Privacy Policy

What we collect

Only what the app needs to work: your first and last name, your email address and a securely hashed password when you create an account, and any message you send us through the Contact / feedback form.

The voyage plan you save, the legs you mark as booked and the sailings you add to My sailings are stored with your account too.

If you ask for a new password, we email you a one-time link and keep only a hashed copy of it, never the link itself, until it is used or 30 minutes have passed.

If you connect a Club Royale account, you sign in to Royal Caribbean yourself in a secure browser session, and the resulting signed-in session is stored on our server, for your account only, so we can read your offers.

It is removed when you disconnect that account, sign out, delete your account, or when your sign-in here ends after two hours without activity. We never see or store your Royal Caribbean password.

We do not collect payment information (booking happens on Royal Caribbean or CruiseDirect, not here).

How we use it

Your email identifies your account and lets you sign in, and it is the address for the email you ask for under Email from us below. Feedback is used to fix and improve the app.

Casino-offer data is used only to compute your back-to-back legs and savings for you, unless you switch on sharing your offer lists with other members, described under Sharing your offer lists below.

We do not sell your data, we do not share it with advertisers, and we run no advertising trackers. The one outside analytics service on the site is Cloudflare Web Analytics, described under Server logs and usage analytics below.

Email from us

We send email alerts about ships and fares only to people who ask for them.

The box that asks is unticked until you tick it yourself, on your Profile or on the page behind the "Email choices" link: "Email me about the ships I follow and when a price I watch changes". Nothing is sent to anyone who has not ticked it.

Our weekly email has a box of its own, described under The Price Check email below; this one does not sign you up for it.

When you tick it we keep the time, the words you were shown and where you ticked it. After that you can get a short note on days something changed for a ship you follow or a fare you watch, and a note when a fare you watch drops a lot.

Each of those can be switched on or off, and you can pause all of it for 30 days.

Every one of these emails has a link that stops all of it with one click and a link to change your choices. Both work without signing in.

When you stop, or when an address bounces or is reported as spam, we keep a scrambled code made from that address, not the address itself, so we do not email it again.

The code stays if you delete your account, and it is the only thing about the address that does.

The list of ships you follow, the fares you watch and your email choices belong to your account alone, and they are removed when you delete your account. We hand the address and the message to Resend, the service that delivers our email, and to nobody else.

These emails carry no tracking pictures and no click tracking, and we never sell or share your address.

Three more alerts work on their own, each with its own box or button.

A cruise countdown: when you are signed in and set My cruise on the Ship Tracker, you can tick "Email me a countdown", and we email you 30 days, 7 days and 1 day before you sail and on sailing day,

with where your ship is scheduled to be and the back-to-backs you could add.

A fare drop alert: on a trip page you can press "Email me when this fare drops", and we email you when the total for 2 guests goes down from what you saw, and again only if it goes down further.

If a trip is sold out and you are signed in, you can press "Email me if it comes back", and we email you once if it goes back on sale.

If the address is not the confirmed address of the account you are signed in to, including any address typed while signed out, we first send one email with a button, and nothing else is sent until that button is pressed;

an alert nobody confirms is deleted after 3 days.

For each alert we keep the address (or the link to your account), what it is about, the fare you saw, when you asked and the words you were shown, and a short record of which emails went, with the address in that record only as a scrambled code.

Every one of these emails has a link that stops that alert with one click, without signing in. Stopping an alert deletes it. Deleting your account deletes all of them, including any left with your address while you were signed out.

Cookies

We use a single, strictly-necessary session cookie to keep you signed in. It is HttpOnly and (in production) Secure.

There are no advertising or tracking cookies (Cloudflare Web Analytics, described below, sets none), so there is nothing to consent to: the cookie notice is only there to tell you so.

The site owner's own browsers also carry one small analytics-only cookie, so the owner's visits are not counted as visitors. It is never given to a visitor, and it is not used to track anyone.

