Privacy Policy

1. What information do we collect?

• Account information: name and email address when you register.
• Third-party sign-in: when signing in with Google, Apple, or Facebook, we receive your name and email from that service.
• Location and settings: language is taken from your phone's language (on the website: your browser's language). Currency and citizenship are taken from your phone's region (on the website: your browser's region, otherwise the country derived from your IP address). These are auto-filled only once and never overwritten afterwards — you can change them yourself at any time in your profile. Your departure location is suggested as the nearest larger airport based on your IP address, but only when your IP country matches your region. The IP address is looked up locally on our own server, is not stored, and is not shared with anyone. IP Geolocation by DB-IP (https://db-ip.com). Precise location (GPS) is only used if you have given the app access to your location on your phone. If you have given access and haven't chosen a departure location, the Home screen fetches an approximate location without you tapping anything, and our server finds the nearest airport for the prices of popular destinations. Otherwise, your location is only used when you tap a location button yourself, such as "Use current location": to find the nearest airport, the starting point in the route planner, restaurants nearby or experiences nearby. The coordinates are then sent to our server, and for restaurants on to Foursquare and for routes to the routing services (see section 3). For experiences, our server finds the nearest destination itself and sends only the destination to Viator. When a place name is needed, your phone's own location service (Apple on iPhone, Google on Android) turns the coordinates into a name. We do not store the coordinates. Travel Safety is shown based on the citizenship in your profile, where information is available for that country.
• Push token: if you accept notifications, we store your device's push token to send price alerts and travel inspiration.
• Travel preferences: departure city, travel style, budget, and preferred currency as set in your profile.
• Search history: flight and hotel searches are stored locally on your device and can be deleted at any time from your profile. When you are signed in, the flight, hotel and activity searches you make are also stored on our server, linked to your account (place, dates, number of travellers and the booking site you chose, and for flights also route, cabin class and baggage), so that we can send you one reminder about the search. The places you have searched hotels for are also used to tailor the suggestions in Inspire me. This is deleted 30 days after the search; a reminder that has not been sent yet is kept until it has been sent. It is also deleted when you delete your account.
• Trip plans: trip plans you create are stored in our database linked to your account.

2. How do we use this information?

• To provide you with a personalised travel experience.
• To send push notifications about price changes and travel inspiration (only if enabled by you).
• To improve the AI assistant's responses based on travel style and budget.
• To send emails for account confirmation and password reset.

Usage statistics (optional)

If you say yes (you are asked once, and you can change your choice at any time under Profile), the app sends usage statistics to our server and our database at Supabase (EU): when the app is opened for the first time and once per day it is used (whether you are signed in, and the number of trip plans in rough groups), when a trip plan is created or something is added to it (and whether it came from a search, a screenshot, an e-mail or was entered by hand), which popular destination you open from Home, which features are used (Inspire me, Ask AI, the route planner), that a search for flights, hotels or experiences was made (never what you searched for), which supplier you are sent on to, and that you changed the language or currency (never which one). Each batch also carries the app version, platform, channel, the ID of the app update, the app's language and whether it is test traffic. The statistics are pseudonymised: they use a random installation ID that is created when you say yes and deleted when you say no, and that is not linked to your account, name, e-mail or guest ID. We never store IP addresses, trip plans, names, text or photos in the statistics. The legal basis is your consent (GDPR Article 6(1)(a)). The statistics are deleted after 13 months, are not shared with anyone and are not used for advertising. The website asks the same question. If you say yes, the website sends only which type and which supplier you open, with a pseudonymous random ID that is stored in your browser (localStorage) and deleted when you say no. The request goes via our own website server (Vercel) to our server.

Usage data

Your choice itself (yes or no) is counted only as a daily total together with platform and language, without anything that links the choice to you or your device. Statistics collected before October 24, 2026 have been combined into daily totals without an account ID, device ID, IP address or search text, and the individual rows have been deleted. A backup copy of those rows is deleted automatically after 30 days. When you are signed in and open a supplier (flight, hotel, car rental or activity), we store your account ID, which supplier you opened and the time, so that we can send you one notification an hour later reminding you to add the booking to your trip plan. This is not statistics. It is deleted when the notification has been sent, when you add something of the same type to a trip plan, after 30 days at the latest, and when you delete your account. Trip plan names may be shown internally in our own overview, without your name or email. None of this is shared with others or used for advertising.

