Privacy Policy

1. Information We Collect

We only collect the data required for the app to function properly.

1.1. Account Information

• Email address
• First name, username and profile details, if you add them
• Time zone (a region name such as Asia/Dubai, so day counts and reminders follow your calendar)
• How you found us, recorded once at signup: the source, medium and campaign from the link you followed, the referring website, and whether you signed up on the web or in the iOS app

If you sign in with Google or Apple, that provider confirms who you are and shares your email address with us, and your name if you allow it. We never receive your Google or Apple password.

We use secure authentication. We do not store or access your password in plain text, and we never see it.

1.2. Passport Information

• Passport name
• Issuing country
• Expiry date
• Passport category (regular, diplomatic, etc.)

1.3. Visa Information

• Visa country
• Visa type
• Entry and exit dates
• Visa validity
• Maximum allowed stay
• Days used and remaining (calculated automatically)

1.4. Trips Data

• Country of travel
• Entry and exit dates
• Calculated days spent in each destination

1.5. AI Visa Scan (Optional Feature)

To help you extract information from visa and passport pages:

• You may upload an image of a visa or passport page.

We do not store these images. They are held in memory only while they are read, and are sent to OpenAI for text extraction. They are not kept on our servers. OpenAI states that data sent through its API is not used to train its models, and that it may keep API inputs and outputs for up to 30 days to monitor for abuse before removing them.

1.6. Profile Photo (Optional)

If you upload a profile photo, it is stored via Cloudinary. You may delete it at any time from your profile settings.

1.7. Flight Data (Optional)

• Departure and arrival airports
• Flight dates and times
• Flight numbers (optional)

1.8. City & Location Data (Optional)

When using the Explore map feature, you may tag:

• Cities visited, lived in, or want to visit
• City coordinates (derived from your text search input, via Nominatim)
• Photo memories pinned to cities (stored via Cloudinary)

City coordinates are stored only as entered by you. We do not track your live GPS location.

1.9. Boarding Pass Scan (Optional)

To auto-add trips from a boarding pass photo:

• You may upload a photo or PDF of a boarding pass or e-ticket.

We do not store these images. They are sent to OpenAI to read the destination and dates, under the same OpenAI terms described in 1.5. No boarding pass image is kept on our servers.

1.10. Push Notification Token (Mobile App)

If you use the iOS app and allow notifications, we store the device token Apple issues for your device, so we can send you visa and passport reminders. The token identifies the device, not you personally. It is deleted when you delete your account, and when Apple tells us the device no longer accepts notifications. We do not use it for advertising.

1.11. App Analytics

We use PostHog to understand how the app is used. This is not anonymous: it is linked to your account by an internal account number. We do not send PostHog your name or your email address.

• Account events recorded by our server, such as signing up, confirming your email, adding a visa or a trip, viewing the plans page, and starting or cancelling a subscription, together with your plan and the signup details listed in 1.1
• Page visits and device type from your browser, only if you choose "Accept" on the cookie banner
• Error reports: when the app hits an error we record the error, the page address and technical details so we can fix it. These reports are also sent to OpenAI to help diagnose the fault

We do not use this data for advertising.

1.12. AI Chat and Support Messages

If you use the AI chat, your questions and the visa, passport and trip details needed to answer them are sent to OpenAI, and your chat history is saved in your account. If you email our support address, your message may be processed by OpenAI to help us sort and answer it.

2. What We Do Not Collect

We do not collect or track:

• Live GPS location
• Contacts
• Biometric data
• Payment card numbers
• Sensitive government identifiers (unless you manually enter them)

We do not use advertising trackers.

3. How We Use Your Data

Your data is used only to deliver the app's features:

• Calculate visa days and compliance
• Track trips and travel history
• Provide country insights
• Prevent overstays
• Send visa/passport expiry reminders
• Improve app stability and user experience
• Process AI-based visa scans (without storing images)

We do not sell, rent, or share your data with advertisers or external companies.

4. Data Storage & Security

We use industry-standard security measures:

• Our database is hosted on Railway, which states that stored customer data is encrypted at rest at the storage level
• HTTPS secure connections
• Access controls
• No storage of uploaded visa, passport or boarding pass images on our servers

No system is perfectly secure, and we cannot guarantee absolute security.

5. Local Storage

To improve performance, some data may be stored locally on your device:

• Cached country insights
• App settings (theme, language, currency)
• Temporary trip data

This information stays on your device.

6. Third-Party Services

The app may interact with trusted third-party providers:

• Stripe (payments, no card data stored by us)
• OpenAI (AI scans, AI chat, support message sorting and error diagnosis, as described in 1.5, 1.9, 1.11 and 1.12)
• PostHog (product analytics, as described in 1.11)
• Google and Apple (sign-in, if you choose it, and Apple for push notifications on iOS)
• Nominatim / OpenStreetMap (turns a city name you type into map coordinates)
• Cloudinary (profile photo storage, photos stored only if you upload one)
• Airtable (internal CRM, we store your email and plan tier to manage your account)
• Resend (transactional email delivery, confirmation, reminders, receipts)
• Railway (cloud hosting and database, all app data resides here)

Each provider handles data under its own terms and privacy policy.

Our marketing website travisaro.app has an optional email list run through Kit. If you join it, Kit stores the email address you enter. That website also uses Google Analytics to count visits, set so that it stores no analytics cookies on your device.

7. Data Deletion & Retention

We keep your data only while your account is active.

When you delete your account:

• Your account, passports, visas, trips, chat history and photos are permanently erased from our database and from Cloudinary
• Any active subscription is cancelled
• Your record in our CRM (email and plan) is removed
• Scan images were never stored by us, so there is nothing to delete
• Deletion is irreversible

Analytics events already recorded in PostHog stay under your internal account number, with no name or email attached. Email hello@travisaro.app if you want those removed too, and we will delete them.

You can delete your account at any time in Settings, or by emailing us.

8. Your Rights

You can:

• Access your data
• Update your information
• Request deletion
• Ask for a data export
• Disable notifications

Contact us anytime for support.

If you are in the EU/UK (GDPR)

We process your data based on: performing our contract with you (running the app), your consent (optional features like AI scans and location tagging), and our legitimate interest in keeping the app secure and reliable. You also have the right to lodge a complaint with your local data protection authority.

If you are in California (CCPA/CPRA)

We do not sell or share your personal information for cross-context behavioral advertising, and we never have. You have the right to know what personal information we hold about you, request its deletion, correct it, and not be discriminated against for exercising these rights. Contact us to exercise any of them.

9. Children's Privacy

The app is intended for users aged 16 and older. We do not knowingly collect data from users under this age.

If you believe a child under 16 has used the app, contact us and we will remove the account.

10. International Data Transfers

Your information may be processed on servers located outside your country. We ensure all transfers comply with applicable data-protection laws (GDPR, etc.).

11. Data Breach Notification

If a security incident occurs that puts your personal information at risk, we will notify affected users by email without undue delay, and in any case within 72 hours of becoming aware of it where required by law, describing what happened, what data was involved, and what we are doing about it.

12. Changes to This Policy

We may update this Privacy Policy occasionally. The "Last Updated" date reflects the most recent revision.

13. Contact Us

For privacy questions or support: