Privacy Policy
1. What We Collect
- Account info: email, password (hashed), display name, gender, birth year, optional avatar
- Home location: a city you pick — stored as a single point, not real-time GPS
- Emergency contact (optional): name, phone, relation — used only when you tap "Share trip"
- Listings & messages: trip postings, chat messages, join requests, reviews
- Device info: Expo push token (so we can notify you), app version, OS
- Compliance timestamps: when you accepted ToS / Privacy / 18+ confirmation
2. What We Do NOT Collect
- Real-time GPS or location tracking
- Contacts, photos (other than the avatar you choose), or device identifiers beyond push tokens
- Payment information (the Service is free for v1)
- Biometric data
3. How We Use Your Data
- To match you with travel companions based on destination and dates
- To enable chat between matched users
- To send push notifications about messages, join requests, and trip events
- To display your public profile (display name, avatar, reviews) to other users
- To enforce safety features (rate limits, blocks, reports)
4. Who Sees Your Data
- Other users: your display name, avatar, home city, gender, and reviews you've received
- Emergency contacts (only when you share a trip): trip destination + dates + your name + co-travelers' names
- Service providers: Supabase (database + auth), Expo (push notifications), Google Places (geocoding only — no personal data sent), Pexels (anonymous photo lookup)
- Nobody else. We do not sell, rent, or share data with advertisers
5. Trip Sharing Links
When you generate a trip-share link, an unguessable 16-character token is created. Anyone with that link can view the trip summary (no login required) until 7 days after the trip end date, at which point the link expires. You can see how many times each link has been viewed.
6. Data Retention
- Active accounts: data is kept while the account is active
- Soft-deleted accounts: 30 days, then permanent deletion (GDPR compliant)
- Reviews: kept even after account deletion, but shown as "Deleted user"
- Messages: deleted when one party deletes their account; the other party loses access
- Chat logs: retained for 90 days for safety / abuse investigation
7. Your Rights
- Access: email us for a copy of your data
- Correction: edit your profile in-app at any time
- Deletion: use Settings → Delete Account, or email us
- Withdrawal of consent: deleting your account withdraws consent for further processing
8. Security
Passwords are hashed. Session tokens are stored in iOS Keychain / Android Keystore (not plain storage). All data in transit is encrypted via HTTPS. Database access is restricted by Row Level Security so users can only access their own data + data shared with them.
9. International Transfers
Your data is processed by Supabase (Postgres) in their hosting region. If you are in the EU/EEA, data may be transferred outside the EU subject to standard contractual clauses where applicable.
10. Children
Travel Buddy is for users 18+ only. We do not knowingly collect data from anyone under 18. If you become aware that a minor is using the Service, please report it to support@travels-buddy.com.
11. Changes
We may update this policy from time to time. The version number will change and active users will be prompted to re-accept on next launch.
12. Contact
Privacy questions or data requests: support@travels-buddy.com