3. Sharing with third parties

We do not share personal data with advertisers or sell it. We use the following third-party services:

• Supabase – database storage and authentication (EU infrastructure).
• Expo – push notifications and app updates. Push notifications go via Expo with your device's push token and the text of the notification. When the app checks for an update, Expo receives your IP address and technical information about the device (for example the app version and operating system). See Expo's privacy policy: https://expo.dev/privacy
• Anthropic (Claude) – the AI assistant, Inspire me and reading screenshots and booking emails. Conversation content, screenshots you upload and the content of booking emails you forward to us (with attachments) are sent to Anthropic for processing, from our server – not your IP address. See Anthropic's privacy policy: https://www.anthropic.com/legal/privacy
• Tavily – web search for the AI assistant and Inspire me. Tavily receives the search terms the AI creates from your question (for example a destination and a month), from our server – not your IP address, name or email address. See Tavily's privacy policy: https://www.tavily.com/privacy
• Google, Apple, Facebook – optional social sign-in.
• Search for flights, hotels and activities – our server asks these services, without your name, email address, account or IP address: Travelpayouts (flight prices, for example for popular destinations, Inspire me and price alerts: route, date and currency), Kiwi.com (place lookup for the flight search: place names), Stay22 (hotel search: place, dates and number of guests and rooms), Viator (activities: place, dates and language), Open-Meteo (weather: the place) and AeroDataBox and Avinor (flight status for flights in your trip plan: flight number and date). The flight search itself takes place on the booking site you choose (for example Kiwi.com or Aviasales); see the partner networks below.
• Google Maps and Google Places – place search, details of airports, hotels and restaurants, photos and maps. Our server sends Google the text you search for or the place (without your name, email address or account). Photos of hotels and restaurants are loaded directly from Google, and maps in the app on Android and in the route planner on the website are shown with Google Maps; Google then receives your IP address, technical information about the device or browser and the map area. On iPhone, maps in the app are shown with Apple Maps. See Google's privacy policy: https://policies.google.com/privacy
• Foursquare – restaurant search. Foursquare receives the place you search for, or the coordinates when you search near where you are, from our server – not your IP address, name or email address. See Foursquare's privacy policy: https://foursquare.com/legal/privacy-center/
• OpenRouteService, OSRM, Valhalla (FOSSGIS) and Photon (komoot) – driving routes and address search in the route planner. They receive the addresses or coordinates of the route, from our server – not your IP address, name or email address.
• Nominatim (OpenStreetMap) – finds places and addresses, for example the town nearest to a point on the map or to where you are. Nominatim receives the place name or the coordinates, from our server – not your IP address, name or email address. See the OpenStreetMap Foundation's privacy policy: https://osmfoundation.org/wiki/Privacy_Policy
• Unsplash and Pexels – photos of destinations. Our server searches Unsplash for the name of the destination. The photos are loaded directly from Unsplash and Pexels, which then receive your IP address and the technical information your device or browser sends. See Pexels' privacy policy: https://www.pexels.com/privacy-policy/
• Stay22 – links to Booking.com and some other travel sites (for example Agoda, Vrbo, KAYAK and GetYourGuide) go via stay22.com with our partner ID, so that we can earn a commission if you book. When you open such a link, Stay22 receives your IP address, the technical information your browser sends (such as the browser type and the address of the page you came from) and the link itself (the booking site and the search, for example place and dates), and sends you on to the booking site. We do not send your name, email address or account to Stay22. See Stay22's privacy policy: https://www.stay22.com/privacy
• Partner networks for links to booking sites – when you open a link to a supplier, it often goes via a partner network with our partner ID, so that we can earn a commission if you book: Travelpayouts (Aviasales, Kiwitaxi and Airalo, and on the website also Kiwi.com), Partnerize (Expedia and Hotels.com in some countries) and Impact (Airalo). Links to Trip.com, Viator and DiscoverCars carry our partner ID directly. The network and the supplier receive your IP address, the technical information your browser sends and the link itself (for example place, dates and our partner ID). We do not send your name, email address or account. On the supplier's site (for example Kiwi.com, Skyscanner, Aviasales, Trip.com or Viator), what you do there is covered by the supplier's own terms. Privacy policies: Partnerize https://partnerize.com/legal/privacy-policy; Impact https://impact.com/privacy-policy/; Kiwi.com https://www.kiwi.com/en/pages/content/privacy/; Aviasales https://www.aviasales.com/privacy; Airalo https://www.airalo.com/more-info/privacy-policy
• DiscoverCars – car rental. The car rental search in the app and on the website is DiscoverCars' own search form, loaded from discovercars.com with our partner ID. DiscoverCars receives your IP address, technical information about the device or browser and what you fill in on the form (for example place and dates). See DiscoverCars' privacy policy: https://www.discovercars.com/privacy
• jsDelivr and cdnjs (Cloudflare) – the page for setting a new password loads a script from jsDelivr, and the car rental form in the app loads a script from cdnjs. They receive your IP address and the technical information your browser sends.
• Render – runs our server. Calls from the app and the website go to our server at Render, which receives your IP address and the technical information sent with the call. See Render's privacy policy: https://render.com/privacy
• Vercel – hosting of the website. Vercel receives your IP address when you visit the website and tells us which country it belongs to. We use the country only as a fallback for currency and suggested citizenship, and for prices on popular destinations; the language is taken from your browser. We do not store the IP address or the country. A suggested citizenship is saved in your profile (when signed in) or in your browser (as a guest), and you can change it at any time. See Vercel's privacy notice: https://vercel.com/legal/privacy-notice
• Resend – sends emails from us to your email address (sign-in codes and links, account confirmation, the welcome email and suggestions from bookings you have forwarded), and receives the booking emails you forward to us, with attachments.
• Resend – delivers the feedback you send in the app or on the website to us by email: your message, language and platform, and, where available, your account ID, a reply email address, a screenshot, the app version and the operating system. The feedback is not stored in the app's database. The email stays in our inbox for as long as we need it to reply to you and follow up. See Resend's privacy policy: https://resend.com/legal/privacy-policy
• Sentry – error reports from the app and the server (crashes and performance measurements), so we can find and fix bugs. A report contains the error message, where in the code the error happened, the device model, the operating system and the app version. It is sent without IP address, location (city or country), account ID, email address, name or other profile information. The website does not use Sentry. The data is stored in the EU (Germany) and deleted according to Sentry's own retention periods. See Sentry's privacy policy: https://sentry.io/privacy/

