Privacy and your data

The questionnaire and your roadmap work signed out. In that case your answers and progress are kept in your own browser's local storage and are not sent to us. Clearing your browser data removes them, and we have no copy.

An account exists so your plan survives a cleared browser and follows you to another device. Against it we store:

• Your email address, your name if you gave one, and a hashed password, or, if you signed in with Google or an email link, no password at all.
• Your questionnaire answers, because they are what generates your roadmap.
• Your progress: which guides you completed, saved, dismissed or have in progress, the checklist items you ticked, and when.
• Milestones you marked, and the history of status changes you recorded, so the roadmap can reflect where you are.

We do not infer your immigration status. Everything above comes from something you answered or ticked. We keep it until you delete it or your account.

Signing in with Google is optional; an email link or a password works just as well. If you choose it, Google shares only your basic profile with us, through the standard openid, email and profile permissions. We never ask for access to your Gmail, contacts, calendar, Drive or any other Google data.

• What we receive: your email address, your name and the address of your profile picture.
• How we use it: only to create your account, sign you in, and greet you by name. Your email is also where your sign-in links and any reminders you turn on are sent.
• Where it is stored: in our account database in the EU (Render, Frankfurt), alongside the rest of your account. Google access tokens are used once to sign you in and are not stored.
• Sharing: we do not sell, rent or share Google user data with anyone, and do not use it for advertising or to train AI models. It is only handled by the hosting providers listed below, on our behalf.
• Retention and deletion: we keep it until you delete your account on the account page, which removes it immediately. You can also revoke our access at any time from your Google Account permissions page.

The Lithuanian Guide's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

When you ask the assistant a question, the question and the relevant guide excerpts are sent to OpenRouter, which routes them to Anthropic to generate the answer. We store the question and answer for 90 days to check quality and prevent abuse, then delete them. Avoid typing passport numbers or other identifiers into it: it never needs them.

If you turn on deadline reminders we use your saved deadlines to email you, or to send a browser notification if you allowed one. For browser notifications we store the subscription your browser gives us, until you turn them off. Every reminder email has a one-click unsubscribe, and your account page holds your email preferences.

If you submit a service provider we store what you entered and link it to your account so moderators can follow up. The business details become public once approved; your own account details never do.

We use PostHog to understand which parts of the product people actually use, to catch errors, and to replay sessions so we can see where people get stuck. Form inputs are masked in recordings. It is loaded only after you accept analytics cookies, and declining leaves the product fully usable. Until you accept, nothing is measured and nothing is written to your browser for analytics purposes. If you are signed in, analytics events are linked to your account email.

• Render (EU, Frankfurt): Hosts the backend and the database that holds your account.
• Vercel: Serves the website.
• Resend: Sends sign-in links, password resets and deadline reminders.
• OpenRouter and Anthropic: Generate answers when you use the AI assistant.
• PostHog (EU): Analytics, error tracking and session recordings, only after you accept analytics cookies.
• Google: Only if you choose to sign in with Google.

We do not sell personal data or use it for advertising.

Your account page has two separate controls: one deletes your saved progress and leaves the account, the other deletes the account itself along with everything attached to it. Account deletion is immediate and cannot be undone.

If you are in the EU, the GDPR gives you the right to access, correct, export and erase your personal data, and to object to processing. The legal bases we rely on are the contract with you for your account and its features, and your consent for analytics and notifications, which you can withdraw at any time. The controls on your account page cover access and erasure directly. For anything else, or if you believe your rights have not been honoured, you can complain to the State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija).