Privacy Policy

This policy explains what TravelLog collects, why, who it is shared with, and the choices you have. TravelLog is a personal trip logger with optional shared trips, optional (off-by-default) location suggestions during a trip, and an AI trip planner. It covers the TravelLog app on iPhone, iPad and Android and our website (travellogapp.web.app, which hosts these pages and shared-trip links). It is also our notice at collection: the categories we collect, why, and how long we keep them are set out below (Sections 2, 6 and 10).

1. Who we are

TravelLog ("we," "us," "the app") is operated by an independent individual developer based in New York, United States. The app is available on iOS and Android and uses Google Firebase as its backend.

Controller. The controller of your personal data (the person responsible for deciding how it is used) is John Armgardt, who operates TravelLog. Contact for all privacy matters, including exercising your rights: armgardtj@outlook.com. He is also the person in charge of the protection of personal information (privacy officer) for the purposes of Canadian law, including Quebec's Law 25, and of other laws that ask for one.

Where TravelLog is offered. The app is offered in the United States and many other countries, including Canada, Australia, New Zealand, South Africa and Brazil. It is not offered in the EU/EEA, the United Kingdom or Switzerland.

2. What we collect and why

We collect only what the app needs to do what you asked it to do. Much of your data never leaves your phone (see Section 4).

Data you create

• Trip content — trips, itineraries, day notes, activity notes, destinations, and dates. Used to build and back up your trips.
• Expenses — amounts and labels you add to a trip. Used to show your trip spending.
• Wishlist — places you want to go and your freeform notes about them. Private to you.
• Profile — your @handle, display name, bio, and avatar, which may be a photo you choose (and a hometown, if you entered one in an earlier version of the app; it is no longer shown). Your profile is how other people find and recognize you, so it can be viewed by anyone signed in to TravelLog, not only by your friends. It also shows how many friends you have — and, if your "Who can see my friends" setting allows it, who they are (see Section 8) — and, to each viewer, only the trips your sharing settings let that person see, with the number of those trips and of the cities on them; a Private trip is never listed or counted for anyone but you. The app asks you to choose your @handle and display name when you create your account, and you can change either at any time in Edit Profile. Signed-in users can find you in people search by your @handle or display name; search shows only your display name, @handle and avatar (never your email or anything else), and people you've blocked, or who have blocked you, don't see each other there. Your trips, wishlist and everything else stay private.
• Social / user-generated content — friend requests, your friend graph, and comments you post on trips. Used to power shared trips and social features. Your friends list (each friend's display name, @handle and avatar) can be opened from your profile by your friends, by default; you can widen that to everyone signed in or narrow it to only you. People you've blocked, or who have blocked you, never see your list, and you never appear in theirs.