Creator videos

An opened trip can show videos about its ship and ports, made by independent creators and published on YouTube.

Their preview pictures are loaded by your browser straight from YouTube's image server when they come into view, so that server sees your IP address, as any website you visit does.

We do not tell YouTube which of our pages you are on, and we load no YouTube player: clicking a video opens it on YouTube itself.

Our own videos

Our Cruise videos pages show videos from our own YouTube channel.

The preview picture of each video is loaded by your browser straight from YouTube's image server when the page opens, so that server sees your IP address, as any website you visit does, and we do not tell it which of our pages you are on.

The video player itself is not loaded until you press play. Then YouTube's privacy-enhanced player (youtube-nocookie.com) loads on the page, and YouTube's own privacy policy applies to what it does.

We add no tracking of our own to these pages or to the player.

The price checker

When you use the price checker, we keep the sailing, cabin type, number of guests, the price per person you typed, where you got it, the verdict you were shown and the time, with no name, account, email address or IP address attached,

so we can learn what people are really being quoted and improve our price comparisons.

If you follow a link from the price checker to Royal Caribbean or CruiseDirect, we count that click with the sailing and the kind of verdict you were shown, and nothing that identifies you; its CruiseDirect link is an affiliate link, as described below.

Your receipt on the price checker

The price checker can read the table from your Royal Caribbean receipt. Reading happens inside your browser: the text you paste never leaves it. If you do nothing more, nothing from your receipt is sent to us or kept.

After it has been read, the page offers a box, unticked, that says "Help improve our prices".

Only if you tick it and press Share do we receive these numbers: the sailing, your cabin type, how many people were in the cabin, the cruise fare per person, the offer discount per person, the taxes and fees per person.

We also receive the room total, the name of the offer if it is one we already know, and the day you booked if you filled that in.

When the two guests on a receipt had different offers, we receive each guest's own offer discount instead of one.

The page shows you exactly what will be sent before you press Share.

We never receive or keep your name, your booking number, your email address, your address, your payment details, or the text of your receipt.

We store no account, cookie, session or IP address with these numbers, and we note only the day they arrived, not the time. The same receipt shared twice is counted once.

To stop one person sending a great many, the server counts requests per address in its memory for an hour; that count is never written down.

The numbers are kept indefinitely in our data lake, with nothing in them that identifies anyone, and we use them only to improve the second guest and offer prices we show.

Because they carry no name or account, we cannot find and remove one person's numbers afterwards.

My sailings and Ship ranks

My sailings is a log you can keep on your Profile page. For each sailing you add we store, with your account, the ship, the day you sailed and the number of nights.

We work out your nights at sea, your Ship rank and your badges from those rows each time you open the page, and keep nothing else about them.

Cruises already in your voyage plan, or marked as booked, that have sailed already count too. We use what we hold already for them and store nothing more.

It is private. Only you can see it. Nothing in it is published, and no other member can see it. The picture you can save to share is drawn in your own browser, and nothing is sent to us when you make it.

If we ever add a leaderboard of members, it will be opt-in: nothing from your log will appear on it unless you switch that on, and this policy will say so first.

If you press "I'm on board" during a cruise, your device asks permission to use its location. The comparison with where the ship should be is done in your own browser. Your location is never sent to us, logged or stored.

We keep only that the check matched, for which sailing, on which day, whether in port or at sea, and the time.

Your log, and these checks, are deleted with your account, straight away.

The offer code lookup

When you look up a Club Royale offer code on our offer code page, or in the box inside our article about offers, we count which code was looked up, when, and whether it was typed on the page or in the article.

We never record which account or which address looked it up. If what you type does not read as an offer code, it is not kept at all.

The page for a code has the code in its address, so like every page it also appears in the standard web logs described below, which are deleted after about two weeks.

The button on that page opens Royal Caribbean's own list of the sailings for that code, on Royal Caribbean's website, in a new tab. Our server does not fetch it for you.

