Privacy

Who we are and what this covers

This is the privacy notice for the Travim website at www.travimapp.com and the Travim app for Android and iOS. It is the notice the app links to from Settings. The operator of Travim is the data controller for the processing described here. Privacy contact: privacy@travimapp.com.

Signing in with Google

Signing in is optional — Travim plans trips without an account. In rare cases — for example a denial-of-service attack or other abuse aimed at exhausting our AI capacity — we may temporarily require sign-in with Google or Apple before generating new plans, so we can apply limits per account instead of restricting the feature for everyone. If you choose Continue with Google, Google asks for your consent and returns a signed identity token to the app.

Travim requests only the basic sign-in scopes: openid, email and profile. That gives us your name, your email address and the account identifier Google assigns you. Travim does not request or receive access to Gmail, Drive, Calendar, Contacts, Photos or any other Google service, and asks for no sensitive or restricted scopes.

The identity token Google returns also carries your name and a link to your Google profile picture. Travim’s servers read only the account identifier, your email address and whether that address is verified; the app passes on your display name. We do not store, display or use your Google profile picture.

Three things are written to our database: the Google account identifier, your email address and your display name. The token itself is verified on our server and then discarded — it is never stored. We use this data for one purpose: to create and sign you into your Travim account, so that one person keeps one account and your saved trips follow you from one device to another. It is not used for advertising, profiling or any other purpose.

Limited Use. Travim's use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use Google user data only to provide and improve the user-facing features described in this notice. We do not sell it, use it for advertising or ad targeting, transfer it to data brokers or information resellers, use it to determine creditworthiness, or use it to develop, improve or train generalised or non-personalised artificial-intelligence or machine-learning models. No human reads it except where you ask us for support, or where the law requires it.

Signing in with Apple

Sign in with Apple works the same way and gives us the same three things — an account identifier, an email address (or Apple's private relay address, if you chose to hide yours) and a display name — used for the same purpose and nothing else.

What the app holds while you use it

Your trips. The description you write, the questions you answer and the plans Travim produces are kept on your phone. When you are signed in they are also stored on our servers, so they survive a lost phone and reach your other devices.

Shared trips. If you invite people to a trip or join one, the members of that trip — for example the tour leader, the organising agency or company, and fellow travellers — can see the trip, its steps, attachments and notes, and your display name. When an organiser invites you directly, they enter your email address or phone number so the invitation reaches you.

Attachments and notes. Photos, videos, tickets, documents, voice recordings and other files you attach to trip steps, and the notes you write, are uploaded to our servers and shared with the members of that trip. Travim reads only the files you choose through the system photo or file picker, or photos you take with the camera for that purpose. It does not scan your photo library or your files.

Phone number. Your account asks for a mobile number. It is used to identify your account, to let trip organisers invite you, and to contact you about your account. It is not used for advertising.

Your location. Only if you grant the permission. For planning, your location is read once, while the app is open, to answer questions about where you are and to place nearby suggestions.

Live location sharing. This is off by default. Only if you turn it on for a trip, for a period you choose, Travim collects your precise location about every 30 seconds, including while the app is closed or not in use, and shows it on the trip map to the members of that trip, such as the tour leader, so you can find each other. A persistent notification is shown while sharing is on, and it stops automatically when the period ends or when you turn it off. Your shared location is visible only to that trip's members, is not used for advertising and is not shared with anyone else.

Notifications. If you allow them, the app registers a push token with Firebase Cloud Messaging on Android or Apple Push Notification service on iOS, so trip reminders and updates from your shared trips can reach the device.

Purchases. In-app purchases are handled by Google Play and the App Store. Travim receives the store's receipt to unlock what you bought; we never see your card or payment details.

Business accounts, identity checks and review

Identity verification. Listing a business requires us to verify the people behind it. We ask the representative, and where relevant the owner, for a government identity document or an equivalent, and we check it against the business details submitted. We hold it to confirm that the business and the person enrolling are real, to prevent fraud and impersonation, and to meet our own legal obligations. It is never published, never shown to travellers, never used for advertising, and it is seen only by the staff who carry out the check.

