Privacy policy

1. Who we are

Tralupo is an adaptive travel-planning application for iOS. The data controller responsible for the personal data described in this policy is [LEGAL ENTITY NAME], [REGISTERED ADDRESS]. In this policy, “we”, “us” and “Tralupo” mean that entity.

You can reach us about anything in this policy, including any request about your own data, at [CONTACT EMAIL].

2. What we collect

Tralupo asks for as little as it can and still plan a trip for you. Most of it is optional, and the app tells you at the point of asking why it wants something.

Your account

Your email address. Signing in uses a six-digit code sent to your email, so there is no password to store. Your address is held by our authentication provider (see section 5) and is not copied into Tralupo’s own database — when the app needs to show it to you, it is read from your signed-in session.

Your traveller profile

Display name — what the app calls you.
Date of birth (optional) — used to pace your days. Your age is never stored: it is worked out from your date of birth at the moment a plan is generated and then discarded.
Home country (optional) — a country, not a city or an address. Tralupo never asks for, and cannot see, your location.
Questionnaire answers — your interests, preferred pace, how early you like to start, how far you like to walk, how you feel about crowds, and any needs you tell it about.
Anything you type in a free-text box, such as “anything else I should know?”

Your trips

Trip name, destination countries and cities, start and end dates, time zone, and your arrival and departure times where you provide them.
Who is travelling — the party type (solo, couple, friends, family) and the number of travellers. Not their names or details.
Per-trip answers, which can override your profile for that trip only.

What the planner produces and records

The generated itinerary — days, stops, times, and the one-line explanation attached to each stop. Because those explanations refer back to what you told us, the itinerary itself restates your preferences.
A snapshot of the inputs used for each generation, so a plan can always be traced to the answers it was built from.
A technical record of each generation, including the full text of what was sent to and returned by the AI model, plus timings and token counts. This is a debugging and quality record. Because the instructions sent to the model include your profile details, that record contains them too — see section 4.

What Tralupo does not collect

No location access. No camera, photo library, microphone or contacts access. No advertising identifier and no cross-app or cross-site tracking. No payment card details, ever. As of the date above, the app contains no analytics SDK and no crash-reporting SDK; if we add either, we will update this policy and the App Store privacy information before it ships.

3. How we use it

To plan and replan your trips — the core of the service. Your profile and trip answers are what make a plan yours rather than generic.
To keep your account — so your trips and profile are still there next time you sign in.
To operate and debug the service — investigating a failed generation, fixing a bug, improving the quality of plans.
To meet legal obligations and to protect the service against abuse.

Where the law requires a legal basis (for example under the UK/EU GDPR), we rely on performance of a contract for planning and account functions, legitimate interests for operating, securing and debugging the service, explicit consent for the needs described in section 6, and legal obligation where applicable.

We do not sell your personal information, and we do not share it for cross-context behavioural advertising.

4. AI and your data

Tralupo builds plans using a large language model operated by a third-party AI provider. This section is the detail behind that, because it is the part people most reasonably want to understand.

Which provider

Plan generation runs on Google’s Gemini models, called through Google’s API from our own backend. The app on your phone never talks to the model directly. The specific model version can change as models improve; the provider is recorded against every plan we generate.

Google’s handling of data submitted through its API is governed by Google’s own terms for the service tier we use ([GEMINI SERVICE TIER + DATA TERMS]).

How a plan is built — and what is sent where

Generating a plan happens in three steps, and they deliberately do not all see the same thing.

Planning brief. Your trip details and your answers — including your derived age, home country, party, and any needs — are sent to the model so it can work out what to research.
Research. This is the only step that reaches the open web, through the AI provider’s own search tool. It is deliberately impersonal: it asks about a destination and a date range and nothing else. Your identity, your party, your answers and even your trip name are excluded from it by design.
Composition. The research findings are combined with your profile and trip answers to write the itinerary.

The short version

Your personal answers are used privately, to shape your plan. They are not included in the web searches Tralupo performs about a destination.

What is stored afterwards

The finished itinerary is stored so you can open your trip again. Separately, we store a technical record of each generation which includes the full instructions sent to the model and its full response. That record exists so we can diagnose a bad or failed plan, and it therefore contains the profile details that were part of those instructions. Access to it is limited to people who need it to operate and debug the service.

Human review and automated decisions

Plans are generated automatically. Nobody reviews or approves your itinerary before you see it. Our staff may read stored generation records when investigating a problem or assessing plan quality, as described above.

Tralupo does not use AI to make decisions that have legal or similarly significant effects on you. A generated itinerary is a suggestion you are free to change, ignore, or delete.

Accuracy

A generated plan can be wrong. Language models can state incorrect opening hours, prices, closures and travel times, and grounding the research step in real sources reduces this without removing it. Always confirm anything that matters — tickets, closures, prices, and especially dietary, allergen or accessibility requirements — directly with the venue before you rely on it. See the terms.

We share personal data only with the providers that make the service work, and only as far as each one needs. They act on our instructions and are not permitted to use your data for their own purposes.

Provider	What it does	What it receives
Supabase	Authentication and database hosting	Your email address and sign-in codes; all Tralupo application data described in section 2
Google (Gemini API)	The AI model that writes and revises plans	Trip details and profile answers as described in section 4. The research step receives no personal data.
[API HOSTING PROVIDER]	Runs the Tralupo backend	Data in transit while a request is processed; operational logs
RevenueCat	Manages purchases and entitlements	A pseudonymous account identifier and purchase status. Never your email address.
Apple	App distribution and payment processing	Whatever Apple collects under its own privacy policy when you download the app or make a purchase. Tralupo never receives your payment details.