Sharing your offer lists

Sharing is off unless you switch it on yourself, on your Profile, with the box "Share the sailing lists of my personal offers with other members".

When it is on, another signed-in member who looks up the code of one of your personal Club Royale offers on our offer code page can see that offer's list of sailings: the code, and for each sailing its date, ship, departure port, itinerary and offer line,

as Royal Caribbean showed them to you, and the day we last read them. If several members share the same code, their lists are shown together.

They never see your name, your email address, your account, the name of your Club Royale account here, your Crown & Anchor number, your points, your book-by dates, your booking links, the legs you booked or anything else of yours,

and we never show how many members shared a code or who. Only lists we read from Royal Caribbean for you are shared, never one typed in by hand.

Birthday and anniversary offers are never shared, and monthly offers are not, because Royal Caribbean publishes their lists itself. Visitors who are not signed in see no shared list.

Switch it off, delete the offer or delete your account, and your lists stop being shown at once. Disconnecting a Club Royale account does not remove the offers already read from it: switch sharing off for that.

Affiliate links

Some outbound "Book with CruiseDirect" links are affiliate links. If you book through one, we may earn a commission at no extra cost to you. These appear only on full-price legs where no casino offer applies, and are labelled as affiliate links.

Server logs and usage analytics

Like any website, our server keeps standard web logs: the IP address, page requested, time, referring page, browser, and country of each request.

We use them to see how much traffic the site gets and to spot abuse and errors, and they are deleted after about two weeks.

The app's own server log notes which page or API route was requested and when (for a search, the filters chosen), never the text you type or an email address, and like the web logs it is deleted after about two weeks.

Cloudflare, which delivers and protects the site, adds its Web Analytics script to our pages. It sets no cookies. It counts page views, referring sites, country, browser and how fast pages load, and we see only the totals.

What Cloudflare does with that data is covered by Cloudflare's own privacy policy.

Inside the app we also record first-party usage events: that a signup, sign-in, search, offer import, or outbound booking/affiliate click happened, plus the non-identifying shape of a search such as departure port, cabin class and number of guests.

If you are signed in, these events are linked to your account, with one exception: for an outbound click, such as a booking or CruiseDirect link, we record which sailing the link was for, and never which account clicked it.

We never record your password, and we do not tie the specific cruises you look at to your account. This data stays on our own server: it is never sold, and never shared with advertisers or any other analytics service.

After about 400 days we erase the link between a usage event and your account and keep the rest as an anonymous record. Deleting your account does the same straight away.

The Ship Tracker map and live positions

The Ship Tracker's map is drawn by your browser from map tiles and fonts it fetches directly from OpenFreeMap (tiles.openfreemap.org).

For members who switch on 3D terrain, your browser also fetches elevation tiles from Amazon's open terrain data (s3.amazonaws.com), and for the satellite photo, images from NASA's GIBS service (gibs.earthdata.nasa.gov).

None of these services is told who you are by us and none sets cookies for us; like any web server they see your IP address, your browser and that the request came from legtolegcruises.com. We receive none of it.

Live ship positions on the tracker come from public radio signals that ships broadcast (AIS), received by shore stations and passed to us by a free feed (aisstream.io). They are positions of ships, not of people.

We keep the history of those signals for statistics. Your own use of the tracker is covered by the usage events described above.

Search data

When you search (by typing what you want, or by using the filters) we record the search itself: the words you typed, what we understood them to mean (departure port, destination, dates, trip length, ship, budget), how many results came back,

and whether it found nothing. We also record which results you open, save to your voyage, or click through to book, and where they ranked.

Searches made through our public API, and by AI assistants through our MCP server, are recorded the same way; for an AI assistant we also record which tool it used, a summary of its settings (ports, dates, numbers, never the words),

how many results came back and how long it took.

We keep this to learn what people are looking for, so we can decide which cruise data to collect next and which pages to write. It is the main thing that makes this site better over time.