Location

• Off by default, and asked per trip. Trip tracking is off for every trip — trips you create, trips you join from someone else's share, and trips restored from a backup or sync. When a trip's dates begin and you haven't answered for that trip yet, the trip's Trip tracking card asks you once to choose Off, Suggest or Auto-log. If the app is in the background and you allow notifications, you may get one ordinary notification with the same question instead. Your answer is remembered for that trip on your device. Only if you choose Suggest or Auto-log does the app explain how it uses location and ask your device for location permission (on Android, background location is requested separately, behind its own explanation). Trips that existed before September 25, 2026 were switched off by that update, so you are asked again.
• What it records — precise location (GPS), including in the background, only while tracking is on for a trip and only inside that trip's window: from the trip's first day until six hours after the later of the end of its last day or its last itinerary entry, ending earlier when you arrive within about 500 m of the home place you saved. It does not run between trips, and it stops on its own when the window closes — you do not have to open the app.
• What location is used for — the complete list:
  1. suggesting places you stopped during the trip ("did you visit here?"), and — only if you chose Auto-log for that trip — marking matching planned entries as visited at the times you were there (with Suggest, the plan is never changed without your tap);
  2. on Android, the distance you travelled on a trip, shown in Stats, Wrapped and your Profile (iPhone and iPad keep no location trail, so they don't measure distance);
  3. flight-delay notes — comparing your most recent recorded location with a flight's departure airport to tell you, for example, that you still seem to be at the airport;
  4. if you have already granted location permission, using the location your device has already cached to rank place-search results near you (this never asks for permission and records nothing).
  Location is not used for anything else. It is not used for advertising (see "Google AdMob" in Section 3 for the coarse, IP-based location the ad network derives on its own) and it is never sold.
• Raw location points (Android). On Android the app keeps the individual GPS points it records on your device only. They are never uploaded, never included in a shared trip, an export or a device backup, and they are deleted automatically 7 days after the trip's tracking window closes — and immediately when you turn tracking off for that trip. Before they are deleted, the app keeps only the trip's total distance travelled (a single number) for your stats. On iPhone and iPad no raw location trail is stored at all: the app uses iOS visit monitoring and keeps only the stops it detects.
• Detected stops. The "did you visit here?" suggestions stay on your device. When you accept one, it becomes an itinerary entry and is synced like the rest of your trip (see Section 4). Stops at or within 150 m of your saved home place are never suggested.
• Health-related places and places of worship are never suggested or stored. If Google identifies a detected stop — or a place in a Google Timeline file you import — as a health-related place (for example a hospital, doctor, dentist or dental clinic, pharmacy or drugstore, physiotherapist, chiropractor, medical lab or clinic) or as a place of worship (a church, mosque, synagogue, Hindu or Buddhist temple, Shinto shrine or other place of worship), the app discards it: it is not suggested, not named and not stored. This filter applies only to automatic suggestions — you can still add any place, including these, to your itinerary yourself, and places you add are your own content and are kept as you wrote them.
• Naming a stop. To give a detected stop a real name instead of a pair of numbers, the app sends that stop's coordinates (never the trail) to Google Places through our own server, which holds the Google API key and does not log the coordinates, and to your device's geocoder (Google's on Android, Apple's on iPhone and iPad) to find its street address. The same lookup can happen once more when you accept a suggestion, so the visit can be counted towards a city in your stats.
• Searching for your home place sends what you type to Google so we can find it. The coordinates we save for it stay on your device and are excluded from device backups.
• Turning it off. You can switch any trip to Off at any time from the trip's tracking control (Off / Suggest / Auto-log). On Android the ongoing tracking notification also has a Stop for this trip button. You can also turn location off for the whole app in your device settings.

Importing your Google Timeline

If you choose to import a Google Maps Timeline export, the file you pick is read on your device and never uploaded to us. To turn its points into named places, the coordinates of each stop are sent to Google (the device geocoder and the Google Places API). Everything imported stays as a suggestion until you accept it. Places Google identifies as health-related places or places of worship are discarded, as described above; you can still add any of them yourself.

Photos

• Photos you attach to a trip entry, and receipt photos you attach to an expense, are uploaded to our storage backend (Google Firebase Storage) and the entry stores a link to the uploaded copy. This is what lets your photos appear on your other devices and for the people you share a trip with.
• Anyone signed in who has the link to a photo can open it, and people you have shared a trip with can see the photos on that trip. Photos are not included in a public share link.
• If you use receipt scanning, or import a booking from a screenshot, that image is sent to Anthropic to be read (see section 3). It is used to answer that request and is not used to train their models.
• Removing a photo from an entry removes it from your trip. Deleting your account removes your trips, the links to your photos (including in trips other people own, where your photos disappear from the entries and the trip's gallery), and the uploaded photo files themselves.

Identifiers and technical data

• Account identifier — a Firebase user ID (uid) created when you sign in.
• Push token — a Firebase Cloud Messaging token, used to deliver friend and shared-trip notifications if you enable them.
• Advertising identifier — on the free tier, Google AdMob uses your device advertising ID (Android Advertising ID, or on iPhone and iPad the Apple IDFA — only if you allow tracking when iOS asks) to show ads. On Android, AdMob may also use Google's Privacy Sandbox ad APIs (Topics and attribution reporting) provided by the operating system. Pro removes ads.
• Purchase state — whether you have an active Pro subscription, used to unlock Pro features and remove ads. Payment is handled entirely by the App Store or Google Play; we never receive your card details. We receive your subscription status and the store's purchase identifier, which we record so the same subscription cannot be redeemed on two accounts (see Section 7).
• AI usage counters — when you use an AI feature, our server records how many AI requests you made, the number of AI tokens they used and their cost, per feature, for the current day and month. This never includes what you asked or what the AI answered. It is used only to apply fair-use limits (for example a monthly AI allowance).
• Diagnostics — crash and stability data via Firebase Crashlytics (crash reports, a Crashlytics installation ID, device model and OS version, and the app screen or upload path involved), used to find and fix bugs.

