One Step Travel respects your privacy.

We collect only the information necessary to provide travel recommendations and improve the user experience.

Information we collect on the website

• Destination preferences
• Budget inputs
• Trip planning selections (travelers, dates, lodging preference)
• Account information when provided

AI assistants and our MCP integration

One Step Travel can be used from AI assistants such as ChatGPT and Claude through our MCP (Model Context Protocol) endpoint at onesteptravel.app/mcp. When an assistant calls one of our travel tools on your behalf, we receive only the trip details it sends us — for example destination, departure city, budget, number of travelers, dates, and lodging preference.

We do not receive or store your AI conversations.

We never see the rest of your chat with the assistant. We have no access to your ChatGPT or Claude account, your identity, your email address, or your chat history, and we do not store transcripts of any kind. Our MCP tools are read-only: they look up travel estimates and itineraries and cannot change anything in your account or in the assistant.

For each MCP request we log operational details so the service stays reliable and affordable: which tool was called, the destination and basic trip parameters, whether the call succeeded, how long it took, whether the answer came from cache, and our internal estimated processing cost.

Rate limiting and client fingerprinting

To prevent abuse and runaway costs on a free service, we apply rate limits per client. To count requests without identifying you, we create a short one-way hash (SHA-256) of the requesting IP address and user-agent string, or of the assistant's client ID when one is provided. We store only that truncated hash — we do not store raw IP addresses from MCP requests, and the hash cannot be reversed back into an IP address.

Caching and retention

Trip answers are cached for about 24 hours so repeat questions are fast and inexpensive. Operational request logs and hashed rate-limit counters are kept only as long as needed for reliability, abuse prevention, and cost monitoring — generally up to 12 months — and are then deleted. You can ask us to delete data associated with your account at any time.

Analytics

We use privacy-conscious, aggregate website analytics to understand traffic: page views, referring source, campaign tags in links, approximate country, and device type. We do not build advertising profiles and we do not sell personal information to third parties.

Third-party services

We rely on trusted third parties to run the product: hosting and database infrastructure, AI model providers used to generate itinerary text, mapping and place data, and flight, lodging, and activity pricing providers. These providers process only the trip details needed to answer your request, under their own privacy policies.

Affiliate links and deep links

Booking links on One Step Travel — flights, hotels, and activities — may be affiliate links, and we may earn a commission at no extra cost to you. Links returned to AI assistants point back to a One Step Travel itinerary page and include campaign tags (for example utm_source=mcp) so we can tell how much traffic assistants send us. When you continue to a booking partner, that partner's own privacy policy and cookies apply.

Estimates, not quotes

Prices shown on the site and returned to AI assistants are estimates. Actual prices may vary and should be confirmed with the booking provider.

Contact and data removal

Users may request account or data removal, or ask any privacy question, by contacting: support@onesteptravel.app

By using One Step Travel, you agree to this Privacy Policy.