Privacy Policy

1. Information We Collect

• Account details: name, email, and optional profile fields such as a username, phone number, or date of birth if you choose to provide them. A unique user ID is generated when you create an account. If you sign in with Apple and choose “Hide My Email,” we receive an Apple-provided private relay address; revoking access in your Apple ID settings will disable your account’s login.
• Authentication providers: we support signing in with your email address (verified with a one-time code sent to that address), Sign in with Apple, and Google sign-in. Authentication tokens are stored in your device’s secure keychain.
• AI prompts and conversations: what you type or say to Maven, the trip descriptions and preferences you submit when generating a tour or road trip, and the trip context needed to answer (destination, dates, saved stops, and, if you have allowed it, your approximate location). Please avoid putting sensitive information such as health details or payment card numbers into prompts.
• Usage data: app sessions, screens viewed, routed destinations, AI feature usage counts (used to apply the fair-use allowances and audio-minute balance described in our Terms), device type, OS version, app version, language, and pseudonymous device identifiers. Used for service operation, analytics, and abuse prevention.
• Purchase data: subscription state, entitlement records, and audio-minute purchases returned by Apple App Store or Google Play (processed through our subscription management provider). We do not receive your full payment card details. Billing is handled by Apple or Google.
• Location inputs: searches, map selections, or manually entered places used to generate walking tours or road trips.
• Precise location (optional): only when you grant the location permission, and only while a feature needs it: showing tours and places near you, fetching the weather for where you are, and turn-by-turn walking and driving guidance. Itineru does not collect your location in the background, and you can withdraw the permission at any time in your device settings.
• Photo library access (optional): we read GPS metadata (EXIF data) from photos you choose so you can tag visited places on your Scratch Map and so you can attach a photo to your profile or a safety report. We do not upload or scan photos automatically. Only photos you explicitly select are processed, and only the embedded coordinates are stored from Scratch Map auto-detection.
• Microphone & speech recognition (optional): when you tap the voice-input button to describe a trip or add an attraction, your microphone is activated for the duration of that recording. Audio is transcribed using your device’s built-in speech recognition (Apple Speech or Google Speech, depending on platform). We do not record continuous background audio, we do not store the raw audio, and the microphone indicator on your device will be visible while recording is active.
• Push notifications (optional): if granted, used for friend requests, trip reminders, audio tour ready alerts, and important service announcements. Manage in Settings → Notifications or your device settings.
• Social graph: usernames, friend relationships, friend requests, blocks, and shared collection memberships you create within the app.
• Trip content you create: walking tours, road trips, saved attractions, bucket-list items, journey notes, expense entries (amount, currency, category, date, optional notes), and any photos or content you upload. Content placed in a shared collection is visible to other members of that collection.
• Generated audio: narration files we generate for your tours are stored so you can listen again without regenerating them. Playback events (start, pause, completion) are stored to manage your tour progress.
• Safety reports (optional): if you submit a safety concern, we store the location, your description, and an optional photo. Reports may be reviewed manually and aggregated to improve route quality. We may share reports with relevant authorities if required by law.
• Crash & performance data: device model, OS version, app version, stack traces, and breadcrumbs collected by our crash-reporting provider when an error occurs. Session replay is enabled around errors only; replays mask all text and images so personal content is not captured.
• Waitlist & website (itineru.app): when you join the waitlist we store the email address and consent you provide, and Cloudflare Turnstile checks that the form was submitted by a person (it may process your IP address and browser signals for that purpose). To tailor the page, we may use your approximate location (city and country) derived at our CDN edge by Cloudflare from your IP address; this is used only to personalise what you see (for example, suggesting your city) and is not stored or used to track you. We also run Cloudflare Web Analytics on the website, which counts page views and records the referring site, country, and browser type. It sets no cookies, stores nothing on your device, and does not build a profile of you or follow you to other sites. Any destination or interest you optionally pick is used only to send you a sample itinerary by email and is never required.

2. How We Use Data

• Generate AI walking tours, road trips, Maven replies, audio narration, and stats such as Scratch Map progress and visited countries.
• Show places, weather, and directions near you or your destination.
• Operate social features: friend requests, shared trip collections, and profile visibility controls.
• Calculate and display safety advisory information for destinations and routes.
• Manage subscriptions, entitlements, fair-use allowances, audio-minute balances, and billing receipts via Apple, Google, and our subscription management provider.
• Log AI prompts and responses so we can review quality, investigate problems, and improve how the AI features work.
• Troubleshoot performance issues, diagnose crashes, and detect abuse, fraud, or spam.
• Send transactional notifications (e.g., route readiness, friend requests, allowance notices) and, if you opt in, occasional product updates.
• Comply with legal obligations and respond to valid requests from law enforcement.