Where the data comes from

• You — everything you type, choose or upload.
• Your device — location (only for trips you track), identifiers, and crash and device information, collected automatically as described above.
• Apple or Google, when you sign in with them — your name, email address and a provider user ID.
• The App Store or Google Play — your subscription status and purchase identifier.
• Other TravelLog users — for example when someone invites you to a trip, sends you a friend request, comments on a trip you're on, or lists you as a companion.

Automatic content filter

Comments, public trip links and text returned by the AI features are checked by an automatic word filter for clearly objectionable content (for example slurs, threats or explicit sexual content). Matching content is removed or not published without a person reviewing it first. If you think something was removed by mistake, email armgardtj@outlook.com and a person will review it. We do not make any other decisions about you based solely on automated processing, and we do not profile you.

3. Who else receives data (third parties)

To make features work, some data is sent to the services below. Each receives only what that feature needs, and only to carry out the feature you asked for.

We do not sell your personal data for money. Showing personalised ads through Google AdMob may count as "sharing" personal information for cross-context behavioural advertising under California and some other US state laws; you can opt out at any time in Settings → Privacy → "Do not sell or share my personal information" (see Section 10). Data sent to Anthropic is used to serve your request and is not used by us to build advertising profiles. Each provider processes data under its own privacy terms. We require every third party that receives your data to provide the same or equal protection of your data as described in this policy.

Service providers and AI processing

The following features send content you provide to Anthropic (the maker of Claude), which processes it on our behalf, as our service provider, solely to fulfil that request. Nothing is sent unless you use the feature:

• AI trip planner (plan, infer from past travel, or refine a trip) — the destination, dates, interests, and answers you tap, plus the trip being refined and, in "infer" mode, a summary of your past trips.
• Explore suggestions — the destination and trip context used to suggest places.
• Receipt scanning — the receipt photo you choose to scan.
• Booking import from a screenshot or pasted text — the screenshot image or the confirmation / route text you paste.
• Forwarded-email import — the body and attachments of a confirmation email you forward to your TravelLog inbox address.

Anthropic's API terms state that data submitted through the API is not used to train its models. Anthropic keeps API inputs and outputs only for a limited period set out in its terms, for abuse and safety monitoring, and longer only where a request is flagged under its usage policies or the law requires it; we do not store the raw prompts server-side beyond the result written back to your trip. See Anthropic's commercial terms and privacy center.

Other disclosures

• Other TravelLog users you choose — people on a trip you share, friends, and anyone who opens a public link you create, as described in Section 4. Your profile (display name, @handle, avatar, bio and friend count) can be seen by anyone signed in to TravelLog; the trips on it, and their trip and city counts, follow each trip's sharing setting; who your friends are follows your "Who can see my friends" setting (friends only, unless you change it).
• When the law requires it — we may disclose data if required by a valid legal process (such as a court order or subpoena), or where needed to protect someone's safety or to defend legal claims.
• If TravelLog changes hands — if the app is ever sold or transferred, your data may pass to the new operator, who must keep treating it as this policy describes.

We do not disclose personal information to third parties for their own direct marketing. (California residents may ask about this under California Civil Code §1798.83; the answer is that there is nothing to report.)

4. Where your data lives

On your device only (never uploaded): the raw location points recorded during a trip (Android only, and only until they are deleted — see Section 6), the "did you visit here?" suggestions you haven't accepted, and your home location. None of these are in your account, in any backup or in Export all my trips. The coordinates of an individual detected stop are sent to a geocoder and to Google Places to name it; the trail itself is not.

Synced to your account (Firebase): your trips, itinerary, expenses, and profile — so you get them back when you sign in on another device. Personal entries, and entries created from a suggestion you accepted, stay visible only to you, even on a shared trip. If you use Auto-log (or tap "Mark visited") on a planned entry of a shared trip, the people on that trip see it marked visited with the times you were there. Your wishlist and its notes are private to you.

