TravelMate Privacy Policy

This Privacy Policy explains what personal data we collect, why, and what your rights are. It is incorporated by reference into the TravelMate Terms of Service.

We take your privacy seriously. TravelMate is offline-first: your trips, itineraries, schedules and the content you download for them live on your device and work without an internet connection. We don't run a profile warehouse. We don't sell data. We don't show ads. We don't track you across apps or sites.

1. Data Controller

The data controller for personal data processed by TravelMate is:

Ilia Vlasov, operating as "w4app" (sole trader), domiciled in Finland. Contact: Show email address (or Show email address)

If the Service is ever transferred to a company we set up, we will notify you and reissue this Policy under the new controller's name without reducing your protection — see Section 14.

We do not currently have a designated Data Protection Officer (DPO), as appointment is not mandatory under GDPR Art. 37 for an entity of our size and scope. We monitor this threshold; if our processing activities meet the DPO appointment criteria, we will appoint and disclose one.

2. What Data We Collect

Plain summary: location (only while you use a guide or discovery feature), your purchase/subscription status, crash diagnostics, a device token for notifications you turn on, and the trip text you type — or the images you choose to send in chat — when you ask the AI for help. That's it. No contacts, no health data, no photos from your library unless you send one in chat yourself, no advertising identifiers.

2.1 Location Data

TravelMate uses your device location to power nearby discovery, proactive suggestions, and the walking audio guide.

• Precise location (GPS) — used only inside an explicit, opt-in, foreground walking-guide session that you start. When you end the session, the app reverts to a coarse, low-power mode. On iOS, location authorization is requested as "While Using the App" (When In Use) only.
• Coarse / approximate location — a budgeted, kilometer-accuracy mode (significant-location-change and region/geofence monitoring) used while you explore, to surface nearby places and time-anchored nudges. This is optional and granted via the system location prompt.

How location is handled:

• Location is used to generate suggestions and guide narration for you. It is not linked to your identity and is never used for tracking, advertising, or profiling.
• Precise location is used only while the app is open, for the feature you are using: nearby places, the camera guide and your day's reminders. The app asks for "While Using the App" access only; there is no background location collection.
• We do not maintain a server-side location history of your movements. Precise location used by a guide session is processed to produce the guidance you requested and is not retained as a tracked trail.

2.2 Account and Subscription Data

• w4app account identifier (used to reconcile your Pro entitlement across w4app products)
• Subscription / purchase status and entitlement state (from Apple or Google via RevenueCat), including the active product (travelmate.pro.monthly / travelmate.pro.annual)
• Push-notification device token (for delivery of notifications via Apple Push Notification service (APNs) on iOS or Firebase Cloud Messaging (FCM) on Android)

2.3 Trip Content You Provide to AI Features

When you ask TravelMate to build an itinerary, narrate an audio guide, or answer a question about a place, the trip text, queries, and preferences you provide (e.g. a destination, dates, interests, or a question) are sent to our AI processor to generate the response (see Section 4). Where the app transcribes your voice into text (for a spoken query), the audio is sent transiently for transcription and is not retained on our servers after processing.

This content contains the text you choose to enter or speak. It does not include identifiers (no name, email, or account ID) at the AI-prompt layer.

2.4 Diagnostic Data

Crash and performance diagnostics, collected at the platform / billing-SDK level and via our error-monitoring tool (Sentry), to keep the app stable:

• Technical crash stack traces, device model, OS version, performance metrics
• PII-scrubbed: breadcrumbs and reports do not include your trip text or your precise location

Where this runs. Our server, its database and our media storage are on Amazon Web Services in Stockholm, Sweden (eu-north-1). Media and downloaded trip content are delivered through a content delivery network whose edge servers are worldwide, so a cached file may be served from outside the EU. Our processors are listed in Section 4; some of them, including the AI provider, are outside the EU — see Section 5.

