MyTravelPal — Privacy Policy

Last updated: 2026-10-14

MyTravelPal (“we”, “the App”) is an Android app that helps you plan road trips across Europe. This policy explains what personal data we collect, why we collect it, who we share it with, how long we keep it and what rights you have under the EU General Data Protection Regulation (GDPR) and the Swiss Federal Act on Data Protection (nFADP).

Data controller: José Javier González García
Route de Saint-Cergue 24bis #1028 · 1260 Nyon (VD) · Switzerland · hello@mytravelpal.io

Privacy contact: privacy@mytravelpal.io

1. Data we collect

Data you provide directly

Account: the email address and public name from the provider you sign in with (Google), together with an internal user identifier and the dates of sign-up, last sign-in and last activity. We do not store your password: authentication is handled by the provider. The App keeps your session with an access token that expires after 30 days.
Travel profile: number of travellers, whether you travel with children or pets, vehicle type, estimated consumption, meal preferences, driving pace and usual departure time.
App settings and data synced with your profile: App settings (theme, units, currency, language), your Hall of Fame nickname and country, your “My places” (name, coordinates, category and note), your recent searches (place name, coordinates and country), the vehicles in your garage (model, tank, fuel) and, if you add them, your emergency contacts (name and phone number). All of this is stored on the server so you can restore it when you reinstall the App or change device.
AI profile (optional): explicit preferences you enter under “AI Personalisation” (scenic routes, dietary restrictions, interests) and implicit data derived from your use (countries visited, number of plans made). They are used only to personalise the answers of the driving assistant and the trip inspirations.
Trip requests: the origin, destination, departure time and preferences of every plan you calculate. They are sent to our server to calculate the plan and are kept only if you save, share or monitor the trip (see below), apart from temporary technical caches.
Saved trips: when you save a trip, we store on the server its summary (origin and destination labels and coordinates, countries, dates, distance, estimated costs), your selections (hotels, stops, fuel stations), a compressed copy of the plan and, for each night, the hotel choice or booking you mark (name, coordinates, price, check-in date, nights, link and status).
Trip monitoring and alerts (Premium plan): if you turn on monitoring for a saved trip, we store the simplified route geometry, its bounding box, the daily driving windows, the countries and your alert preferences. Our server periodically checks the weather and adverse events along that route, starting 7 days before departure and until arrival, and stores the alerts it generates in your inbox.
Push notifications (if you enable trip alerts): when you turn on monitoring for a saved trip, the App first explains what will happen. Only if you accept and allow notifications in the system dialog, we store your device’s notification identifier (a push token issued by Firebase Cloud Messaging, a Google service), the platform, language, time zone and App version, linked to your account, up to a maximum of 10 devices per account. The token is used only to deliver your trip alerts. You can turn alerts off in the App or revoke the notification permission in your phone’s system settings at any time; the token is removed when you sign out, when you turn alerts off and when you delete your account.
Shared trips: when you share a trip we store a copy of the plan and of the request under a 6-character code. Anyone who has the link can view it for 30 days.
Suggestions and feedback: the free text you send from “Send a suggestion”, up to 3 screenshots you choose from your gallery and, if you tick the corresponding box, your email address so we can reply. Sending is always voluntary. We store the text, your reply email (if provided), your account identifier, the App version and the language, and we send a copy by email to our mailbox together with your account email and the screenshots.
Subscription: the subscription tier, its expiry date and the purchase token that Google Play passes to us, stored in your profile.
Companion group session: if you create or join a group session, the driver periodically sends their position (coordinates), speed, next stop, estimated arrival time, remaining kilometres, upcoming speed camera and the list of planned stops. That data is stored on the server and can be read by anyone who has the access code while the session is active.
Hall of Fame (optional): only if you tick “I want to take part in the Hall of Fame”, your alias and your country flag become public together with your totals (kilometres driven in Companion mode, euros saved on fuel, euros saved on tolls and hazards avoided) and your position in each ranking. Your name, email, routes and positions are not published, and nothing is linked to any social network. To compute the totals we store on the server, unpublished, a record of each Companion drive (drive identifier, date, start and end time, kilometres, top speed and the number and quality of GPS fixes, not the fixes themselves), the saved trip it belongs to and the hazards already counted (type, a grid cell of about 11 km and departure date). Other users can report an alias: a reported alias is hidden until we review it, and we keep who reported it. When you leave the Hall of Fame your alias and all those statistics are deleted at once (a cached copy of the ranking may keep showing it for up to a minute); deleting your account removes them too.
Drive summary (optional): when a Companion drive ends, the App keeps a summary on your phone only; nothing is sent to us. If you then tap “Save to my profile” after reading the explanation shown, we store on the server the start and end time, kilometres, driving and stopped minutes, average and top speed, planned kilometres, estimated fuel and toll costs, the countries crossed, an optional reference to the copy on your phone, the version and time of your consent and up to 40 stops that have a name (stops without a name, and generic names such as “Stop” or “Parking”, stay on your phone and are never uploaded; each has a type such as fuel, restaurant or hotel, brand, place identifier, coordinates, arrival time, minutes stopped, whether it was planned and whether you marked it as a favourite). We never keep the GPS trace of the drive: it is discarded when the drive closes. If you do not save it, the summary exists only on your phone and is lost if you delete the App’s data or uninstall the App. Separately, and only for the stops you mark one by one, we add to your learning profile a reduced preference (type of stop, brand, time-of-day slot — morning, lunch, afternoon, dinner or night) with no coordinates, country, name or place identifier, so that suggestions fit you. This does not need the summary to be saved: each mark travels with a random identifier that we store only as a hash, so sending it twice does not count twice. Unmarking a stop removes its contribution; deleting a saved summary does not, because these marks belong to your learning profile. You can remove everything the assistant learned from your stops at any time with Settings → “Forget what the assistant learned from my stops”, and it is also removed if you delete your account. The summary is not used to compute Hall of Fame totals.
Trip story (Premium): the story with photos and short texts about the places on your route is kept on your phone next to the saved trip, so you can read it offline. It holds only text, links and the author and licence of each photo (no images and no audio), is not sent to our server when trips sync, and is deleted with the trip or when you sign out. Reading it aloud uses your device’s own voice, and the text is not sent to any service.

