The short version
Traypass is made by Gonzalo Fuentes. It keeps what it needs to plan a trip with the people you invite, and nothing it can avoid. The files you add to a trip are encrypted on your iPhone before they leave it, with keys only the people on that trip hold. Nothing is sold, and nothing is used for advertising.
Your account
You sign in with Apple or Google through Firebase Authentication. Traypass keeps your user id, the name and the optional @username you choose, the photo you add, the country you set off from, and your passport: its cover, the signature you draw and the places you add by hand. Sign in with Apple can hide your email from us. Google shares the address of the account you pick. Your photo is kept on our server and can be opened by anyone who has its link, which is how the people on your trips see it.
Your trips
A trip lives in Firebase Firestore, in the European region, and is shared with every member of that trip. The name, address and location of every stay, the title, place, notes and location of every plan, seats and booking references, what the checklist and the shared packing list say, and the titles of documents are sealed with a key that only the trip's members hold. The servers store them but cannot read them. The trip's name, dates, stops and cover stay readable, because an invitation shows them. So do the flights (number, airline, times, airports, gate), so the server can watch them for delays and cancellations, and the times of bookings and plans. How the sealing works.
Your documents
Every file you add is encrypted on the phone (AES-256-GCM, with a Curve25519 identity kept in your iCloud Keychain) and stored as an opaque envelope on our own server. We cannot open it. A document shared with a trip can be opened by its members once one of them lets a newcomer in; a personal document can be opened only by you. Deleting a document deletes the envelope.
Your passport, as others see it
Other people can open your passport only as far as you allow in Settings, under Passport privacy: nobody, the people you have shared a trip with, anyone who scans your code, or anyone who types your exact @username. What they see is your name, @username, photo, nationality, the stamps of the trips that have ended (dated to the day, the month or the year, as you choose) and, if you allow it, your signature. Never a trip, never where you are now. There is no search and no feed.
Anyone who can open a passport can report it or block its owner. A report keeps what the passport showed at that moment, so we can look at it. A block closes both passports to each other and is not announced. The people you blocked are listed in Passport privacy, where you can unblock them.
Packing and the wardrobe
The wardrobe you describe, and how you adjust the lists the app proposes, are kept with your account so the next list starts as yours. When you ask for suggestions, the request sent to our server and on to the model provider (OpenAI) carries the trip's shape (destinations, dates, climate, and what is on the list by type) and no names, nothing you wrote in your own words and no itinerary. The first time you ask on a phone, the app says so and asks before it sends anything.
If you tell the wardrobe that you menstruate, that answer, the trips you expect your period on and the period kit on your own packing list are kept with your account, so they follow you to another phone. They are health information. Our servers can read them. They never go on a trip anyone else can see, and they are never sent to the model provider. You can switch the answer off in the wardrobe at any time, and deleting your account erases it.
Suggested plans
A suggested day is built from a corpus of public places (Wikivoyage) and the trip's own anchors: roughly where you sleep, to about half a kilometre, and when your flights land. The model picks from that list and writes the words. It does not receive your name, your documents or your messages.
What the servers see
- Weather comes from Apple's WeatherKit, asked for by place and date.
- Cover photographs come from Unsplash, chosen by the name and location of the place. The area around it (town, province, country) is looked up in OpenStreetMap's Nominatim. Neither is told who is asking.
- Flight status comes from AeroDataBox, asked for by flight number and date, through our server.
- Your profile (name, @username, photo, home country, wardrobe, your answer about your period if you gave one, and the places in your passport) is stored with your account and is readable by our servers.
- Exchange rates come from the European Central Bank and exchangerate-api.com.
- Notifications are sent through Apple's push service to the phones registered on your account. For each phone the server keeps its push token, its language and its time zone. The server writes the sentence, and a name in it is sealed and filled in on your phone.
- Purchases are handled by Apple and RevenueCat. RevenueCat receives your user id, your email and your name, so a purchase or a refund can be matched to your account. We never see a card number.
- The app counts how it is used with PostHog, in its European region: which screens are opened and which features are used, as plain events and counts. Each event carries your user id, and PostHog reads the rough country and city of the connection from its IP address. Events never carry a name, an email, a place, a trip's title or anything you typed.
- When the app crashes or something fails, a report goes to Sentry, in its European region: the error, what led up to it, how long some actions took, the phone's model and system version, and your user id. Reports never carry a name, an email, a trip, a document or a screenshot.
- This website uses Vercel Analytics, which does not use cookies and does not identify you.
What is never collected
No advertising identifiers, no contacts, no location in the background. Bookings you share into the app from your mail or Wallet are read on the phone, with Apple Intelligence, and are not sent anywhere to be read.
Deleting your account
Settings, then Delete account, erases your profile, your wardrobe, your personal lists and your documents, removes you from every trip, deletes the trips you created and asks Apple to revoke its sign-in. Nothing is kept afterwards apart from what the law requires of a purchase receipt.
Who handles it
Google (Firebase Authentication and Firestore, in the European region), our own server, Apple (sign-in, push, WeatherKit, purchases), OpenAI (suggestions), RevenueCat (purchases), AeroDataBox (flights), Unsplash and OpenStreetMap (covers), PostHog (usage), Sentry (crash reports) and Vercel (this website). Some of them are in the United States. They act on our behalf and only for the part described above.
Your rights
Gonzalo Fuentes is responsible for this data. Traypass keeps it to give you the app you signed up for. Your answer about your period is kept only because you gave it, and switching it off withdraws it. You can ask for a copy of what we keep, have it corrected, have it deleted, or object to how it is used, by writing to the address below. You can also complain to the Spanish data protection authority (AEPD, aepd.es). Traypass is not meant for children under 14.
Questions
Write to hi@gonzalofuentes.com.