2.5 Payment Data

We do not collect or store payment card data. Apple (App Store) and Google (Google Play) process all payments via in-app purchase. We receive only subscription/entitlement status via Apple/Google and RevenueCat.

2.6 What We Do NOT Collect

If you switch on Travel memory, the chat sends the countries and places your own photo library shows you have visited that are relevant to the trip you are planning, together with that message, so the plan can take account of where you have already been. Your photos are never sent, nothing about them is stored on our servers, and the feature is off until you turn it on.

Images you send in chat. You can send up to three images in a chat message — for example a screenshot of a booking or a ticket — so the AI can read the details. The image is sent as it is. It may show names, booking codes, document numbers and barcodes, yours and those of people travelling with you, so send only what you are happy to share, and don't send passport or ID scans: a booking doesn't need them. Before your first image the app tells you this and asks you to confirm. The app removes hidden data such as location from the image before sending it. Our server passes it to OpenAI and deletes it as soon as it has been read — it is never written to disk, a database or our logs, which record only how many images were sent and their size. OpenAI keeps requests, including images, for up to 30 days to detect abuse, then deletes them. We keep only what was read from the image and added to your trip, such as the hotel's name and address, the dates and flight numbers. The original image stays in the chat on your iPhone and is deleted with the trip or by Delete all my data.

We do not collect: contacts, health & fitness data, messages or calendar, your photo library (TravelMate never reads it for you; an image leaves your iPhone only when you attach it to a chat message yourself, as described above; see also Travel memory for the one derived thing that can leave the device, with your consent), browsing or search history, advertising or device identifiers (no IDFA, no Android Advertising ID), or any "sensitive" special-category data. We do not use App Tracking Transparency (ATT) because the app does not track.

3. How We Use Your Data

We do not use your data for:

• Selling to third parties or data brokers
• Advertising or ad targeting
• Cross-app or cross-site tracking
• Training AI models (we invoke "no-training" provisions with our AI processor where available)
• Profiling for decisions with legal or similarly significant effects (no automated decision-making under Art. 22)

4. Who We Share Data With (Sub-processors)

We engage carefully selected sub-processors. They process personal data only on our instructions and only as needed to operate the Service. The table below reflects the sub-processors used in production as of the last-updated date.

Map, place, and imagery data

TravelMate's place information comes from Wikidata, geography from GeoNames and Natural Earth, nature stops on day trips (trails, viewpoints, visitor centres and the like) from OpenStreetMap, maps from Apple, narrative and suggestions from GPT-5.5 model knowledge, and imagery from Wikimedia Commons. We use no Google Places, Google Maps, Foursquare, Yelp, Mapbox, or any other paid third-party place / imagery / map-tile vendor, and no place vendor builds a profile of you.

Two kinds of lookup do leave our servers. When you add a stay — from a booking, a screenshot, or a hotel you name in chat — the server sends its name and address to OpenStreetMap's Nominatim service so the stay can be shown in the right spot and the plan can work out how far things are from where you sleep. That is what goes: the accommodation's name and address, and the rectangle of the map your trip covers. Nothing about you goes with it — not your name, not the booking reference, not an email, not an account or device identifier — so the service has no way to connect the place to you or to your other stays. A booking is stripped of that information on your phone, and again on our server, before this step. Stays we suggest ourselves already carry coordinates and are never sent. When Apple Maps cannot route part of your day — some countries are not covered — our server asks openrouteservice (HeiGIT, Germany) for that leg. It sends only the two points and whether you are driving or walking. Those points are places you planned or the stay you booked, so they say where you intend to be; they are not linked to you, your device or your trip when they are sent, and a route never starts from your own location. Separately, once a night our server downloads public nature data — trails, viewpoints, visitor centres — for destinations that day trips cover, from OpenStreetMap's public Overpass service. It sends only the map area of the destination. That request is not made while you use the app, and it carries nothing about you or any other traveller. Weather. When the AI plans days that start within the next ten days, and once a night before such a trip, our server asks Apple WeatherKit for the forecast. It sends only an approximate point — the town or area of your stops, rounded to about 10 km, which may be the area you stay in — and its time zone. It does not send your dates, your name, your trip or anything that identifies you or your device. We use the forecast to put outdoor plans into dry hours and to suggest swapping two stops when rain is coming; a swap happens only if you tap it. When the app fetches a map tile or a Wikimedia image, it retrieves public content and sends nothing about you.