Data we collect automatically

Installation identifier and activity: a random identifier generated on your phone the first time you open the App (it is not tied to the hardware or to the advertising identifier and disappears when you clear the App’s data), the App version and the date of last activity, linked to your account when you are signed in.
Usage and cost accounting: for each paid call to an external provider (language model, routing, places, etc.) we record the provider, the feature, the number of units or tokens, the estimated cost, the subscription tier and your account identifier, without the content of the query. We also keep daily call counters per provider and per user (for users who are not signed in, a short code derived from the IP address) to apply daily limits and control cost.
Crash and diagnostic reports via Sentry (EU region) and, in the App, also via Firebase Crashlytics (Google). Crashlytics receives, when the App crashes, the stack trace, device model, system and App version information, the state of the device at the moment of the crash and an installation identifier generated by Firebase; we attach no account identifier, name or email to it. We do not use Firebase Analytics. Sentry reports come from both the App and the server. They include stack traces, device, system and App version information and, for the server, technical details of the request that failed (for example the request path and its parameters, which may include coordinates). In Companion mode, if no GPS position is obtained for 60 seconds, the App sends a diagnostic report with the technical state of the GPS.
One-off location when you tap “Use my location” or “Leave now”: the coordinates are sent to our server to calculate the route. They are kept only if they become part of a trip you save, share or monitor.
Real-time location during Companion mode: while Companion mode is active, the App reads your GPS position on your device, including with the screen off or the App in the background if you grant the “all the time” location permission, and shows a persistent notification while it does so. About once a minute the App sends our server your position, speed, heading, driving time and your alert settings to receive recommendations (breaks, weather, fuel, adverse events, border crossings). The server uses that position to query external providers and does not write it to our database, except in the group session described above.
Impact detection (Companion): your device’s accelerometer and GPS are processed on the device itself to detect a sudden stop consistent with a crash. If one is detected and you do not cancel the alert within 15 seconds, the App prepares an SMS in your messaging app for your emergency contacts with a link to your position; your phone sends it. This sensor data is not sent to our servers.
IP address: like any Internet service, our hosting provider processes it to serve requests, and we use it in memory to limit abuse.