Review before publication. Every business submission — profile, photograph, post, product, service, offer, campaign and advert — is reviewed by us before it appears, and may be reviewed again afterwards. Review is carried out by our staff, with automated checks assisting. We may reject, edit down, remove or suspend anything that is unlawful, misleading, unsafe, infringing or against our rules, and we tell the business why.

Business contact data. Names, roles, addresses, phone numbers, tax or registration numbers and correspondence connected with a business account are held for the life of the account and for as long afterwards as the law requires us to keep commercial records.

What you publish is public. A business profile, its photographs, opening details, posts, products, services, offers and campaign codes are shown to anyone using Travim, can appear in the Explore directory and in generated trip suggestions, and may be indexed by search engines. Do not put anything in them you would not want seen publicly.

Analytics, crash reports and how we improve Travim

Website analytics. This website uses Google Analytics 4 to count visits and understand which pages people use. It sets cookies in your browser and processes your IP address, the pages you view, the approximate region you are in, and basic device and browser details. We use it to see what works and what does not, not to identify you. You can prevent it entirely with Google's opt-out add-on, with your browser's tracking protection, or by declining analytics where we ask.

App diagnostics and crash reports. When the app hits an error it sends us a diagnostic report — what failed, where in the app, the app version and platform — so we can fix it. These reports are processed only by us. They describe the failure, not your trip content, and we do not use them to identify you.

Usage analysis. We analyse how Travim is used — which destinations, categories, seasons and areas draw interest, and how listings and adverts perform — to improve the product and to advise businesses on what to publish, when, and to which audience.

What businesses receive. Businesses and advertisers receive aggregated and de-identified insight only: counts, trends, categories, areas and performance figures. They do not receive your name, email address, account identifier, device identifier, precise location or trip content, and we do not give any business a way to single you out.

Cookies

The Travim website stores two kinds of information in your browser. Strictly necessary cookies and similar technology keep the site working and secure — for example Cloudflare’s, which protects the site from abuse and routes your request to the nearest server. These cannot be switched off, because the site cannot run without them, and we rely on our legitimate interest in operating a secure service to set them. Analytics cookies come from Google Analytics and are set only if you agree — they help us see which pages are used, as described above.

We ask for your choice the first time you visit, through the banner at the bottom of the page, and you can change it at any time using the “Cookie settings” link in the footer of every page. Where the law requires your prior consent — the EU and UK’s ePrivacy rules, and the equivalent Turkish rules under Law No. 6563 — non-essential cookies are not set until you agree, and Google Analytics cookies are kept for up to 14 months before being refreshed or deleted. If we introduce advertising cookies on the website, we will add them to this banner as a separate category before switching them on.

Advertising

Travim may show adverts, for example while a plan is being generated. These can be Travim's own promotions, adverts from businesses that advertise directly with Travim, or adverts served by Google AdMob.

Direct adverts. Adverts from businesses that advertise with Travim are chosen by where they appear and by the context of what you are searching for or planning at that moment, not by a profile of you. The advertiser receives only aggregated figures such as impressions and clicks.

Google AdMob. Where AdMob is used, it may use a device advertising identifier to select and measure adverts, under Google's own privacy terms. On iOS this happens only if you allow tracking through App Tracking Transparency; otherwise you see non-personalised adverts. On Android you control the identifier with "Delete advertising ID" in your device settings.

We do not share your Google or Apple account data, your trip content, your attachments or your location with advertisers.

How plans are generated

Travim uses third-party AI providers to turn your description into plans. The text you write and the trip details needed to answer it are sent to that provider for the single purpose of producing your answer. Your Google or Apple account data is never included in those requests, and neither we nor the providers use your content to train generalised AI or machine-learning models.