Shared only when you choose: only trips you explicitly share are visible to the people you add, and only the base itinerary. Nothing is public unless you create a public link yourself. A public link carries the trip's name, dates and itinerary, your display name and the names of anyone you listed as a companion. For a companion who has joined the trip with their own TravelLog account, it also carries their @handle and account ID, so people viewing it in the app can open their public profile; never their email or anything else from their account. A shared view (public link or friends) never carries anything tracking observed: an entry whose times came from tracking shows its planned time if one was recorded and otherwise no time, and "visited"/"completed" status is never published. It never includes coordinates or street addresses. Public links created from this version of the app never include booking confirmation numbers or map coordinates; if you published a link before September 2026, revoke and re-create it under Settings → Privacy & Data → Manage public links to remove those fields.

5. How we protect your data

All traffic between the app and our backend, and between our backend and the services listed above, uses HTTPS/TLS. Your cloud data is stored in Google Firebase and is encrypted at rest by Google. Access is enforced by server-side security rules: your profile's private data, your wishlist, your backups and your personal trip entries are readable only by your own signed-in account, and a shared trip is readable only by the people you invited. Photos are stored under unguessable URLs that only you and the people you share a trip with receive. Our third-party API keys are held in Google Secret Manager and never ship inside the app.

No system is perfectly secure, and we cannot guarantee that data will never be accessed without permission. If a security breach affects your personal information, we will notify you and the relevant authorities as the law requires.

6. Retention

• Raw location points (Android only; kept on your device only) — deleted automatically 7 days after the trip's tracking window closes, and immediately when you turn tracking off for that trip. The app keeps only the trip's total distance travelled. iPhone and iPad keep no raw trail.
• Suggestions you haven't accepted (pending or dismissed; on your device only) — until you delete the trip, sign out/delete your account (Android), or remove the app.
• Accepted places and other itinerary entries — until you delete them, the trip, or your account.
• Home place — on your device until you clear it, sign out, or remove the app.
• Account data (including uploaded photos) — for as long as your account exists. Account deletion is processed immediately in-app (Section 7): the deleteUserAccount cascade removes your cloud data and your sign-in account in a single run.
• Server logs that may contain your account identifier — kept by our hosting provider for up to 30 days, then deleted automatically.
• Crash reports — kept by Firebase Crashlytics for up to 90 days, then deleted automatically. They are tied to a Crashlytics installation ID, not to your account, so they are not part of account deletion.
• AI usage counters — only the current day's and month's counts are kept (each new period replaces the last); deleted with your account.
• Push tokens — until your device replaces them or you delete your account.
• Abuse reports and moderation records — reports you file or that are filed about your content, and records of comments removed by the automatic filter (your account ID, the reason, and a one-way fingerprint of the text, not the text itself), are kept after account deletion for as long as we need them for safety.
• Purchase record described in Section 7 — kept after account deletion, because a store purchase can be presented again at any time.
• Copies held by our providers — data you delete may remain for a limited time in our hosting provider's internal backups until they are overwritten on its schedule. Data held by Google AdMob and by Anthropic is kept under their own terms (Section 3).

We keep nothing else about you once the periods above end.

7. Deleting your account and data

You can delete your account at any time in the app: Settings → Privacy & Data → Delete my account. This runs a server-side cascade that permanently deletes:

• Your profile and @handle
• Your cloud trips, backups, and the photos you uploaded
• Any public links you created
• Your friends, friend requests, block list, and trip invites
• Your push tokens, wishlist, and forwarded-email booking imports
• Your sign-in account

Shared trips you own are deleted for everyone on them. Trips saved only on your device are not part of the cloud deletion. On both Android and iPhone/iPad the app erases its local copy from that phone when you delete your account, along with your location data and saved home place. Use Settings → Privacy & Data → Export all my trips first if you want to keep them. Abuse reports and purchase records may be retained as described on the deletion page. This cannot be undone.

