Privacy Policy

• Account details. Your display name, email address and profile picture, as your sign-in provider gives them to us — Google, Microsoft, or the address and password you registered. We never see your password. And the About paragraph, if you write one on your profile.
• Your travel records. Flights, hotels, car hire and other bookings, trips and itineraries, places, budgets and expenses, documents you upload, and the confirmation emails you forward.
• What you write and post. Notes, published posts, questions, answers, comments, tags, photographs, and the messages you send. For a photograph you post in Explore, also the month and the time of day it was taken (morning, evening…), read from the photo on your device. Never the date or the hour. When you post a snapshot, where a photo was taken is also read on your device to suggest the place: it is sent once to look up places nearby and is never stored, and the photo you post carries no location.
• Social connections. Who you follow, friend requests, who is on a trip with you, and which friends you chose to share your travel with.
• Device tokens, if you allow notifications — an identifier for an app install, so a gate change or a message can reach it.
• Location only when you send it: sharing a place or a live location in a chat stores a coordinate. We do not track your location in the background.
• Usage and cost telemetry. Counts of billable operations — a search, an import, a map load — recorded against your account so we can see what the service costs to run. It is counters, not a log of what you looked at.
• How the product is used. A record of actions, so we can see whether the features work: that you opened the app on a given day and whether a trip of yours was in progress, that a trip was created (and whether from a post), that an invitation was sent or accepted, that a post or a poster was shared, and the link you first arrived by when you signed up. Also: which version of the app you run and in which language; when a Pro feature asked you to upgrade, and whether you went on to the checkout; a booking added, corrected or deleted (which fields changed, never what they say); a post published, an answer, a comment, a save, a report or a block; and each notification we sent and whether it was opened. These are identifiers, kinds, counts and dates — never the text you wrote, a place name or where you were. They are first-party: nothing goes to another company.
• How the app behaves on your device. For each visit, how long it lasted, which screens it opened and how long the main ones took to show; and when the app crashes, freezes or hits an error, a report of where in our code it happened. A crash report names our code, never your content. The app’s Share usage data setting stops these and the actions your device reports (a share, a paywall seen, a notification opened); the rest describe what our server did and are part of running it.
• Searches that found nothing. When a search of posts or questions finds nothing, its words are kept, lower-cased and with no account attached, so we can see what people look for and do not find. A search for a person is never kept.
• Technical data that any web service receives: IP address, browser or device type, and timestamps, in server and CDN logs.

Mail sent to trips@imprint-travel.com is stored in our cloud storage, then read by a language model that extracts the booking — the airline, the flight number, the dates, the confirmation number — and writes it into your account. The message text or attachment is sent to that model to do it.

Mail sent to import@imprint-travel.com is for past trips. It is stored and read the same way, one booking email or file at a time, but nothing is written into your account until you have reviewed the trips it found on the import screen. Its stored copy is deleted 30 days after it arrived.

Two protections matter here. Attribution happens before the reading: mail from an address no account has confirmed is logged and discarded without ever going to a model, so a stranger’s travel details are never parsed or stored. And an address is only attributed once its owner has clicked a confirmation link sent to it, so nobody can point your mail at their account.

You can see every forwarding address on your account, and remove one, in the app’s settings. Removing it stops attribution from then on.

To run the service you asked for: to file your bookings, build your itineraries, track a flight you saved, show your posts to the people you published them to, deliver your messages, and bill a subscription. To keep the service safe — handling reports, stopping abuse and preventing one account reaching another’s data. To keep it working, through error logs and the cost counters above. And to meet legal obligations, such as keeping records of a payment.

Where the law requires a legal basis, ours is the performance of our contract with you for everything the product does, our legitimate interest in security and in keeping the service running, your consent for notifications and location, and legal obligation for financial records.

We use these providers to deliver the product. Each receives only what its job needs, and none of them is permitted to use your data for their own purposes.

• Amazon Web Services — hosting, databases and file storage, in the United States. Also the mail service that receives your forwarded confirmations and sends ours, and an image-screening service that checks photographs posted in Explore against our content standards.
• Google (Firebase) — sign-in and identity, and Android push notifications.
• Google Maps and Places — searching for a place, its details and its photographs. A place you search for is sent to Google.
• OpenRouter, and through it DeepSeek, Google Gemini, OpenAI and Anthropic — reading a forwarded or uploaded booking (only the booking document, and only when you forward or upload one), writing a suggestion when you ask for one (writing with AI, below), planning a trip when you ask for one (planning a trip with AI, below), and suggesting places to add to a trip when you ask (suggestions on a trip, below).
• FlightAware and FlightRadar24 — flight schedules, status and positions. They receive a flight number and date, not your identity.
• TripAdvisor — hotel details and photographs.
• Apple — iOS push notifications, and purchases made in the iOS app. Google Play for purchases made in the Android app.
• Stripe — payments made on the web. Card details go to Stripe and never reach our servers.
• Wikipedia — city photographs, where a place has no other picture.

We also disclose data where the law compels it, and to protect someone’s safety. If the business is ever sold or merged, your data moves with it, and we will say so before it does.