We may also disclose data where we are legally required to, to establish or defend legal claims, or to protect the rights and safety of users. If the business is ever transferred, your data may transfer with it, subject to this policy.

Operational logs

Our backend writes technical logs to help us keep the service up. These record the request method and path, the response status, a correlation identifier, and internal account or trip identifiers. Authorisation headers are stripped, and request and response bodies are never logged — so your answers, your plans and the AI prompts do not appear in them.

6. Dietary and accessibility needs

Tralupo lets you tell it about needs so that it can plan around them rather than leave you to work around the plan. The options include step-free access, avoiding stairs, keeping walking light, quiet places to rest, travelling with children, travelling with a pet, and dietary requirements including gluten-free, vegetarian, vegan, halal, kosher and nut allergy.

Some of these can reveal something about your health or your beliefs. Where data protection law treats that as a special category of personal data, we process it only with your explicit consent, given by choosing to tell us. Every one of these questions is optional, you can change or clear your answers at any time in the app, and clearing them stops them being used in future plans.

Because these answers shape a plan, they are also referred to in the explanations attached to your stops and appear in the generation records described in section 4. Deleting your account removes all of it.

Tralupo does not verify venues. Telling us about an allergy or an access need changes how a plan is built; it is not a guarantee that any restaurant or site actually meets that need. Always confirm with the venue.

7. What stays on your device

Some data is stored locally on your phone, not on our servers:

Your sign-in session, so you do not have to sign in every time.
A cache of your trips and profile, which is what lets you read your active plan when you have no signal. This is cleared when you sign out.
Drafts and preferences, such as a half-finished trip or your “learning from my trips” setting. Also cleared when you sign out.

Deleting the app from your device removes all of it. This website uses no cookies and no analytics; the only third-party requests it makes are to Google Fonts to load its typefaces.

8. How long we keep it

Your profile, trips and plans are kept while your account exists, because they are the service. When you delete your account they are deleted as described in section 10.

Generation records (section 4) are retained for [RETENTION PERIOD — generation records] and then deleted. Operational logs are retained for [RETENTION PERIOD — logs]. We may keep information for longer where we are legally required to.

9. Your rights

Depending on where you live, you may have the right to:

Access a copy of the personal data we hold about you.
Correct anything inaccurate — most of it you can edit directly in the app.
Delete your data (see section 10).
Port your data to another service in a machine-readable form.
Object to or restrict processing based on legitimate interests.
Withdraw consent at any time, including for the needs in section 6. Withdrawing consent does not undo processing that already happened.
Complain to your data protection authority. In the EU or UK that is your national supervisory authority; you are welcome to raise it with us first.

Residents of California and other US states with similar laws have equivalent rights to know, delete, correct and opt out, and the right not to be discriminated against for exercising them. Tralupo does not sell personal information or share it for cross-context behavioural advertising, so there is nothing to opt out of on that front.

To exercise any of these, email [CONTACT EMAIL]. We will respond within the time the applicable law allows, and we may need to verify that the request comes from you.

10. Deleting your account

You can delete your Tralupo account and everything attached to it. Deletion removes:

your traveller profile, including your name, date of birth, home country and every questionnaire answer;
every trip, with its dates, destinations and per-trip answers;
every generated itinerary; and
the generation records behind those itineraries, including the stored AI prompts and responses.

Your authentication record with our authentication provider is deleted as part of the same action. Deletion is permanent and cannot be undone.

Two things deletion does not reach. Your subscription is separate: if you have a paid subscription, cancel it through your Apple ID — deleting your Tralupo account does not cancel it and does not refund it. And Apple keeps its own purchase records under Apple’s privacy policy, which we cannot delete on your behalf.

Request deletion in the app, or by emailing [CONTACT EMAIL] from the address on your account.

11. Children

Tralupo is not intended for children. You must be at least 13 years old to use it, and older where your country sets a higher minimum age for consenting to online services on your own behalf. We do not knowingly collect personal data from children below that age; if we learn we have, we will delete it. If you believe a child has given us their data, contact [CONTACT EMAIL].

Telling Tralupo that you are travelling with children is a fact about your trip. It is not personal data about a child, and the app never asks for a child’s name, age or details.

12. Security

Traffic between the app and our backend is encrypted in transit, and data at rest is encrypted by our hosting providers. Sign-in uses one-time codes rather than passwords, so there is no password for us to lose. Every request to our backend is verified against your signed-in session, and the app has no direct access to the database. Authorisation credentials are stripped from logs.

No system is perfectly secure, and we cannot guarantee absolute security. If a breach affects your personal data and the law requires it, we will notify you and the relevant regulator without undue delay.

13. International transfers

Our providers may process your data outside your own country, including in the United States. Our database and authentication are hosted in [SUPABASE REGION] and our backend runs in [API HOSTING REGION].

Where data leaves the UK or the European Economic Area, we rely on an appropriate safeguard — an adequacy decision where one applies, or the relevant Standard Contractual Clauses with the provider. You can ask us for details of the safeguard used for a specific provider.

14. Changes to this policy

We update this policy when the app changes. The date at the top always reflects the current version. If a change materially affects how we handle your personal data, we will tell you in the app or by email before it takes effect, and where the law requires consent for that change, we will ask for it.

15. Contact us

Questions, requests, or corrections: [CONTACT EMAIL].
[LEGAL ENTITY NAME], [REGISTERED ADDRESS].

See also the terms and conditions, which cover what a generated plan is and is not.