Privacy Policy

1. Information We Collect

• Account details: name, email, phone number (if provided), date of birth (used to verify minimum age and personalise recommendations), and optional profile fields. A unique user ID is generated when you create an account. If you sign in with Apple and choose “Hide My Email,” we receive an Apple-provided private relay address; revoking access in your Apple ID settings will disable your account’s login.
• Authentication providers: we support email/password, Sign in with Apple, and Google sign-in. Authentication tokens are stored in your device’s secure keychain.
• Usage data: app sessions, screens viewed, routed destinations, AI prompts you submit, credits consumed, device type, OS version, app version, language, and pseudonymous device identifiers. Used for service operation, analytics, and abuse prevention.
• Purchase data: subscription state and entitlement records returned by Apple App Store or Google Play (managed via RevenueCat). We do not receive your full payment card details — billing is handled by Apple or Google.
• Location inputs: searches, map selections, or manually entered places used to generate walking tours or road trips.
• Foreground location (optional): when granted, used to show tours near you, provide turn-by-turn walking and driving guidance, and personalise nearby recommendations.
• Background location (optional): when granted, used to trigger location-based audio narration during an active audio tour. You can disable this at any time in your device settings or in Settings → Privacy.
• Photo library access (optional): we read GPS metadata (EXIF data) from photos you choose so you can tag visited places on your Scratch Map and so you can attach a photo to your profile or a safety report. We do not upload or scan photos automatically — only photos you explicitly select are processed, and only the embedded coordinates are stored from Scratch Map auto-detection.
• Microphone & speech recognition (optional): when you tap the voice-input button to describe a trip or add an attraction, your microphone is activated for the duration of that recording. Audio is transcribed using your device’s built-in speech recognition (Apple Speech or Google Speech, depending on platform). We do not record continuous background audio, we do not store the raw audio, and the microphone indicator on your device will be visible while recording is active.
• Push notifications (optional): if granted, used for friend requests, trip reminders, audio tour ready alerts, and important service announcements. Manage in Settings → Notifications or your device settings.
• Social graph: usernames, friend relationships, friend requests, blocks, and shared collection memberships you create within the app.
• Trip content you create: walking tours, road trips, saved attractions, bucket-list items, journey notes, expense entries (amount, currency, category, date, optional notes), and any photos or content you upload. Content placed in a shared collection is visible to other members of that collection.
• Safety reports (optional): if you submit a safety concern, we store the location, your description, and an optional photo. Reports may be reviewed manually and aggregated to improve route quality. We may share reports with relevant authorities if required by law.
• Crash & performance data: device model, OS version, app version, stack traces, and breadcrumbs collected via Sentry when an error occurs. Sentry session replay is enabled around errors only; replays mask all text and images so personal content is not captured.
• Audio playback: the app plays AI-generated audio narration. Playback events (start, pause, completion) are stored to manage your tour progress.
• Waitlist & website (itineru.app): when you join the waitlist we store the email address and consent you provide. To tailor the page, we may use your approximate location (city and country) derived at our CDN edge by Cloudflare from your IP address; this is used only to personalise what you see (for example, suggesting your city) and is not stored or used to track you. Any destination or interest you optionally pick is used only to send you a sample itinerary by email and is never required.

2. How We Use Data

• Generate AI walking tours, road trips, audio narration, and stats such as Scratch Map progress and visited countries.
• Operate social features: friend requests, shared trip collections, and profile visibility controls.
• Calculate and display safety advisory information for destinations and routes.
• Manage subscriptions, entitlements, credit allowances, and billing receipts via Apple, Google, and RevenueCat.
• Troubleshoot performance issues, diagnose crashes, improve AI quality, and detect abuse, fraud, or spam.
• Send transactional notifications (e.g., route readiness, friend requests, credit warnings) and, if you opt in, occasional product updates.
• Comply with legal obligations and respond to valid requests from law enforcement.

3. Location, Social & Sharing Controls

• Location is only accessed when you submit a search, request directions, start an audio tour, or explicitly enable background location.
• Privacy settings let you toggle profile visibility, shared countries, and travel activity. Change these at any time in Settings → Privacy.
• Friends only see your Scratch Map highlights and shared activity if you grant permission. Private trips, expenses, and bucket lists are never visible to friends.
• Shared trip collections: when you accept an invite to a collection, the other members can see itineraries, attractions, and notes added to that collection. Removing yourself from a collection revokes your access but does not delete content other members have already added.
• Block & report: you can block another user from sending requests, and you can report abusive content to support@itineru.app.

4. Third-Party Service Providers

We use the following processors to operate the service. Each only receives the minimum data needed for its purpose, and each is bound by data-protection agreements where required.

