Your data

Your email, display name, and the 6-digit codes we email to sign you in — there is no password.

So you can get into your account securely, with no password that could ever leak.

Stored with Supabase (EU). Sign-in codes and your IP address are kept only as scrambled hashes, never in the clear. Codes are emailed through Resend.

Kept while your account is active. Sign-in codes are one-time and expire within minutes.

Every pin, map, trip and note — plus any travel documents or booking PDFs you upload.

It's your content: saving, planning and sharing it is the whole app.

Supabase (EU); uploaded files live in Supabase Storage.

Kept while your account is active.

Four things can read your device location, and only when you tap them. "Use my location" ranks saved places entirely on your device. "Show my location" adds a marker to the open CityMap on your device. A "near me" Magic Search sends your coordinates in that one search request. The visit bonus sends them once to check whether you are within 250 m of a place.

So saved places can rank by your city, you can see yourself on an open CityMap, a "near me" search can look around your real position, and confirming a real visit can earn a bonus Magic Search.

Nowhere for the local ranking chip or CityMap marker. A "near me" search sends the coordinates to our EU server and, when a provider lookup is needed, to Google Places as a one-time location bias. The visit check sends them once to our EU server for the comparison. Neither network path writes the coordinates to our database.

Not stored. We keep no location history — search keeps only the places you choose, and a successful visit check records only that the place earned its bonus.

Which screens and actions get used (product analytics), plus how fast pages load (Speed Insights).

So we can see what to fix and what feels slow.

PostHog, Google Analytics and Vercel process it — Google Analytics runs cookie-free with your IP anonymized. We never sell it and never show ads.

Held by those providers under their own retention.

When you paste a link or message a bot, we send that link's content — its caption, images or audio — to reading services to pull out the real places. We never send your name, email or account id.

That is how Magic search turns a link or a chat into pins on your map.

Apify opens the link, Google Gemini reads the text and images, and Groq (Whisper) transcribes audio. The bots run on WhatsApp, Telegram and Instagram.

We keep only the places we extract; each provider keeps what it processes under its own policy.

The travel style you pick — your vibe, pace, budget and interests (your Travel taste).

So Magic search sorts places for your taste instead of showing one generic top list.

Supabase (EU); visible only to you — never shared and never sold.

Kept until you change or clear it, or delete your account.

When you buy Premium on the web, Stripe — as the seller of record — handles your name, billing address, card and tax. We never see or store your card number.

To take payment, calculate tax and send you receipts.

Stripe (web) or Apple (App Store). From them we only get your subscription status and the billing alerts we need to run your account.

Stripe keeps invoices for as long as tax law requires.

Direct messages to friends, your friend connections, and stories — a photo or video shown to friends for 24 hours, then kept privately in your own archive. You can block or report anyone.

So you can plan and share trips with the people you travel with.

Supabase (EU); story media lives in Supabase Storage.

Stories are friend-visible for 24 hours, then private to you; everything is removed when you delete your account.

When something breaks we log a technical error report (what failed and on which screen) and a minimal activity log (which screens and actions). Your notes and passwords are never in it.

To find and fix crashes and keep the app reliable.

Supabase (EU); Sentry processes the limited technical crash diagnostics.

Deleted automatically once older than 90 days.

You can download a copy of your data as a file, or schedule your whole account for deletion.

It's your data — you can take it or remove it whenever you want.

Export is a file you download. Deletion runs on our servers.

Deletion has a 30-day undo window — sign back in before then to cancel. Card-subscription renewals stop as soon as you request deletion (your paid time runs to the period end); after the window a daily job cancels any remaining billing and permanently removes your account, content and files.