3. Location, Social & Sharing Controls

• Precise location is only read when you have granted the permission and you submit a nearby search, request directions or weather, or start a tour. Nothing runs in the background.
• Privacy settings let you toggle profile visibility, shared countries, and travel activity. Change these at any time in Settings → Privacy.
• Friends only see your Scratch Map highlights and shared activity if you grant permission. Private trips, expenses, and bucket lists are never visible to friends.
• Shared trip collections: when you accept an invite to a collection, the other members can see itineraries, attractions, and notes added to that collection. Removing yourself from a collection revokes your access but does not delete content other members have already added.
• Block & report: you can block another user from sending requests, and you can report abusive content to support@itineru.app.

4. Third-Party Service Providers

We use the following processors to operate the service. Each only receives the minimum data needed for its purpose, and each is bound by data-protection agreements where required. Where we name a category rather than a company, that is to avoid publishing our full technical supply chain; email support@itineru.app and we will tell you the specific providers.

• Cloud application platform: authentication, database, and file storage. Our database is hosted in South Korea.
• AI model providers: the models behind tours, road trips, Maven, and narration scripts. They receive your prompts, trip descriptions, and the trip context needed to answer, but not your account email or device identifiers. Under our enterprise agreements, your prompts are not used to train their models. These providers process data outside Australia, including in the United States.
• AI trace logging provider: stores the prompts sent to our AI models and the responses that come back, linked to a pseudonymous user ID, so we can check quality and debug problems.
• Speech synthesis providers: voice synthesis for audio narration, including the optional premium voice. They receive the narration script, not your identity.
• Cloudflare: hosting and CDN for itineru.app, Turnstile bot protection on our web forms, and cookieless Web Analytics on the website (aggregate page views, referrer, country, and browser type; no cookies and no cross-site tracking). As our CDN, Cloudflare already handles every request to the site, so the analytics adds no new recipient of your data.
• Google Maps Platform: place search, place details and photos, and routing for Itineru+ members. Receives search text and coordinates. Google’s handling of that data is governed by the Google Privacy Policy.
• Mapbox: maps, geocoding, and directions. Receives search text and coordinates.
• OpenStreetMap data and Apple Maps: places and maps on the Explorer plan. Apple Maps runs on your device under Apple’s privacy terms; OpenStreetMap-based place lookups receive a search query and map area, not your identity.
• Weather data provider: forecasts. Receives the coordinates of your location or destination only; no account or device data.
• Web search providers: search used to enrich tours, Maven replies, and travel advisory information. Receives search queries derived from your prompt or destination, not your identity.
• Apple Speech Recognition and Google Speech Recognition: on-device or platform-provided speech-to-text for voice input.
• Subscription management provider: subscription and audio-minute purchase state. Receives a pseudonymous app user ID, device identifier, and purchase metadata returned by Apple or Google.
• Apple Push Notification service (APNs) and the Android push messaging service: delivery of push notifications.
• Crash and error reporting provider: receives device, OS, app version, stack traces, and a short session replay around the error with all text and images masked. Personal content is not captured.
• Product analytics provider: product analytics, only if you opt in (see section 8). Receives events about feature usage linked to your account ID, plus your email and display name when you sign in, so we can tie product usage to a user profile, debug account-specific issues, and respect opt-outs. This data is first-party only; we do not link it with data from other apps or share it with advertisers.
• Transactional email provider: sends our emails (for example waitlist and account emails). Receives your email address and the content of the email.

We do not sell or rent personal data. We do not share your data with advertisers, and we do not use your trip content or prompts to train third-party AI models.

5. Data Retention & Deletion

• Route history, generated audio, Scratch Map progress, expenses, bucket-list items, and usage logs persist while your account remains active so you can revisit past journeys.
• Use Settings → Data Management to export an archive or request deletion. You can also email support@itineru.app.
• When you delete your account, your profile, trips, audio tours, expenses, bucket list, friends, push tokens, and privacy settings are queued for deletion and removed from active systems within 30 days. Encrypted backups are purged within a further 60 days.
• Content you contributed to a shared collection (and that other members have already received) is removed from your view immediately, but other members may retain copies of items they saved.
• Crash reports are retained for 90 days. AI conversation logs (your prompts and the AI's replies) are retained for up to 24 months for quality and safety review, then deleted, and are deleted earlier if you delete your account. Aggregated, anonymised analytics may be retained for up to 24 months to improve the service.
• Waitlist entries are kept until launch or until you unsubscribe, and are deleted within 30 days of either.
• We may retain limited records (e.g., transaction logs, abuse history) where required to meet legal, tax, or fraud-prevention obligations.

