Privacy Policy

1. Who we are

Tralupo is an adaptive travel-planning application for iOS. The data controller responsible for the personal data described in this policy is Adi Roth, an individual operating Tralupo from Kiryat Motzkin, Haifa District, Israel. In this policy, “we”, “us” and “Tralupo” mean Adi Roth operating Tralupo.

You can reach us about anything in this policy, including any request about your own data, at privacy@tralupo.com.

2. What we collect

Tralupo asks for as little as it can and still plan a trip for you. Most of it is optional, and the app tells you at the point of asking why it wants something.

Your account

Your sign-in details. You can sign in with Apple, Google, or a six-digit code sent to your email. Supabase manages the signed-in session for us. If you choose Apple or Google, that provider sends Supabase an identity token and the account information you authorise it to share, which may include your name and email address. Tralupo does not receive or store a password for any of these methods.

When you request an email code, Supabase uses Resend to deliver the six-digit message. Resend receives the destination email address and the delivery metadata necessary to send and troubleshoot that email.

Your traveller profile

• Display name — what the app calls you.
• Date of birth (optional) — used to pace your days. Your age is worked out when a plan is generated. The derived age is included in the generation instructions and therefore in the generation record described below.
• Home country (optional) — a country, not a city or an address. Home country is a profile preference, not your current location. Optional location use for Vibe Food is described below.
• Questionnaire answers — your interests, preferred pace, how early you like to start, how far you like to walk, how you feel about crowds, and any needs you tell it about.
• Anything you type in a free-text box, such as “anything else I should know?”

Your trips

• Trip name, destination countries and cities, start and end dates, time zone, and your arrival and departure times where you provide them.
• Who is travelling — the party type (solo, couple, friends, family) and the number of travellers. Not their names or details.
• Per-trip answers, which can override your profile for that trip only.

What the planner produces and records

• The generated itinerary — days, stops, times, and the one-line explanation attached to each stop. Because those explanations refer back to what you told us, the itinerary itself restates your preferences.
• A snapshot of the inputs used for each generation, so a plan can always be traced to the answers it was built from.
• A technical record of each generation, including the full text of what was sent to and returned by the AI model, plus timings and token counts. This is a debugging and quality record. Because the instructions sent to the model include your profile details, that record contains them too — see section 4.

Optional location for nearby food (Vibe)

When you tap Start exploring in Vibe, the app asks for foreground location permission. If you allow it, your phone's coordinates, which may be precise, are sent to our authenticated backend and Google Places to find nearby restaurants as you walk, together with your filters and any dietary requirements you have shared, as search words. Location watching and discovery requests stop when the map loses focus or the app backgrounds. We do not request background location access. You can deny or revoke permission in iOS Settings.

The backend holds your location, filters and results in a temporary account-linked in-memory exploration session lasting twenty minutes. Each result batch expires separately, after ten minutes by default. The app clears map place data on background. Individual List search results and opened place details remain only in memory until their original expiry, including when you briefly background the app. Feature exit, expiry and sign-out clear that content. It does not save a location history in our database. We retain an account-linked search usage record to enforce your allowance. One unit buys a twenty-minute exploration with up to six batches; older app versions retain their per-search allowance behavior. That record does not contain your coordinates.

For Vibe recommendations, Gemini receives restaurant shortlist details, approximate travel times, filters and food preferences from your profile, including dietary needs you have consented to share. Parallel receives restaurant names and locality for web research, with an internal session identifier. These requests do not send your phone's coordinates directly to Gemini or Parallel. Provider processing and retention are subject to their own terms; our session expiry does not delete a provider's records.

3. How we use it

• To plan your trips — the core of the service. Your profile and trip answers are what make a plan yours rather than generic.
• To keep your account — so your trips and profile are still there next time you sign in.
• To operate and debug the service — investigating a failed generation, fixing a bug, improving the quality of plans.
• To meet legal obligations and to protect the service against abuse.

Where the law requires a legal basis (for example under the UK/EU GDPR), we rely on performance of a contract for planning and account functions, legitimate interests for operating, securing and debugging the service, explicit consent for the needs described in section 6, and legal obligation where applicable.