• Supabase — authentication, database, file storage, realtime, and edge compute (hosted in Singapore).
• Mapbox and Google Maps Platform — maps, place search, directions, and place photos.
• Google Gemini — AI generation of itineraries, attraction enrichment, and audio narration scripts.
• OpenAI — secondary AI provider used for selected enrichment tasks. Prompts may include place names, your trip description, and preferences but never your account email or device identifiers.
• ElevenLabs and Google Cloud Text-to-Speech — voice synthesis for audio tour narration.
• Apple Speech Recognition and Google Speech Recognition — on-device or platform-provided speech-to-text for voice input.
• RevenueCat — subscription state management. Receives a pseudonymous app user ID, device identifier, and purchase metadata returned by Apple or Google.
• Apple Push Notification service (APNs) and Firebase Cloud Messaging — delivery of push notifications.
• Sentry — crash and error reporting. Receives device, OS, app version, stack traces, and a short session replay around the error with all text and images masked. Personal content is not captured.
• PostHog — product analytics. Receives events about feature usage linked to your account ID, plus your email and display name when you sign in, so we can tie product usage to a user profile, debug account-specific issues, and respect opt-outs. PostHog data is first-party only — we do not link it with data from other apps or share it with advertisers.
• Serper and other web-search providers — used server-side to enrich travel advisory and safety information. Searches contain destination names, not your identity.
• Cloudflare — static site hosting and CDN for itineru.app, terms, and privacy pages.

We do not sell or rent personal data. We do not share your data with advertisers, and we do not use your trip content to train third-party AI models.

5. Data Retention & Deletion

• Route history, Scratch Map progress, expenses, bucket-list items, and usage logs persist while your account remains active so you can revisit past journeys.
• Use Settings → Data Management to export an archive or request deletion. You can also email support@itineru.app.
• When you delete your account, your profile, trips, audio tours, expenses, bucket list, friends, push tokens, and privacy settings are queued for deletion and removed from active systems within 30 days. Encrypted backups are purged within a further 60 days.
• Content you contributed to a shared collection (and that other members have already received) is removed from your view immediately, but other members may retain copies of items they saved.
• Crash reports are retained for 90 days. Aggregated, anonymised analytics may be retained for up to 24 months to improve planning models.
• We may retain limited records (e.g., transaction logs, abuse history) where required to meet legal, tax, or fraud-prevention obligations.

6. Security

• Database row-level security policies restrict access to user records. Secrets and API keys are stored in encrypted environments.
• Authentication tokens are stored in your device’s secure keychain (iOS) or encrypted shared preferences (Android).
• We monitor for suspicious login attempts and may temporarily lock accounts if abuse is detected.
• No mobile app can guarantee perfect security — please avoid sharing your credentials or reusing weak passwords.

7. Children

• Itineru is not directed at children under 13. We do not knowingly collect personal data from anyone under 13. If we learn that a child under 13 has created an account, we will remove it promptly.
• Some jurisdictions require a higher minimum age (for example, 16 in parts of the EU). You must be at least the minimum age required where you live to use Itineru.

8. Tracking, Advertising & Cross-App Data Sharing

• Itineru does not track you across other companies’ apps or websites.
• We do not use the iOS advertising identifier (IDFA) or any equivalent on Android.
• We do not share your data with advertisers, ad networks, attribution providers, or data brokers.
• We do not show third-party advertising inside Itineru.
• Because we do not engage in any of the above, iOS does not show the App Tracking Transparency prompt for Itineru.
• First-party product analytics are off by default. You can opt in — and opt out again at any time — in Settings → Privacy → Allow analytics.

9. AI-Generated Content Notice

• Walking tours, road trips, and audio narration are produced by AI models and may include inaccuracies, outdated facts, or content that does not reflect current conditions.
• Use the in-app feedback button on any AI-generated tour or attraction to report errors. We review feedback to improve quality.
• Audio narration is synthetic speech, not a human guide. Voice samples used by our text-to-speech providers may resemble licensed performers but are not endorsements.

10. Updates & Contact

• We will notify you of material policy updates via in-app banners or email. Continued use after changes constitutes acceptance of the revised policy.
• Questions? Contact support@itineru.app or use the in-app Help Center. We respond within two business days.

11. Your Privacy Rights (GDPR & CCPA)

• Right to Access: request a copy of personal data we hold about you via Settings → Data Management or by emailing support@itineru.app.
• Right to Deletion: delete your account at any time through Settings → Data Management. Your data is removed from active systems within 30 days. Aggregated, anonymised analytics may be retained to improve AI models.
• Right to Correction: update your profile information at any time in Settings → Edit Profile.
• Right to Portability: export your route history, Scratch Map data, expenses, and account information in JSON format via Settings → Data Management.
• Right to Object / Restrict: contact support@itineru.app to object to processing or restrict use of your data for analytics or service improvement.
• Legal Basis: we process data based on your consent (account creation, optional permissions), contract performance (service delivery, subscriptions), and legitimate interests (fraud prevention, service improvement, security).
• International Transfers: data may be processed in Australia, the EU, the UK, Singapore, and the US via our service providers. These transfers are protected by standard contractual clauses or applicable adequacy decisions.
• California Residents (CCPA): you have the right to know what personal information is collected, opt-out of sales (we do not sell data), opt-out of sharing for cross-context behavioural advertising (we do not engage in this), and request deletion. Contact support@itineru.app to exercise these rights.
• EEA / UK Residents: you have the right to lodge a complaint with your local data-protection authority. Our data controller is Itineru Pty Ltd (New South Wales, Australia).