Device permissions

Location (precise, approximate and background): for “Use my location” and for Companion mode. You can deny or revoke it in the system settings.
Contacts: only if you tap “Pick from contacts” when adding an emergency contact. The App reads the address book on your device to show you the picker and stores only the name and phone number of the contacts you choose. You can add them by hand without granting the permission.
Notifications: for stop reminders and alerts, and for the persistent Companion notification.
Photos: the App does not request general access to your photos. It receives only the images you manually choose to attach to a suggestion.

Data we do NOT collect

No advertising identifier (GAID or similar).
No behavioural analytics for targeted advertising.
No microphone or camera.
The content of conversations with the AI assistant beyond the request in progress (the server does not keep chat history).
Card or other payment data: Google Play handles it entirely.

2. Why we collect it

Calculating trip plans: the origin, destination and profile feed the routing, POI, fuel cost and toll algorithms.
Personalising the AI assistant: the user profile is included as context in the calls to the language model so the answers are relevant to you.
Syncing across devices: the profile, settings and saved trips persist on the server so your data can be restored if you reinstall the App or change device.
Driving alerts and trip monitoring: the real-time GPS position lets Companion mode warn you about speed cameras, adverse events, route changes and upcoming stops; trip monitoring warns you about problems on a future route.
Safety: impact detection and alerting your emergency contacts.
Managing your account and subscription: identifying you, validating your subscription tier and restoring your data.
Improving reliability: crash reports help us fix bugs in production.
Replying to your suggestions: if you gave your email when sending us feedback, we use it only to reply to you.
Running the service, cost control and abuse prevention: usage accounting, per-installation activity and the daily counters let us size the infrastructure, control the cost of external APIs and limit abuse.

We never sell your data or share it with advertisers.

3. Third-party services and processors

MyTravelPal relies on the following providers. The data they receive is strictly what their function requires. Calls to route, place, weather and event data providers are made by our server, so they do not receive your account identifier, email or name. Exceptions: some resources are requested directly by your device (OpenStreetMap map tiles, Wikimedia Commons photos, Frankfurter exchange rates and the Google Places card); those services receive your device’s IP address and the usual technical data of a connection, and, for map tiles, the area you are viewing, but not your account identifier, email or name.