Writing with AI. When you choose Write with AI in a Find, a question or a snapshot’s caption, what you have written there (its title, its text and the names of the places on it) goes through OpenRouter to the model that writes the suggestion: OpenAI, Anthropic or DeepSeek. It is sent only when you choose an action, and used only to write that suggestion. We do not keep the text or the suggestion; we keep a count of how many you used each day. Nothing is posted until you post it yourself.

Planning a trip with AI. When you ask Imprint to plan a trip, what you type or say, and any change you ask for afterwards, goes through OpenRouter to the model that writes the plan: Anthropic, Google or OpenAI. With it go today’s date and your time zone, so that “next Saturday” is yours, and up to 30 places in that city for the plan to use: from your own Bucket list, and from public Finds. Speaking into the planner uses your device’s speech recognition, and we never receive the audio: on an iPhone it runs on the phone where your language allows; on Android and in a browser it is the phone’s or the browser’s own service (Google’s in Chrome and on most Android phones, Apple’s in Safari), under that company’s policy. We keep the plan for 24 hours so that you can come back to it, then it is deleted. What we keep after that is numbers about it (how long it took, what it cost, how many places it had and how many you kept), never its words. The places in it are looked up with Google Places only when you keep the plan as a trip or a note.

Suggestions on a trip. When you ask for suggestions on a trip, a shorter route through each day, a place on the day it is nearest and a place planned on a day it is closed are worked out on our own servers from the trip itself; nothing goes anywhere for those. For places worth adding nearby, the trip’s days go through OpenRouter to the model that suggests them (Anthropic, Google or OpenAI): each day’s date and the town it is spent in, the names and times of the places on it, and up to six places near them from your own Bucket list and from public Finds and snapshots. Never your notes, costs, links, confirmation numbers or who is on the trip. A place the model names is looked up with Google Places only when you add it. We keep the suggestions for 24 hours, so that an applied one can be undone, and a count of how many times you asked each day.

AI apps you connect. If you connect ChatGPT, Claude or another AI app to your account (Plan with ChatGPT or Claude), it can do only what you allowed on the consent screen: read your trips day by day, create trips and add places to them, search and read public posts, and post questions, Finds and Snapshots for you. What it reads — a trip, a post — is then held by that company under its own privacy policy, not ours; we never send it confirmation numbers, costs, your messages or your contacts. Places it names are looked up with Google Places, as when you search in the app. We keep a record that the app is connected, when it was last used, and which posts it made, and only a hash of the sign-in tokens it holds. Disconnect it at any time in Passport → Settings → Connected apps: its access stops at once. Deleting your account disconnects every app.

A published post is public with no account. Its text, photographs, place cards, tags, your display name and your profile picture are readable by anyone at a permanent address, and served to search engines. Its comments are public too.

Liking, saving or commenting on a post, answering a question and following someone is shown to the person it concerns, with your name and picture, in their activity list.

A shared trip is visible to everyone invited to it, including its album, its bookings and its dates. A trip’s invite link shows anyone who opens it the trip’s name, city, dates and cover, the organiser’s name and picture, and how many people are going; anyone with the link can join until the organiser resets or turns it off. Your profile — name and picture — is visible to people who find you in search, receive a friend request from you, or read something you posted.

Your Passport, as other people can see it. If you turn on your public Passport page (it is off until you do), anyone with its address, search engines included, can see your name, picture and handle, your level, rank and badges, how many cities, flights and miles you have, and which countries you have been to. Your friends can compare their Passport with yours and see the same facts. Neither ever shows a date, a city, an airport or where you live, and turning off Show my travel record hides your countries from everyone, friends included.

Your travel record in Explore. People signed in to Imprint Travel see your level beside what you post and, on your traveller card (opened from your name), your rank, badges, followers, how many answers you have written, and your posts. While Show my travel record is on, which it is until you turn it off, they also see the countries you have been to, a line such as “Been to Kyoto 2×” on your posts and answers about a city you have visited, and the city you know best. Only trips that have ended count, shown as months and never as dates, so a trip you are on or have booked never shows. Lives in shows only if you type it, and so does the About paragraph you write in your profile settings, which is also on your public Passport page while that page is on. Turning the switch off hides where you have been from everyone, friends included; your level, rank and badges still show. The card is never shown to people without an account or to search engines, and nothing you have saved is ever on it.

Snapshots you are tagged in. A friend can tag you in a snapshot they post. Your name then shows on it to signed-in people who can see it and on your traveller card, you are told, and you can remove the tag.

Questions about places you know. If you turn on Happy to help (it is off until you do), the cities you have been to are used to choose whom to ask when someone posts a question about a city, at most three times a week. The person asking does not see who was asked.

Travel you share with a friend. You can choose, friend by friend, to share your travel (it is off until you pick someone). A friend you picked sees, on the day, a flight of yours that leaves that day or is in the air, with its number, airports, times and status, and the city of a trip you are on that day. Never a booking reference, a seat, a hotel or the trip’s name. Ending the friendship ends the sharing.