How the w4app LLM proxy works

The trip text you provide is sent to a shared w4app LLM proxy operated by us. The proxy injects the API key server-side (the key is never on your device) and forwards your request to OpenAI (api.openai.com). The proxy does not attach your name, email, or account ID to the AI prompt. We do not retain your prompts and responses on our servers beyond ephemeral processing.

We do not share data with sub-processors not listed above without prior notice and, where required, your consent.

Sharing a trip

You can create a link to one of your trips and send it to anyone. Whoever has the link can see the trip without the app and without signing in, so share it only with people you mean to. What they see is a snapshot of your plan at the moment you shared it — later changes are not shown unless you share again:

• the trip's title as you wrote it, its dates and its days;
• the places in your plan, with their short descriptions and photos from Wikimedia Commons, each with its author and licence (a place we have no licence details for is shown without a photo);
• a map of the route from Apple Maps, showing your stops — never the place you stay;
• for each night, the town you are staying in — not the name or address of your accommodation.

Never on the page: your name, email or support code; the name or address of where you stay; your travel history, Travel memory or Your World; your chats; anything from your photo library; your location.

Think about the dates. A shared trip shows where you plan to be and when. Anyone with the link can see that, including the dates you will be away from home.

How long, and how to stop it. A link stops working after 90 days; sharing the trip again renews it. You can revoke it at any time in the trip's share menu, and deleting the trip or all your data revokes it too. When a link is revoked or expires, we delete the snapshot and its preview image straight away, and the link shows nothing. A short record that the link existed — with no trip content — is kept for 30 days, so the same link can never come back, and is then deleted.

Copies. Someone who has TravelMate can save a copy of a shared trip into their own trips. That copy is theirs — it is not linked back to you, and revoking your link does not remove copies others have already saved.

People who open a link. The page sets no cookies and loads no third-party scripts. We count views without recording who viewed. Like any web server, ours keeps a technical log of each request, including the IP address, for 14 days, for security and to fix problems (GDPR Art. 6(1)(f)). Protection against abuse counts requests per address in the server's memory only; nothing about them is stored. The preview image that messengers show for a link is delivered through Amazon's content delivery network, which already serves our app; we keep no log of those image requests.

The map on a shared page comes from Apple Maps. To draw it, our server sends Apple the points of the places shown and the route between them — the same things the page itself shows, with no identifier and never where you stay — and passes the image on to the visitor. The visitor's browser does not contact Apple. We keep that image only briefly in memory, to load the page faster.

Legal basis. We publish the snapshot because you asked us to, as part of the service (Art. 6(1)(b)).

5. International Data Transfers

Where personal data is transferred outside the EEA (e.g., to our AI processor, billing processor, or error-monitoring processor in the US), we rely on:

• The EU Standard Contractual Clauses (2021 module 2) with each processor
• The EU-US Data Privacy Framework where the processor is self-certified
• Additional technical measures: no identifiers attached at the AI-prompt layer; PII-scrubbing of diagnostics

You can request copies of the safeguards in place by emailing Show email address.

6. How Long We Keep Data

To have your data deleted, email Show email address. TravelMate has no accounts: we identify an installation only by a random key the app keeps, so we may not be able to find your data from an email alone, and we may ask you for information that identifies your installation. If we cannot identify it, we will tell you (GDPR Article 11). When we can, we delete the data we hold on our servers within 30 days. Data stored on your device is removed when you delete it in the app or uninstall the app. Subscription/billing records are retained for legal compliance, accessible only on legitimate request.

