What happens to your data

The short version

• Your travel history lives on your iPhone. Everything works with the network switched off.
• Reading your photo library to work out where you have been, and reading a receipt with the camera, both happen on the device. Neither the photos nor the receipt images are sent anywhere for that.
• When you sign in, your own copy is mirrored so you can get it back on a new phone — and the things you deliberately share are sent to the people you shared them with. Nothing else goes up.
• There is no analytics SDK, no crash reporting SDK and no advertising SDK in Travi. We do not sell anything about you, because we do not collect it.
• What is mirrored sits on servers in Frankfurt, Germany. You can delete the whole account from inside the app.

Who is responsible

Travi is made by one person. For anything in this document — a question, a request for a copy of your data, a deletion, a complaint — write to joe.bouchedid@gmail.com and you will get a person, not a ticket number.

What stays on your iPhone

The app is local first. Places you have been and places you want to go, your trips, day plans, notes, expenses and their receipts, and your profile are all stored in the app’s own database on the device. If you never sign in, that is where the story ends.

Three things read something sensitive, and all three do it on the phone.

Your photo library

When you ask Travi to find trips in your photos, it reads the dates and the location stamps of your pictures on the device to work out where you were, and shows you the result before anything is added. A photograph is only ever uploaded when you put it into a shared album yourself.

The camera

A receipt is read by the text recognition built into iOS, on the phone. The picture is only sent anywhere if the expense belongs to a group you share with other people, and then only to them.

Your location

Used once, when you tap “I’m here”, to work out which city you are in. There is no background location, no tracking and no location history beyond the places you chose to add.

Drafting a day plan with the on-device model also happens on the phone. Deleting the app deletes the local copy.

What we store when you sign in

An account exists so that you can get your globe back on a new phone, and so that other people can be let into a trip. You sign in with Apple, with Google, or with a six-digit code sent to your email address. We keep your email address, an account identifier, and the sign-in method you used.

Once you are signed in, the following is mirrored:

• Your profile — display name, handle, home city, bio and profile picture. A profile picture is stored in the one public bucket, so that it can appear on an invite page for somebody who is not signed in. Treat it as public.
• Your own travel data — the places, trips, plans and expenses you have entered, so they survive a lost phone.
• The things you share — a trip you invite someone to, a plan, a shared album and its photographs, an expense group and its receipts, your friends and any groups you are in. These are readable by the people you shared them with, and by nobody else.

The legal grounds, if you need them named: performing the service you asked for (your account, your mirror, your shared trips), your consent (photos, camera, location — each asked for separately and revocable in iOS Settings), and a legitimate interest in keeping the service working and free of abuse.

What we do not do

No analytics, no product telemetry, no crash reporting service, no advertising or attribution code, no fingerprinting, no third-party trackers on this website, and no profiles built from your behaviour. Nothing about you is sold, rented or shared for anyone else’s marketing. There is no automated decision-making.

The other companies involved

Keeping it this small still takes a handful of services, and it is honest to name them:

• Supabase hosts the database, the sign-in system and the file storage, in Frankfurt, Germany.
• Apple and Google, if you choose to sign in with them, tell us that the sign-in succeeded and give us an email address. We do not get access to anything else in those accounts.
• A mail provider delivers the six-digit sign-in code to your email address.
• Apple Maps is used for searching places, drawing maps and fetching street-level imagery. Those requests go to Apple under their own privacy terms.
• A published exchange-rate feed is fetched so that money spent in one currency can be shown in another. The request carries nothing about you.

Where it lives, and for how long

Everything mirrored is stored in Frankfurt, Germany, inside the European Union. It is kept for as long as your account exists. When you delete the account it is removed. Things you contributed to something shared — an expense in a group, a photograph in an album, a stop on somebody else’s plan — may stay visible to the other people in that trip or group, because removing them would break the record they are still using. Everything that is only yours goes.

Deleting, and taking it with you

In the app, open Settings → Account → Delete account. It asks you to confirm, and then the account and everything mirrored under it is deleted. Deleting the app from your iPhone removes the local copy.

Settings → Your data → Export everything as JSON writes your travel data out as a file you can keep or move elsewhere. If you would rather we did either of these for you, ask at joe.bouchedid@gmail.com.

This website

travi.app exists so that a link someone sends you works even before you have the app. It sets a cookie only when you sign in here — the one that keeps you signed in — and, while the site is still private, one that remembers you knew the password. There are no analytics or advertising cookies, and none of the pages load a third-party script.

An invite page shows only what the invite is: who is hosting, what it is called, when it is and who has joined. It never shows balances, photographs or the code itself to someone who has not been given it.

Children

Travi is not intended for children under 16, and accounts are not knowingly created for them. If you believe a child has made an account, write to us and it will be removed.

Your rights

If you are in the European Union, the United Kingdom or somewhere with comparable law, you have the right to ask for a copy of what we hold, to correct it, to have it deleted, to restrict or object to how it is used, and to take it elsewhere. Most of that is a button in the app; the rest is an email away, and we will answer within a month. You also have the right to complain to your national data protection authority.

Changes

If this document changes, the date at the top changes with it, and a change that affects what happens to your data will be told to you directly rather than left here to be found.