iTravel Privacy Policy

Effective September 6, 2026

iTravel is a collaborative travel-planning app operated by an independent developer. This policy explains what information the app handles, why it is used, and the choices available to you. We do not sell personal data or use it for advertising.

Information you provide

• Account — email address and password (or Sign in with Apple / Google, handled by our authentication provider). We never see your password.
• Profile — nickname, optional avatar photo, and optional details you choose to add: bio, age, country, travel styles, interests, languages, Instagram handle, visited countries.
• Trip content — trips, day-by-day activities, expenses, packing checklists, links, playlists, cover images, and documents/attachments you upload (e.g. tickets, confirmations).
• AI requests — text, selected places, and images you choose to send to the AI trip-planning assistant.
• Technical data — device push tokens and limited usage, quota, security, and diagnostic records needed to operate and protect the service.

Why we use information

We use information to create and secure your account, provide collaborative trip features, process purchases, deliver notifications you enable, answer support requests, prevent abuse, and maintain service reliability. Depending on the context, the legal basis is performance of our agreement with you, your consent where requested, our legitimate interest in operating a secure and reliable service, or compliance with legal obligations.

How your content is shared

• Trip content is visible to the participants of that trip. Documents and checklist items support per-item visibility (everyone / selected people / only you).
• Anyone with an active trip invite link or 8-character code can see a limited preview: trip title, description, dates or planned duration, cover image, participant count, and the creator's nickname. They can then request to join the trip.
• If you enable live location sharing inside a trip, your location is broadcast to that trip's participants only while it is turned on; it is not stored on our servers.
• We do not sell your data or share it with third parties for marketing.

Where data is stored

Account, profile, and trip data are stored with Supabase (our backend platform: database, file storage, authentication). Uploaded documents live in private storage accessible only to the people your visibility settings allow. Transport is encrypted (HTTPS).

Third-party services

Some features send limited data to external services, only as needed to provide the feature:

• Google Maps Platform — map display, place search, and directions send your queries and relevant coordinates to Google (Google Privacy Policy).
• Apple Weather (WeatherKit) — trip destination coordinates are used to fetch forecasts.
• Unsplash — cover-photo search terms are forwarded to Unsplash via our backend.
• AeroDataBox — flight number and date are forwarded via our backend to look up schedules.
• Exchange Rate API — currency rates are fetched; no personal data is sent.
• Apple App Store — subscription purchases are processed entirely by Apple; we never receive your payment details. Website download buttons ask Apple for the product page associated with iTravel's bundle identifier.
• Google Gemini — when you use the AI assistant, the text, selected places, and images you submit, plus relevant trip-planning context, are sent through our backend to Google to produce a response. iTravel does not store AI conversation content in its own database; recent conversation history is stored locally on your device.
• Email delivery provider — your email address and verification email are processed to deliver account verification messages.

These providers may process information in countries outside your own. We use providers that offer contractual and technical safeguards appropriate to the service they provide. Their own retention practices may also apply.

Data retention & deletion

Account and profile data are kept while your account exists. When you delete your account in the app (Profile → Delete Account), your authentication account, profile, avatar, private activities, and private or restricted documents are removed. A trip with no other participant is deleted; a collaborative trip is transferred to another participant so their shared plan is not destroyed. Shared team documents may remain with that trip, and expense amounts and settlement history may remain with your identity anonymised. Travel-data quota records are retained for 30 days; other security, notification, moderation, and operational records are kept only as long as needed for their stated purpose. Providers may retain records for their own security, legal, or operational periods.

Your choices and rights

You can update profile information and delete your account inside the app. Depending on where you live, you may also have rights to access, correct, delete, restrict, object to, or receive a portable copy of your personal data, and to withdraw consent where processing relies on consent. Contact us to make a request. You may also complain to your local data-protection authority.

Children

iTravel is not directed at children. You must be at least 13 to use it and, where local law requires a higher age or parental consent, meet that requirement.

Changes

If this policy changes materially, the updated version will be posted here with a new effective date.

Contact

Questions or requests: haoboxx@icloud.com