The short version
Travlyo keeps what it needs to plan your trips and nothing more: your email, the name you give us, and the trips, stops, notes and expenses you create. We do not sell your data, we do not share it for advertising, and we do not show you ads.
Who we are
Travlyo (“we”) runs this app and decides how your data is used; in data-protection terms we are the controller. For anything on this page, write to hello@travlyo.com.
What we keep
- Account — your email address, your name, home city and home currency if you add them, your plan, and your email preferences.
- Trips — everything you put in a trip: dates, stops, bookings, notes, expenses, packing lists, companions' first names and the email addresses you invite, and the stories the app writes for you.
- Chats with Roam — what you ask the assistant and what it answers, saved with your account so a chat started on one device is there on the next. Please do not put passport numbers, card details or health information in a chat or a note; Travlyo does not need them.
- Usage — which AI features you used and what they cost us, so credits can be counted. No behavioural tracking, no advertising identifiers.
- Payments — handled by Stripe. We never see your card number; we keep only your Stripe customer id, your subscription status and the credits you bought.
- Technical records — like any website, our hosts log requests (IP address, browser, time) for a short time to keep the service secure and to stop abuse, and we count requests to enforce fair-use limits.
- Error reports — when something breaks, we keep what went wrong, the page it happened on, your browser type and your account id, so we can fix it. Never the content of a trip, a note or a chat; email addresses and links are stripped before saving.
- Waitlist — if you leave your email before we open, we keep that address to tell you when we do, and nothing else.
- Place caches — where a place is, its opening hours and its photo link are kept once for everyone, keyed by the place, never by you.
Why we use it
- To provide the service you asked for (our contract with you): your account, your trips, sharing, payments, and the emails that belong to them (sign-in links, invites, the note before a trip).
- Our legitimate interest in a safe, working service: security checks, abuse limits, counting page views without identifying you, fixing faults.
- Your consent, where we ask for it — optional emails, for example. You can withdraw it at any time from Settings or the link in any email.
- The law — keeping payment records as long as tax and accounting rules require.
We make no decisions about you by automated means that have a legal or similarly significant effect.
Who processes it for us
- Supabase (database and sign-in, hosted in the United States) and Vercel (hosting, and page-view counts that use no cookies and do not identify you).
- Google — where a place is, its opening hours and its photo, for the stops you add; Google Gemini writes trip plans, Roam's answers, stories and packing lists from the trip you give it. Only the trip content needed for the request is sent, never your email.
- Mapbox — routes between your stops; OpenFreeMap — the map itself, loaded by your browser; Photon (OpenStreetMap search by Komoot), Foursquare and OpenStreetMap — hotels and places by name near your city. AirLabs and SerpApi (Google Flights) — flight schedules and live fares for a route and a date. Wikipedia — a summary and photo of a place. Each receives the place or the route, never your account.
- Stripe — payments. Cloudflare Turnstile — the security check on sign-in. Resend — the emails we send (sign-in links, invites, the welcome note, the notes before and after a trip). Open-Meteo and Unsplash — forecasts and cover photos; they receive a place, not you.
- Partner links — when you open a booking site from Travlyo (Expedia, Expedia, Hostelworld, Skyscanner, Omio, Rentalcars, GetYourGuide, Viator, OpenTable, Rome2Rio), that site and its affiliate network (Impact, for example) see the click and may set their own cookies; they do not receive your Travlyo account. Their privacy terms apply there.
We may also disclose data when the law requires it, or to a successor if Travlyo is ever merged or sold — in which case this policy keeps applying to your data until you are told otherwise.
Where it is processed
Our database is in the United States, and several of the providers above are based there. If you are in the European Economic Area, the United Kingdom or Switzerland, your data is therefore transferred outside your country; where the law requires it, those transfers rely on the European Commission's standard contractual clauses or an equivalent safeguard offered by the provider.
How long we keep it
- Your account and trips — for as long as you have an account.
- A trip you delete — leaves the app at once and is removed for good 30 days later, with its stops, notes, expenses, share links and chats. In those 30 days we can bring it back if you write to us.
- Roam chats — your newest 200 chats; older ones are removed automatically. A chat tied to a trip goes when the trip goes.
- Closing your account — removes your account, trips, stops, notes, expenses, Roam chats, published stories, your seat on friends’ trips, invites and your sign-in, at once and for good.
- Payment and credit records — as long as tax and accounting law requires, without your trip content.
- Technical records — a short time, as long as needed for security.
- Error reports — ninety days after the last time the error was seen.
Sharing
A trip is private unless you create a share link. A read-only link (the whole trip, or one day) lets anyone who has it read that part of the plan, not your notes or expenses. An invite link lets the people you travel with join the trip and change it. Each link works until you stop it in the trip's Share menu. A story you publish to Stories is public until you unpublish it.
Your rights
Wherever you live, you can ask us to show you the data we hold about you, correct it, delete it, or give it to you in a file you can take elsewhere. Depending on where you live (the EU, the UK, California and other US states, among others) you may also have the right to object to or restrict a use of your data, to withdraw a consent, not to be treated differently for using these rights, and to complain to your data-protection authority. We do not sell personal data and do not share it for cross-context advertising, so there is nothing to opt out of.
Most of this you can do yourself, below. For anything else write to hello@travlyo.com from your account's email address; we answer within 30 days.
Your choices
- Download everything — Settings → Your data → Download my data gives you a JSON file of your account and trips.
- Delete everything — Settings → Close my account removes your trips, notes, expenses and your account. This cannot be undone.
- Emails — the link at the foot of every email, or Settings, turns the optional ones off. Sign-in links and invites you ask for are always sent.
- Cookies — one sign-in cookie and your time zone (so “today” is your today). Your theme and text size stay in the browser. Nothing tracks you.
- On your device — trips you open are saved for reading offline; sign out, or turn Offline off in Settings, and they are removed.
Children
Travlyo is for people aged 16 and over. We do not knowingly keep data about anyone younger; if you believe a child has opened an account, tell us and we will remove it.
Security
Your data travels encrypted, each account can read only its own trips (and the ones shared with it), and payment details never touch our servers. No service can promise perfect security; if a breach ever affects your data, we will tell you and the authorities as the law requires.
Changes to this page
When this policy changes in a way that matters, we change the date above and say so in the app or by email before the change applies.