We do not sell your personal information, and we do not share it for cross-context behavioural advertising.

4. AI and your data

Tralupo builds plans using a large language model operated by a third-party AI provider. This section is the detail behind that, because it is the part people most reasonably want to understand.

Which provider

Plan generation runs on Google’s Gemini models, called through Google’s API from our own backend. The app on your phone never talks to the model directly. The specific model version can change as models improve; the provider is recorded against every plan we generate.

We use the Gemini API as a paid service through a Google Cloud project with active billing. Under Google’s current Gemini API Additional Terms, Google says it does not use prompts or responses submitted to paid services to improve its products and processes those prompts and responses under its Cloud Data Processing Addendum.

Tralupo 1.0 does not enable Gemini’s Google Search Grounding tool. That does not mean destination research is limited to Gemini’s existing knowledge. Before Gemini writes the destination notes used in an itinerary, Tralupo uses Parallel, a separate research provider, to retrieve current destination information from web sources.

How a plan is built — and what is sent where

Generating a plan happens in four steps, and they deliberately do not all see the same thing.

1. Planning brief. Your trip details and your answers — including your derived age, home country, party, and any needs — are sent to the model so it can identify the destination topics to consider.
2. Destination research. For each topic, Tralupo sends Parallel a research objective containing a generic destination question, the destination and trip dates; one to three generic destination search queries; an internal generation job identifier; the Gemini model name; and search settings such as mode and result and excerpt-length limits. Parallel returns source URLs and titles, any available publication dates, and relevant excerpts. Gemini receives those source details and excerpts and uses them to write a destination brief. This step is deliberately impersonal: Parallel does not receive your identity, trip name, party, age, home country, profile or trip answers, dietary or accessibility needs, or free-text answers. The one exception: if you list must-see places, their names may be used as search terms so they can be researched and included — without anything that identifies you.
3. Place checks. Tralupo uses Google Places to find and confirm the restaurants and sights your plan can use. These searches contain the destination and generic place terms. If you have told us about dietary requirements, those requirements may be added as search words — for example “vegan restaurants in Rome” — so the plan can offer places that suit them. Google Places does not receive your name, email, account, trip name, accessibility or health needs, or free-text answers.
4. Composition. Those destination notes are combined with your profile and trip answers to write the itinerary.

What is stored afterwards

The finished itinerary is stored so you can open your trip again. Separately, we store a technical record of each generation which includes the full instructions sent to the model and its full response. That record exists so we can diagnose a bad or failed plan, and it therefore contains the profile details that were part of those instructions. Access to it is limited to people who need it to operate and debug the service.

Human review and automated decisions

Plans are generated automatically. Nobody reviews or approves your itinerary before you see it. Our staff may read stored generation records when investigating a problem or assessing plan quality, as described above.

Tralupo does not use AI to make decisions that have legal or similarly significant effects on you. A generated itinerary is a suggestion you are free to change, ignore, or delete.

Accuracy

5. Who we share it with

We share personal data only with the providers that make the service work, and only as far as each one needs. Some act as processors under our instructions; identity, App Store and payment providers may also process data under their own terms and privacy policies for the services you choose to use.

We may also disclose data where we are legally required to, to establish or defend legal claims, or to protect the rights and safety of users. If the business is ever transferred, your data may transfer with it, subject to this policy.

Operational logs

Our backend writes technical logs to help us keep the service up. These record the request method and path, the response status, a correlation identifier, and internal account or trip identifiers. Authorisation headers are stripped, and request and response bodies are never logged — so your answers, your plans and the AI prompts do not appear in them.

6. Dietary and accessibility needs

Tralupo lets you tell it about needs so that it can plan around them rather than leave you to work around the plan. The options include step-free access, avoiding stairs, keeping walking light, quiet places to rest, travelling with children, travelling with a pet, and dietary requirements including gluten-free, vegetarian, vegan, halal, kosher and nut allergy.

