Google provides, and never sees your Google password.

4.2 Bookings and payments. Test bookings you make (tours, room stays, flights) are stored against your account. Payments run through Paystack in test mode: no real money is ever charged, and card details are entered in Paystack's own checkout, never on this server, which stores only the transaction reference and status.

4.3 Reviews. Reviews you write on completed test trips are public and appear with your account name on the demo board.

4.4 Verification codes. Two-factor and one-time login codes are sent to the email address or phone number you provided and expire quickly. Delivery goes through ordinary email and SMS providers.

4.5 Nothing else. There are no analytics, no advertising trackers, and no profiling of any kind.

5. Your test data is visible to other visitors

This is the most important thing to understand before entering real details: the demo's staff roles (agent and admin) are open to visitors through the shared demo sign-ins, and staff can see customer records, including names, contact details, bookings, and payment history. Treat anything you enter as visible to strangers. Use invented details, never reuse a real password, and do not enter another person's information.

6. How your data is used

Data is used for exactly one purpose: making the demo work (your account, your test bookings, and the emails or texts the demo sends about them). It is never sold, shared, rented, used for advertising, or used to train models.

7. Deleting your data

You are encouraged to clean up after trying the demo:

• Sign in with the demo admin and delete the test account you created, along with its bookings.
• Or email abdulmajeednurudeen48@gmail.com and I will delete it for you.

Independently of either, the demo database is test inventory and may be reset or wiped at any time, which also removes any data you left behind.

8. Security

The demo is built to production security standards: bcrypt password hashing, short-lived session tokens in httpOnly cookies with refresh-token rotation and replay detection, verified contact changes, account lockout, rate limiting, and encrypted connections throughout, with the database on a managed provider that encrypts storage at rest. Still, no online system is completely secure, and this one is a demo run by one person: do not put anything sensitive into it.

9. Infrastructure and processors

The demo runs on ordinary cloud infrastructure: a frontend host, an API host, a managed PostgreSQL database, Redis for background jobs, and Cloudinary for catalog photos. Paystack processes test payments, Google handles sign-in only if you choose it, and email/SMS providers deliver verification codes and booking notifications. These providers process data only to run the application; no third party receives your data for its own purposes.

10. Cookies

The app sets only strictly necessary cookies: httpOnly access and refresh tokens that keep you signed in. There are no analytics, advertising, or cross-site tracking cookies.

11. Children

The demo is not directed at anyone under 18, and no data is knowingly collected from minors.

12. Changes to this policy

If the demo's data practices change, this document will be updated with a new date at the top. Continued use after a change means you accept the updated policy.

13. Contact

Questions, deletion requests, or security reports: abdulmajeednurudeen48@gmail.com. See also the Terms of Service.