This search record, and the record of what you clicked, carry no account id and no IP address. Searches are grouped under a temporary identifier derived from your connection that changes every day and cannot be linked back to you or across days.

That lets us tell that three searches in one visit belong together, and nothing more.

If you are signed in, the usage log described above also notes that you searched, with the non-identifying shape of the search (such as the departure port, dates and number of guests), linked to your account; it never holds the words you typed.

We keep what you search for, indefinitely, because the questions people ask are what teach us what to build.

Please do not type personal details such as emails or phone numbers into a search box: if something looks like one, it is replaced with a placeholder like [email] before anything is saved.

The temporary identifier that groups the searches of one visit is erased after about 400 days.

What is kept (the words you typed with emails, phone numbers and @handles replaced, the port, dates, trip length and so on) carries no account id and no IP address, and we keep it long term,

together with anonymous daily counts ("twelve people searched for Miami in March"), so we can see how cruise demand changes over the years.

We may publish or share those counts. We never sell, publish or share individual searches.

The Price Check email

If you say yes, on your Profile, when you make your account, or with the "Get the weekly Price Check" button on some of our pages or on the small Price Check bar at the bottom of a page, we will email you "The Price Check",

our weekly note about the biggest price drops we saw. The box starts empty: it is off until you turn it on, we never turn it on for you, and you do not need it to use the site. Agreeing to our Terms of Use does not sign you up for it, or for any other email.

To send it we keep one yes or no per account, the day you said yes (or no) and the version of this page you saw, and a private key that makes the Unsubscribe link in every email work. Email only: we do not ask for or keep a postal address.

Your own details in your copy are a second choice, with a box of its own on your Profile that also starts empty: "Put my own details in my copy".

Only if you tick it does your copy have a part made from your own lists: under "What you follow", the trips you watch and the ships you follow on the Ship Tracker (and trips you asked us to email you about when their fare drops) with their prices that week;

the book-by dates of your Club Royale offers that are close; and your Ship rank and badges from My sailings. Nothing else. We make it when we write your copy, only your copy has it, and we keep nothing extra to do it.

Without that tick your copy is the same as everybody's, and unticking The Price Check unticks it too. Apart from that we use your account email and nothing else about you.

The small Price Check bar remembers, in your own browser, whether you folded it away or said no thanks, so it does not keep asking. That note stays on your device and is never sent to us.

To stop it, untick the box on your Profile or press Unsubscribe in any email, and it stops straight away. Deleting your account removes this record too. We do not sell the list or share it with anyone.

How long we keep it

We keep your account data until you delete your account. You can delete your account at any time from your Profile.

That removes your name, email, password hash, sessions, your sailing log, any password reset links, the ships you follow, the fares you watch, your email choices (including your Price Check yes or no) and your email alerts.

Backups made before you delete your account are overwritten within about 60 days. Connected Club Royale sessions are removed when you disconnect, sign out, delete your account, or when your sign-in here ends after two hours without activity.

A message you send through the Contact / feedback form is kept; the reply email address left with it, and any link to your account, are erased after about 400 days, or straight away when you delete your account.

Your rights

You can access, correct, or delete your personal data at any time (email and password from your Profile; account deletion from your Profile).

If you are in the EU (GDPR) or California (CCPA), these rights apply to you, and you can also contact us with any privacy request through the Contact form. We honour deletion and access requests.

Security

Passwords are stored only as salted scrypt hashes, never in the clear. Sessions use random tokens in a hardened cookie.

A link to choose a new password works one time, for 30 minutes, and using it signs your account out everywhere; it changes only the password, so an account that uses a sign-in code from a phone app still needs that code.

Connected Royal Caribbean sessions are treated like a password store and are never shared. No system is perfect, and legtolegcruises.com is in beta, so please don't store anything here you couldn't stand to lose.

Contact

Questions or requests about your data? Use the Contact / feedback link in the app and we'll respond. This policy may change as the app grows; the "last updated" date above will change when it does.