Service	Purpose	Data received	Country or region
Fly.io	Hosting of the server and the PostgreSQL database	All request data and the stored data described above	Servers in Paris (France)
Sentry	Crash and diagnostic reports (App and server)	Traces, device information and technical request details	EU data region (Germany)
Resend	Emailing suggestions to our mailbox	Suggestion text, screenshots, your account and reply emails, account identifier	United States
Anthropic (Claude)	Language model for AI Inspiration, the Companion assistant, the trip narrative and the trip story wording	Your message and a summary of the trip context and your preferences, without name, email or account identifier	United States
Google Places (server)	Identifying restaurants and hotels and obtaining their place identifier	Venue name and coordinates; from the response we store only the place identifier (place_id)	United States and other countries
Google Places UI Kit (on your device)	Card with ratings and photos for a place, with Google’s attribution	The place identifier; Google serves the request directly to your device, with the usual technical data of a connection	United States and other countries
Google Sign-In	Sign-in	Email, name and account identifier from the provider you choose	United States and other countries
Google Play (billing)	Essential and Premium subscriptions	Google handles the payment; we only receive and store the purchase token	United States and other countries
Firebase Cloud Messaging (Google)	Push notifications for trip alerts, if you enable them	The device notification identifier and the content of the alert	United States and other countries
Firebase Crashlytics (Google)	Crash reports of the App	Stack traces, device and system information and a Firebase installation identifier, without account data	United States and other countries
HERE Technologies	Routing, tolls, fuel prices and places	Coordinates of origin, destination, route geometry and stops	Netherlands and other countries
Geoapify	Hotels, restaurants, fuel stations and charging stations	Coordinates of the route corridor	EU
OSRM (public server)	Route calculation	Coordinates of origin, destination and stops	Germany
OpenStreetMap (Nominatim and Overpass)	Address search, reverse geocoding, speed cameras and toll data	Search text and coordinates	Europe (several public servers)
OpenStreetMap (map tiles, on your device)	Displaying the App’s maps	Your device downloads tiles directly from tile.openstreetmap.org: it receives your IP address, the App identifier and the coordinates of the tiles for the area you are viewing	OpenStreetMap Foundation (United Kingdom) and its content delivery network
Open-Meteo	Weather forecast and heatwaves	Coordinates sampled along the route and time	Switzerland and EU
MeteoAlarm, EFFIS, NASA FIRMS, USGS	Weather warnings, fires and earthquakes	MeteoAlarm is queried by country and receives no data about you; EFFIS, FIRMS and USGS receive the geographic area of the route	EU and United States
Wikipedia, Wikidata and Wikimedia Commons	Short texts and photos of the places in the trip story (Premium), and photos of hotels and restaurants	Our server queries coordinates, place names and the language, with no account data; your device downloads the photos directly from Wikimedia (upload.wikimedia.org), which receives your IP address and the usual technical data of a connection, but no account identifier, email or name	United States
Frankfurter (on your device)	Exchange rates to show prices in another currency	Your device queries api.frankfurter.app directly (about once a day): it receives your IP address and the usual technical data of a connection, with no personal content in the request	Public service
Cloudflare	Hosting and DNS of the mytravelpal.io website	Technical data of visits to the website	United States and global network
Booking.com, TheFork, GetYourGuide, Google Maps	Links to hotels, restaurants, activities and maps	Only if you tap a link: public search parameters and, where applicable, our affiliate code. From then on the destination site’s own policy applies	Depends on the provider

We do not send your personal data to any other third party. Providers acting as processors handle the data to provide us with the service and under our instructions.

Note on language model calls (Anthropic): when you use AI Inspiration or the Companion assistant we send Anthropic the text of your query together with a summary of the trip context (for example destination, remaining kilometres, upcoming stops or number of days) and of your travel preferences, but no name, email or account identifier. If you ask the assistant a question while driving, the summary also includes your approximate position as the name of the nearest town (or, if none is found, coordinates rounded to about 100 metres), your direction of travel, speed, local time, fuel level and the names of the places found near you; your exact position is never sent to Anthropic. Conversations are not used to train models under Anthropic’s API terms of use.

4. Subscriptions and payments

The Essential and Premium subscriptions are managed entirely through Google Play. MyTravelPal does not store card data or payment information. When you subscribe, Google passes us a purchase token, which we store in your profile together with the tier and the expiry date in order to unlock the corresponding features. To cancel, download invoices or request refunds, use the Google Play subscription management.