A record of any purchase you made is kept so the same subscription cannot be redeemed on two accounts at once. It holds a one-way fingerprint of the store's purchase identifier, the product, the platform, the dates it was recorded and released, and the ID of the deleted account — never your name, email or payment details. When you delete your account, the record is released from it, so if you sign up again you can restore the same subscription on your new account. Deleting your account does not cancel a subscription: cancel it in the App Store or Google Play if you no longer want to be billed.

If you cannot access the app, you can request deletion by emailing armgardtj@outlook.com from the email associated with your account. See our account deletion page for details.

8. Your choices

• Location — tracking is off unless you turn it on for a trip. Switch any trip to Off at any time (or use "Stop for this trip" on the Android tracking notification), or revoke the location permission in your device settings. Turning a trip off also deletes that trip's raw location points.
• Who can see my friends — in Settings → Privacy choose Friends (the default), Everyone, or Only me. It decides who can open your friends list from your profile; your friend count still shows.
• Notifications — toggle friend and shared-trip alerts in Settings, or revoke the notification permission.
• Ads — turn on "Do not sell or share my personal information" in Settings → Privacy (signed in or not; the setting stays on this device) so ads are no longer personalised using your data; where Google shows a privacy message for your region, "Privacy choices" in the same place reopens it. You can also upgrade to Pro to remove ads.
• Export — export a trip, or all your trips, to a file from Settings → Privacy & Data. Exports contain your trips, entries, expenses and notes; they do not include raw location points, which are temporary and deleted as described in Section 6.
• Correct your data — edit your profile, trips and other content in the app at any time, or email us.
• Do Not Track and Global Privacy Control — the app has no web browser, so it does not receive browser signals such as Do Not Track or Global Privacy Control; use the in-app "Do not sell or share my personal information" setting, or email us, to opt out. Our website sets no cookies and runs no analytics or ads.

9. Age requirement

TravelLog is intended for adults. You must be at least 18 years old to create an account, as set out in our Terms, and the app is not directed to children. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us data, contact armgardtj@outlook.com and we will delete it.

10. Your rights, legal bases and international transfers

Your rights

Depending on where you live, you may have the right to:

• know whether we process your personal information, and access it (including the categories of data, its sources, why we use it, and the categories of third parties — or, where your law requires, the specific third parties — we disclose it to);
• correct inaccurate data;
• delete your data;
• receive a portable copy of the data you gave us;
• opt out of "sharing" for cross-context behavioural advertising (targeted advertising), of any sale (we do not sell), and of profiling (we do not profile you);
• object to or restrict processing, and withdraw consent where we rely on it (for example per-trip location tracking) — withdrawing does not affect processing that happened before, and the only consequence is that the feature that needed it stops working;
• be told about, and ask a person to review, a decision made solely by automated processing (see "Automatic content filter" in Section 2);
• not be discriminated against for exercising any of these rights — you will not be denied the service or charged a different price for doing so.

How to exercise them. Many rights can be used directly in the app: Settings → Privacy & Data (export your trips, delete your account), Settings → Privacy ("Do not sell or share my personal information"), and editing your profile and trips. For anything else, email armgardtj@outlook.com, or use the account deletion page.

Verification. To protect your data, we verify requests before acting on them — normally by asking you to send the request from the email address on your account, or to confirm it in the signed-in app. We use what you give us for verification only for that purpose. If we cannot verify you, we will tell you why.

Authorised agents. Where your law allows, someone you authorise may make a request for you. We may ask for your signed permission and to verify your identity directly with you, unless the agent holds a valid power of attorney.

Response time. We respond within the time your law requires — generally within 30 days, or 45 days under most US state laws. Where the law allows an extension, we will tell you within the original period and explain why.

Appeals (US states). If we decline to act on your request, you can appeal by replying to our decision or emailing armgardtj@outlook.com with "Appeal" in the subject. We will respond in writing within the time your state's law requires (at most 60 days) and explain our decision. If you disagree with the outcome, you can contact your state attorney general.

California and other US states

This table describes the personal information we have collected in the past 12 months, in the categories California law uses. Sources are described in Section 2 ("Where the data comes from"); retention is in Section 6.

We do not collect protected-classification characteristics, biometric information, professional or employment information, or education information, and we do not create inferences or profiles about you.