7. What stays on your device

Some data is stored locally on your phone, not on our servers:

• Your sign-in session, so you do not have to sign in every time.
• Saved trips and a profile snapshot, which let you read downloaded itineraries without a signal. These have no automatic expiry and survive app or phone restarts. Signing out keeps them on this device, accessible only after signing back into the same account. Deleting a trip removes its saved copy; deleting your account removes that account's saved data from this device.
• Drafts and preferences, such as a half-finished trip or your “learning from my trips” setting. Also cleared when you sign out.

Deleting the app from your device removes all of it. This website uses no cookies and no analytics; the only third-party requests it makes are to Google Fonts to load its typefaces.

8. How long we keep it

Your profile, trips and plans are kept while your account exists, because they are the service. When you delete your account they are deleted as described in section 10.

Generation records (section 4) are retained while your account exists and are deleted when you delete your account. Railway operational logs are retained for seven days on our current plan. We may keep information for longer where we are legally required to.

9. Your rights

Depending on where you live, you may have the right to:

• Access a copy of the personal data we hold about you.
• Correct anything inaccurate — most of it you can edit directly in the app.
• Delete your data (see section 10).
• Port your data to another service in a machine-readable form.
• Object to or restrict processing based on legitimate interests.
• Withdraw consent at any time, including for the needs in section 6. Withdrawing consent does not undo processing that already happened.
• Complain to your data protection authority. In the EU or UK that is your national supervisory authority; you are welcome to raise it with us first.

Residents of California and other US states with similar laws have equivalent rights to know, delete, correct and opt out, and the right not to be discriminated against for exercising them. Tralupo does not sell personal information or share it for cross-context behavioural advertising, so there is nothing to opt out of on that front.

To exercise any of these, email privacy@tralupo.com. We will respond within the time the applicable law allows, and we may need to verify that the request comes from you.

10. Deleting your account

You can delete your Tralupo account and everything attached to it. Deletion removes:

• your traveller profile, including your name, date of birth, home country and every questionnaire answer;
• every trip, with its dates, destinations and per-trip answers;
• every generated itinerary; and
• the generation records behind those itineraries, including the stored AI prompts and responses.

Your authentication record with our authentication provider is deleted as part of the same action. Deletion is permanent and cannot be undone.

Request deletion in the app, or by emailing privacy@tralupo.com from the address on your account.

11. Children

Tralupo is not intended for children or anyone under 18 years old. You must be at least 18 to create or use an account. The app asks you to confirm this before you can continue, but it does not ask for identity documents or send the device-local confirmation to our servers. We do not knowingly collect personal data from anyone under 18; if we learn we have, we will delete it. If you believe a child has given us their data, contact privacy@tralupo.com.

Telling Tralupo that you are travelling with children is a fact about your trip. It is not personal data about a child, and the app never asks for a child’s name, age or details.

12. Security

Traffic between the app and our backend is encrypted in transit, and data at rest is encrypted by our hosting providers. Sign-in uses Apple, Google or one-time email codes; Tralupo does not receive or store your identity-provider password. Every request to our backend is verified against your signed-in session, and the app has no direct access to the database. Authorisation credentials are stripped from logs.

No system is perfectly secure, and we cannot guarantee absolute security. If a breach affects your personal data and the law requires it, we will notify you and the relevant regulator without undue delay.

13. International transfers

Our providers may process your data outside your own country, including in the United States. Our database and authentication are hosted in Singapore, and our Railway backend also runs in Singapore. Google and our other providers may process data in additional countries where they operate.

Where data leaves the UK or the European Economic Area, we rely on an appropriate safeguard — an adequacy decision where one applies, or the relevant Standard Contractual Clauses with the provider. You can ask us for details of the safeguard used for a specific provider.

14. Changes to this policy

We update this policy when the app changes. The date at the top always reflects the current version. If a change materially affects how we handle your personal data, we will tell you in the app or by email before it takes effect, and where the law requires consent for that change, we will ask for it.

15. Contact us

Questions, requests, or corrections: privacy@tralupo.com.
Adi Roth, Kiryat Motzkin, Haifa District, Israel.

See also the terms and conditions, which cover what a generated plan is and is not.