6. Security

• Database-level access controls restrict each account to its own records. Credentials and API keys are stored securely.
• Authentication tokens are stored in your device’s secure keychain (iOS) or encrypted shared preferences (Android).
• We monitor for suspicious login attempts and may temporarily lock accounts if abuse is detected.
• If a data breach is likely to cause you serious harm, we will notify you and the relevant regulator (in Australia, the OAIC) as the law requires.
• No mobile app can guarantee perfect security. Please avoid sharing your sign-in details.

7. Children

• Itineru is not directed at children under 13. We do not knowingly collect personal data from anyone under 13. If we learn that a child under 13 has created an account, we will remove it promptly.
• Some jurisdictions require a higher minimum age (for example, 16 in parts of the EU). You must be at least the minimum age required where you live to use Itineru.

8. Tracking, Advertising & Cross-App Data Sharing

• Itineru does not track you across other companies’ apps or websites.
• We do not use the iOS advertising identifier (IDFA) or any equivalent on Android.
• We do not share your data with advertisers, ad networks, attribution providers, or data brokers.
• We do not show third-party advertising inside Itineru.
• Because we do not engage in any of the above, iOS does not show the App Tracking Transparency prompt for Itineru.
• First-party product analytics are off by default. You can opt in, and opt out again at any time, in Settings → Privacy → Allow analytics.

9. AI-Generated Content Notice

• Walking tours, road trips, Maven replies, and audio narration are produced by AI models and may include inaccuracies, outdated facts, or content that does not reflect current conditions. Always verify opening hours, routes, timings, and anything safety-related before relying on it.
• Your prompts and trip context are sent to our AI model providers to generate a response, and the prompt and response are logged with our trace-logging provider so we can review quality. They are not used to train those providers’ models.
• We do not make decisions about you using automated processing that has legal or similarly significant effects on you.
• Use the in-app feedback button on any AI-generated tour or attraction to report errors. We review feedback to improve quality.
• Audio narration is synthetic speech, not a human guide. Voice samples used by our text-to-speech providers may resemble licensed performers but are not endorsements.

10. Updates & Contact

• We will notify you of material policy updates via in-app banners or email before they take effect. Continued use after changes constitutes acceptance of the revised policy.
• Questions? Contact support@itineru.app or use the in-app Help Centre. We respond within two business days.

11. Your Privacy Rights (Australia, GDPR & UK GDPR, CCPA)

• Right to Access: request a copy of personal data we hold about you via Settings → Data Management or by emailing support@itineru.app.
• Right to Deletion: delete your account at any time through Settings → Data Management. Your data is removed from active systems within 30 days and from backups within a further 60 days. Aggregated, anonymised analytics may be retained to improve AI models.
• Right to Correction: update your profile information at any time in Settings → Edit Profile, or ask us to correct anything else.
• Right to Portability: export your route history, Scratch Map data, expenses, and account information in JSON format via Settings → Data Management.
• Right to Object / Restrict / Withdraw Consent: contact support@itineru.app to object to processing or restrict use of your data. Where processing is based on consent (for example analytics, location, or the microphone), you can withdraw it at any time in Settings or your device settings without affecting the rest of the service.
• Legal Basis (GDPR / UK GDPR): we process data to perform our contract with you (running the app, generating tours and Maven replies, managing subscriptions and allowances); with your consent (optional permissions such as location, microphone, photos, notifications, and analytics); and for our legitimate interests (fraud and abuse prevention, security, crash diagnosis, and reviewing AI quality), which we balance against your rights.
• Australian Privacy Act: we handle personal information in line with the Australian Privacy Principles. You can ask to access or correct your information, and you can complain to us about how we have handled it. We will acknowledge your complaint within a few business days and aim to resolve it within 30 days. If you are not satisfied, you can complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.
• International Transfers: we are based in Australia and our database is in South Korea. Our service providers process data in the United States, the European Union, the United Kingdom, South Korea, and Australia. Australia does not have an EU or UK adequacy decision, so transfers of EEA and UK data to us and to providers outside those regions rely on standard contractual clauses (or the UK International Data Transfer Addendum), adequacy decisions where they apply, and providers’ data-protection agreements.
• California Residents (CCPA): you have the right to know what personal information is collected, opt-out of sales (we do not sell data), opt-out of sharing for cross-context behavioural advertising (we do not engage in this), and request deletion. Contact support@itineru.app to exercise these rights. We will not discriminate against you for exercising them.
• EEA / UK Residents: you have the right to lodge a complaint with your local data-protection authority (in the UK, the ICO). The data controller is Itineru (ABN 36 330 764 188), a sole trader business registered in Australia and based in Victoria; contact support@itineru.app for our full business details.