7. Your Rights (GDPR Articles 12–22)

If we process your personal data, you have the following rights:

We respond within 30 days (extendable by 60 days for complex requests, with notice). We do not charge for these requests except where they are manifestly unfounded or excessive.

8. Children

The Service is a general-audience travel utility and is not directed at children. You must be at least 16 years old to use it, as the Terms of Service state, or older where your country requires it. We do not knowingly collect data from children below that age. If you believe a child has provided us data, contact Show email address and we will delete it promptly.

9. Security

We implement technical and organizational measures appropriate to the risk:

• On-device storage for trips, itineraries, schedules and the content you download for them (offline-first)
• TLS / HTTPS for all network communications (standard OS-provided encryption)
• Server-side key injection via the w4app LLM proxy — no API keys on your device
• PII-scrubbed diagnostics — no trip text or precise location in crash breadcrumbs
• Access controls for administrative systems
• Incident response plan with 72-hour breach notification to the supervisory authority per Art. 33

Despite our efforts, no system is fully secure. In the event of a data breach affecting your personal data, we will notify you and the supervisory authority as required by law.

10. Automated Decision-Making and Profiling

The Service uses AI to generate travel suggestions, itineraries, and narration personalized to your stated preferences and location. We do not make decisions with legal or similarly significant effects about you using automated means under Art. 22 GDPR.

You can always:

• Override or ignore AI suggestions (every AI place suggestion is labeled "verify on site")
• Disable location features in device settings
• Request human review of any suggestion — email Show email address

11. Cookies and Tracking

The mobile app does not use cookies in the web sense and does not track you.

Our marketing website (w4app.com, https://w4app.com/travelmate) may use:

• Essential cookies (session, language preference)
• Analytics cookies (only with consent — see cookie banner)

We do not use advertising cookies, cross-site tracking, the IDFA, or the Android Advertising ID. We declare our Apple Privacy Manifest accordingly and do not declare the AD_ID permission on Android.

12. Store Privacy Disclosures (Apple App Privacy + Google Play Data safety)

This Privacy Policy is the canonical source. The Apple App Privacy survey (App Store Connect) and the Google Play Data safety form must be kept in exact sync with it and with the sub-processor table in Section 4.

Apple App Privacy — declared:

• Data Linked to You: Purchases (purchase history / subscription state)
• Data Not Linked to You: Precise Location, Coarse Location, Diagnostics (crash/performance)
• Data Used to Track You: None

Google Play Data safety — declared:

• Collected (none shared with third parties, none for tracking): Precise Location, Approximate Location, Financial info › Purchase history, App performance › Crash logs / Diagnostics
• Data encrypted in transit: Yes
• Data deletion path: Yes (email Show email address)
• Advertising ID requested: No

The store labels above summarise what each store asks us to declare. This policy is the full disclosure under GDPR Articles 13 and 14, and it is the document the mandatory Privacy Policy URL points to in both stores.

13. Changes to This Policy

We may update this Privacy Policy. For material changes, we will notify you in-app and (if you have provided an email) by email at least 30 days before the change takes effect, and make the prior version available on request. Continued use after the effective date constitutes acceptance.

14. Change of Controller

The data controller is the sole trader named in Section 1. If the Service is transferred to a company we set up, or to any other successor:

• You will be notified at least 30 days in advance via in-app message
• All your data and consent records will transfer to the new controller
• This Privacy Policy will be reissued under the new controller's name
• Your rights and the level of protection will not be reduced

The legal basis for the transfer is GDPR Art. 6(1)(b) and (f) — necessity for the contract and the legitimate interest of corporate reorganization that does not adversely affect you.

15. Contact

• General privacy questions: Show email address
• Subject access / data export / deletion requests: Show email address
• Complaints: Finnish Data Protection Ombudsman, https://tietosuoja.fi/en (or your local EU DPA)

Hosted at: https://w4app.com/travelmate/privacy (the URL referenced in App Store Connect and Google Play Console).

Document control

• v1.0 (2026-06-20) — First published version.