Selling and sharing. We do not sell personal information and have not sold it in the past 12 months. On the free plan, Google AdMob may use your advertising ID and IP-based coarse location to show personalised ads, which California and some other US state laws may treat as "sharing" for cross-context behavioural advertising (or "targeted advertising"). You can opt out at any time in Settings → Privacy → "Do not sell or share my personal information": when it is on, every ad request tells Google to apply restricted data processing, so your data is not used to personalise ads (you still see ads on the free plan, and Pro removes them). Where Google shows a US state privacy message, you can also change your choice under "Privacy choices" in the same section. We do not knowingly sell or share the personal information of anyone under 16 (and the app is for adults only — Section 9).

Sensitive personal information. Precise geolocation is "sensitive personal information" under the CPRA and similar state laws. We collect it only when you turn tracking on for a trip, and use it only to provide the features you asked for (the list in Section 2). We do not sell it, do not share it for cross-context behavioural advertising, and do not use it to infer characteristics about you. Because we use sensitive personal information only for these permitted purposes, the right to limit its use does not apply, and we do not offer a separate "Limit the use of my sensitive personal information" link.

Consumer health data (for example under Washington's My Health My Data Act, Nevada SB 370 or Connecticut law): TravelLog does not collect consumer health data. Location is never used to identify health-related visits; places Google identifies as health-related are discarded and never suggested or stored, as described in Section 2.

Religious beliefs: location is never used to infer your religion; places Google identifies as places of worship are discarded from automatic suggestions and never suggested or stored, as described in Section 2. You can still add any place yourself.

Canada (including Quebec)

We collect and use your personal information only for the purposes described in this policy, with your consent. Using the app with an account is consent to the processing needed to provide it; for optional uses (per-trip location tracking, notifications, personalised ads) we ask separately, and you can withdraw consent at any time as described in Section 8. Location tracking is off by default. You have the right to access and correct your personal information and to withdraw consent; contact our privacy officer (Section 1). Your data is stored and processed outside Canada, mainly in the United States (see "International transfers" below), where it may be accessible to courts and authorities under local law. If you are not satisfied with our response, you can complain to the Office of the Privacy Commissioner of Canada, or, in Quebec, to the Commission d'accès à l'information (or to your provincial privacy commissioner where one applies).

Australia and New Zealand

Your personal information is disclosed to and stored by overseas recipients — our providers in the United States and other countries where they operate (Section 3). You can ask to access or correct your information at any time. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner or New Zealand's Office of the Privacy Commissioner.

South Africa

You can ask to access or correct your personal information, and object to its processing. If you are not satisfied with our response, you can complain to the Information Regulator (inforegulator.org.za).

Brazil

Under the LGPD you have the rights listed above, including confirmation that we process your data, access, correction, anonymisation, blocking or deletion of unnecessary data, portability, information about who we share it with and about the consequences of not giving consent, and withdrawal of consent. You can also complain to the Autoridade Nacional de Proteção de Dados (ANPD). The legal bases we rely on are below.

Legal bases

Where the law requires a legal basis for processing (for example Brazil's LGPD), we rely on the following:

International transfers

TravelLog is operated from the United States, and your data is stored in the United States. Our providers — including Google (Firebase, Places, AdMob) and Anthropic — process data in the United States and other countries. Wherever you live, your data is therefore transferred to and processed in countries whose data-protection laws may differ from yours. We send each provider only what the feature you use needs (Section 3). If you used TravelLog in the EU/EEA, UK or Switzerland before it was withdrawn there, transfers from those places rely on the EU-U.S. Data Privacy Framework (and its UK and Swiss extensions) where the provider is certified, and otherwise on Standard Contractual Clauses in the provider's data processing terms; you can also complain to your local data protection authority.

Anywhere else

If you live somewhere not listed above, you have the rights your local law gives you, which you can exercise as described in this section, and you can complain to your local data protection authority.

11. Changes to this policy

We may update this policy. Every change is reflected by a new "Last updated" date at the top of this page. If a change would let us use data we have already collected in a materially different way, we will ask for your consent first where the law requires it.

12. Contact

Questions or requests: armgardtj@outlook.com.