Who else sees your data

We do not sell your data. It reaches other companies only where they perform a service for Travim: Cloudflare, which delivers and protects our traffic; our hosting provider; the third-party AI providers that generate plans; Google Analytics for the website measurement described above; Google Play and the Apple App Store for purchases; Firebase Cloud Messaging and Apple Push Notification service for notifications; and Google AdMob for advertising. Each acts under contract and on our instructions, except where it is an independent controller of its own service. We also disclose data where the law compels it, and we may transfer it as part of a merger or sale of the business, on notice to you.

Connection data. Cloudflare and our servers log the usual technical details of a request — IP address, time, user agent, the page or endpoint asked for — to deliver the service, block abuse and diagnose faults. These logs are kept for a short period and are not used to build a profile of you.

Why we are allowed to do this

If you are in the European Economic Area or the United Kingdom, we rely on these legal bases under the GDPR: performance of a contract for your account, your trips, purchases and business listings; legitimate interests for securing the service, preventing fraud and abuse, understanding usage in aggregate and improving the product; consent for analytics cookies, notifications, location, live location sharing and, where required, advertising identifiers — each of which you can withdraw at any time in your browser or device settings; and legal obligation for identity verification records, tax and accounting records, and responses to lawful requests.

Where your data is

Travim operates internationally, so your data may be processed outside your own country, including in the United States, by the providers named above. Where a transfer out of the EEA, the UK or Türkiye needs a safeguard, we rely on the European Commission's standard contractual clauses, the UK addendum, or the equivalent undertakings permitted under Turkish law.

How it is protected

Everything the app and the website send travels over HTTPS. Your session token is held in the platform's own protected store — the Android Keystore or the iOS Keychain — locked to that one device and excluded from backups. Identity documents are stored separately from ordinary account data and are reachable only by the staff who carry out verification. Server-side data sits on access-controlled infrastructure, reachable only by the systems and people that need it.

How long we keep it

Account data — identifier, email, name and your saved trips — is kept while your account exists, and deleted within 30 days of a deletion request. Identity verification documents are kept while the business listing is active and for as long afterwards as the law requires, then deleted. Connection and analytics logs are kept for a short period, then discarded or aggregated. Purchase and accounting records are kept for the period tax law requires. Content you published stays visible until you or we remove it.

Your rights

Everyone. You can ask us what we hold about you, ask us to correct it, ask us to delete it, or ask for a copy. Write from the address on the account to privacy@travimapp.com. We answer within 30 days and we do not charge, and we will not treat you differently for asking.

European Economic Area and United Kingdom. You also have the right to restrict or object to processing, to data portability, to withdraw consent at any time without affecting what came before, and to complain to your national data protection authority.

Türkiye. Under Article 11 of Law No. 6698 (KVKK) you may learn whether your data is processed, request information about it, learn its purpose and whether it is used accordingly, know the third parties it is transferred to at home or abroad, request correction, erasure or destruction and ask that this be notified to those third parties, object to a result produced solely by automated analysis, and claim compensation for damage caused by unlawful processing. Applications may be made in writing to the address above under the procedure set by the Personal Data Protection Board, and you may complain to the Board.

United States. Depending on your state, you may have the right to know, delete and correct personal information, to a portable copy, to opt out of its sale or of sharing for cross-context behavioural advertising, and to appeal a refusal. We do not sell personal information for money. Advertising identifiers used by Google AdMob, where it is used, may count as "sharing" for cross-context behavioural advertising in some states; you can opt out through your device advertising settings or by writing to us. We do not knowingly process the sensitive categories those laws single out for the purpose of inferring characteristics about you.

Children

Travim is not directed at children. We do not knowingly collect data from anyone under 13, or under the age of digital consent in their country where that is higher. If you believe a child has given us data, write to us and we will remove it.

Automated decisions

Travim generates plans, descriptions and suggestions automatically, and automated checks assist our review of business submissions. Decisions with a legal or similarly significant effect on you — approving, suspending or removing a business account — are made by a person, and you can ask us to explain one and to look at it again.

Changes

If this notice changes materially we will say so on this page before the change takes effect. Last updated 24 September 2026.

Contact

Privacy questions, access requests and deletion requests: privacy@travimapp.com.