5. How long we keep it

Account, profile, synced settings, vehicles, places, emergency contacts and subscription: until you delete them or delete your account.
Saved trips: until you delete them or delete your account. The detailed copy of a trip’s plan is removed 90 days after its arrival date; the trip summary stays until you delete it. A deleted trip leaves for 30 days a minimal record (identifier and dates, no personal data) so that your other devices learn about the deletion.
Trip monitoring and alerts: monitoring is removed 30 days after the trip’s arrival (or when you delete the trip) and its alerts go with it; the state of an already resolved alert is removed after 7 days.
Push notification identifiers: until the device is removed from your account, until the notification service reports them as no longer valid, or until you delete your account.
Shared trips: the link works for 30 days from the moment you create it; the copy is then deleted by a periodic cleanup. It is deleted at once when you delete your account.
Companion group sessions: the code works for 12 hours at most. If the driver ends the session, it is deleted at that moment. A session that simply expires is no longer shown to anyone and is deleted automatically by a periodic cleanup; it is also deleted when you delete your account.
Saved drive summaries: 12 months after you save the summary, or until you delete the summary or delete your account, whichever comes first. The copy on your phone stays until you delete it or the App’s data.
Learning counters from marked stops: until you unmark the stop, use “Forget what the assistant learned from my stops” in Settings, or delete your account. They do not expire with a saved summary.
Recent searches and local settings: on your device until you clear the App’s data; the synced copy until you delete your account.
Suggestions and feedback: kept for as long as they are needed to handle them and improve the App, and deleted when you delete your account (the copy in our mailbox is deleted when you ask by email).
Usage accounting and per-installation activity: the installation record and the daily counters are deleted when you delete your account. The usage records (provider, feature, units, estimated cost) are kept for as long as they are needed for cost control, but without your account identifier after you delete your account.
Deletion marker: when you delete your account we keep for 31 days a one-way cryptographic hash of your account identifier and the time of the deletion, so that a sign-in token issued before it (for example on another phone) cannot recreate data. It cannot be reversed to your account, and it is deleted automatically afterwards.
Crash reports (Sentry): rolling 90 days.
Crash reports (Firebase Crashlytics): kept by Google for 90 days, as documented by Firebase.
Backend logs: rolling 7 days on Fly.io.
Backups: database dumps; the 14 most recent are kept.

What is deleted when you delete your account, and the little that is kept without any link to you, is detailed on the account deletion page.

6. Your rights (GDPR and nFADP)

You can, at any time:

Access your data: Settings → “Download my data”. For data that download does not include, write to privacy@mytravelpal.io.
Delete your account: Settings → “Delete my account” deletes your account record (email, name and sign-in provider), profile, saved trips, monitoring and alerts, notification identifiers, vehicles, installation records, suggestions, shared trips, group sessions, saved drive summaries and learning counters. Usage statistics are kept without your account identifier. Details are on the account deletion page. If you cannot use the App, write to privacy@mytravelpal.io.
Correct your data: edit your profile at any time from the App.
Withdraw your consent: for the AI profile, you can delete your preferences under Settings → AI Personalisation. For feedback with an email, write to privacy@mytravelpal.io. Trip alerts can be turned off in the App, and device permissions (location, contacts, notifications) can be revoked in the system settings.
Object to processing and request its restriction: write to privacy@mytravelpal.io, or sign out and uninstall the App.
Lodge a complaint: with your national data protection authority (in Spain, the AEPD — aepd.es) or with the Swiss Federal Data Protection and Information Commissioner (FDPIC).

For requests you cannot resolve from the App, write to privacy@mytravelpal.io. We reply within 30 days at most.

7. Children

MyTravelPal is not directed at children under 13. We do not knowingly collect data from children. If you believe we have inadvertently collected data from a child, contact us so we can remove it immediately.

8. International transfers

The server and the database run in the EU (Fly.io’s Paris region), and the data controller is based in Switzerland. Sentry stores reports in its EU data region. Some providers in the table above (among them Anthropic, Resend, Google, Cloudflare, HERE, NASA, USGS and Wikimedia) are headquartered or process data outside the EU and Switzerland; in that case they act under the European Commission’s standard contractual clauses or equivalent mechanisms. Booking.com, TheFork and GetYourGuide receive only the public URL parameters when you tap their links.

9. Security

All communication between the App and our server uses HTTPS; the hosting redirects any HTTP connection to HTTPS. The App’s optional biometric lock works only on your device.

10. Website

The mytravelpal.io website is static and hosted on Cloudflare. We use no cookies, analytics or third-party resources. It stores only the language you choose in your browser (local storage). Like any web server, the hosting provider processes technical connection data, such as the IP address, to serve the pages.

11. Changes to this policy

We may update this policy as the App evolves. Material changes will be announced inside the App before they take effect. The “Last updated” date reflects the version in force.