Cookies on the website

The website (plantravelapp.com) sets two cookies of its own. They contain no ID and are not used for advertising or statistics. pt_citizenship contains the two-letter country code of your citizenship, so that the website knows whether to show Travel Safety. pt_web_lang_choice contains the code of the language you chose on the website, so that the website opens in that language next time. Both are kept for 1 year.

4. Storage and security

Your data is stored securely in Supabase with encryption in transit (TLS). Access is restricted using Row Level Security policies.

How long we keep your data

• Account, profile, trip plans and documents you have uploaded: for as long as you have the account. When you delete the account, the files, price alerts and statistics that belong to it are deleted too. Feedback is not stored in the app's database; it reaches us by email (see Resend above).
• Notifications in the app, reminders after a search or about a booking, and forwarded bookings you have not confirmed: 30 days. A reminder that has not been sent yet is kept until it has been sent.
• Logs of sign-in emails and of push notifications that can no longer be delivered: 30 days.
• Forwarded emails from an address without a PlanTravel account: 30 days.
• Price alerts: until the travel date has passed, or until you remove them.
• Usage statistics (only if you have said yes): 13 months.
• Older visit and search statistics: 90 days.

5. Your rights

• Account deletion & backups: see the delete-account page (plantravelapp.com/en/delete-account) for a full overview of what is deleted, including any attachments/documents you uploaded. Database backups are automatically deleted within 7 days.
• Access: you can view your data in your profile.
• Deletion: you can delete your account and all associated data directly from your profile in the app.
• Notifications: you can turn off push notifications at any time in your profile or in your phone's settings.
• Data export: you have the right to receive your personal data in a machine-readable format (GDPR Article 20). Send an email to kontakt@nordicdigitalapp.no to request this.

6. Children

PlanTravel is not directed at children under 16. We do not knowingly collect information from children.

7. Changes to this policy

We may update this policy. Significant changes will be notified in the app. Continued use after an update constitutes acceptance.