Everything else is private to your account: your trips, your notes, your flights, your imports, your messages, your saved places, and your Passport page unless you turn it on. Nothing is visible to people without an account unless you chose it; the travel record above is shown to signed-in people until you turn it off.

We use no advertising cookies and no third-party analytics trackers. The app stores a few things in your browser to work: your sign-in session, and small preference keys for theme, language and units. Chat keeps unsent messages in your browser’s local database so they survive a lost connection, and sends them when you are back.

On a phone, the app keeps a copy of your conversations in its own storage, with their photographs and voice notes, and videos you played or received on Wi-Fi, so your chat history is there without a connection. The copy belongs to the account that is signed in: signing out keeps it unless you choose Sign out and remove chats, and deleting your account removes it from that phone. Like the rest of the app’s data, it is included in your phone’s own iCloud or Google backup if you have that turned on. You choose how long each phone or browser keeps it: 30 days, a year or for ever.

You can also back your chats up yourself, to a folder you pick in iCloud Drive, Google Drive or on your phone (Settings → Chat backup). The backup is encrypted on your phone with a key we keep for your account, so Apple and Google cannot read it; we could, as we can read a message while our servers hold it. The files stay in your folder until you delete them. Deleting your account deletes the key, which leaves every backup of it unreadable.

The web app keeps the same copy in your browser’s local database, with photographs and voice notes, and videos you played, so your chats open without a connection there too. It belongs to the account that was signed in, stays on that computer until you sign out with Sign out and remove chats or clear this site’s data, and is removed from that browser when you delete your account there. We cannot see or reach it.

If Share usage data is on, the browser also queues a short list of actions (a post shared, a poster shared) and sends it to us in a batch; turning it off discards the queue. The link you first arrived by is remembered for 30 days so it can be sent when you sign up.

Clearing site data signs you out and discards those preferences and any unsent message.

Your records stay while your account is open, because the point of the product is to keep them. The record of how the product is used is kept for 13 months, and only weekly totals after that; visits, crash reports and the words of searches that found nothing are kept for 90 days. Files you upload to import bookings are deleted 30 days after the upload; what was read from them stays as your bookings. Deleting a trip, note, post or booking removes it from the app. Photographs and files in a shared trip album are kept while the album exists and are moved to colder storage after 90 days rather than deleted, so an old thread does not lose its pictures.

Chat. Messages, and the photographs, voice notes and videos in them, are kept on our servers while the conversation exists, so they reach each of its members on every device; files move to colder storage after 90 days. They are encrypted in transit and at rest but not end to end, so our servers can read a message while they hold it. The sender of a message, or the owner of a group (for a trip’s chat, the trip’s owner), can delete it for everyone within two days of sending it: its words and file are removed from our servers at once and from backups within 7 days, and the app removes it from every device running a current version. Anyone in a chat can turn on disappearing messages (24 hours, 7 days or 90 days): each message sent after that is deleted from our servers, and from every device running a current version, that long after it was sent. If you report a conversation, the last five messages from that person or group go with your report and are kept for a year after the report is closed. If the law requires us to preserve a conversation, we keep a copy of it, including messages deleted in the meantime, for as long as that requirement lasts and no longer.

Closing your account deletes your records, your content and your uploads. What survives is bounded and listed: database backups age out within 7 days, server logs within 14, files you uploaded to import bookings within 30, and a raw copy of any booking confirmation you forwarded within 90. Messages you already sent stay in the threads you sent them to, and a copy someone else already saved of something you published is not ours to delete. The whole list is on Delete your account.

You can access, correct, export or delete your data. Most of it you can change or delete in the app directly. You can delete your account yourself, from the app: Passport → Settings → Account → Delete account, which removes it immediately. Delete your account sets out the steps, exactly what goes, what is kept and for how long.

If you cannot sign in, or you want an export or a specific piece of data removed rather than the whole account, write to support@imprint-travel.com from the address on your account, or use the support form. Either way we action it within 30 days.

Depending on where you live you may also have the right to object to or restrict certain processing, to withdraw consent — turning off notifications, removing a forwarding address — and to complain to your local data protection authority. We do not sell personal information and we do not share it for cross-context behavioural advertising.

Imprint Travel is not for children under 13, or under 16 where local law sets that floor, and we do not knowingly collect their data. If you believe a child has an account, tell us and we will remove it.

Our servers and storage are in the United States, and the providers above may process data elsewhere. If you are in the UK, EEA or another region with transfer rules, the transfer relies on the standard contractual clauses or an equivalent mechanism in our agreements with those providers.

Traffic is encrypted in transit and data is encrypted at rest. Credentials and API keys are held in a managed secrets store rather than in configuration, every private endpoint requires a verified identity token, and access is scoped to your own account.

No service is perfectly secure, and we will not pretend otherwise. If a breach affects you, we will tell you and the relevant authority as the law requires.

We will update this page when the product changes, and the date at the top says when. For a material change — a new processor, a new category of data — we will give notice in the app or by email. The Terms of Service and the content standards sit alongside this document.

MelonTech AI, operator of Imprint Travel — support@imprint-travel.com.