Privacy Policy for TravelYou
Effective date: October 3, 2026
TravelYou is a mobile application (the "App") developed and operated by Byte Sized App ("we," "us," or "our"). This policy explains what information the App collects, why, and what you can do about it. It applies to the iOS and Android versions of the App.
The short version: TravelYou is built privacy-first. Creating trips works entirely on your device. Nothing leaves your phone unless you create an account or explicitly share a trip — and we collect nothing we don't need. We show no ads, run no analytics, and do not sell your data.
1. What we collect
Photos and the data inside them (only when you share a trip)
The App's main feature is building a visual map of your trips from your own photos. When you create a trip, the photos stay on your device. If you choose to share a trip (publish it to a link others can open), we upload:
- The photos you put in that trip.
- The GPS coordinates and timestamp embedded in each photo's metadata (EXIF data) — this is how we plot them on the map and order them in time.
We never access photos you don't explicitly pick.
Account information (when you create an account)
- Your email address, which identifies your account.
- Your display name and optional profile picture, if you set them.
- An internal account ID.
If you sign in with Google, your email and name come from your Google account at the moment you tap "Continue with Google." If you sign in with Apple on iOS, they come from Apple — including Apple's "hide my email" relay address if you choose it.
Trip content (when you create or share trips)
Trip name, description, start/end dates, mood, and visibility setting (private or public). Shared trips also include the photos and location data described above.
Basic activity data
We record when your account was last active. We use this only for basic account housekeeping — not for advertising or analytics.
Crash reports (only when the App crashes)
If the App crashes, our crash-reporting service (Sentry, sentry.io) receives a crash report so we can find and fix the bug. A crash report contains the technical details of the failure: the code path that failed (a stack trace), your device model, the operating system version, and the App version. It does not contain your photos, trip content, account details, or location data, and it is not linked to your account. Crash reports are stored on Sentry's servers in the United States.
2. What we do NOT collect
- No ads, no advertising identifiers, no cross-app tracking, and no analytics or usage-measurement tools (no Firebase Analytics, no heatmaps). The only exception is crash reporting: if the App crashes, we receive a technical crash report so we can fix the bug (Section 1).
- No device location from your phone's GPS — only the coordinates stored inside photos you select.
- No financial, health, or contact-list data.
3. Where your data is stored (third-party services)
We are a small team, so we build on trusted infrastructure. The services below process data on our behalf under their own privacy policies:
| Service | What it holds for us |
|---|---|
| Supabase (supabase.com) | Your account (auth) and trip metadata — it hosts our database |
| Cloudflare R2 (cloudflare.com) | Photos from shared trips, served from photos.travelyou.app |
| Google Cloud (cloud.google.com) | Our app server (where the App talks to) |
| Sign-in handshake when you choose "Continue with Google"; map rendering on Android | |
| Sentry (sentry.io) | Crash reports — the technical details of App crashes, used to fix bugs |
We don't sell your data and we don't share it with anyone other than the services listed above.
4. A note about location
TravelYou does not turn on your phone's location services and does not ask for location permission. The only "location" we see is the GPS coordinate stored inside a photo when it was taken (this is standard EXIF metadata, present in most camera photos). We read it only from photos you explicitly select, use it only to plot that photo on your trip map, and — for shared trips — store it alongside the photo. If a photo has no GPS data, we simply don't plot a pin.
5. Permissions the App requests
- iOS / Android: photo library access — so you can pick photos for your trips (and so we can read the location embedded in them). On iOS you may grant access to all photos or only selected ones; the App works with either.
- Android only: media location access — reads the GPS data inside photos you select.
That's the complete list. The App requests no other permissions (no camera, no contacts, no device location, no notifications).
6. Sharing trips
Trips are private by default. A trip becomes visible to others only when you explicitly share it; then anyone with the link can view it (photos, map, and trip details). You can stop sharing or delete a trip at any time.
7. How long we keep things, and how to delete them
- Delete a trip in the App: its photos are removed from our storage as soon as the server receives the request. The trip record itself is kept briefly (up to 30 days) so the deletion can propagate to your other devices, then it is permanently purged.
- Delete your account: email us (below) and we will delete your account, profile, and all associated trips and photos. Step-by-step instructions are on our Account Deletion page. (There is no in-app account deletion yet — we are building it; until then, the email route works.)
- Crash reports: automatically deleted after 30 days, in line with Sentry's retention period for our plan.
- Backups: we maintain periodic backups of our systems for disaster recovery. Deleted data may remain in backup copies for up to 30 days, after which it is automatically deleted. Backups are not used for any other purpose.
8. Your rights
Depending on where you live (for example, the GDPR in Europe or the CCPA/CPRA in California), you may have the right to:
- Access the personal data we hold about you.
- Correct it.
- Delete it.
- Object to or restrict its processing.
We do not sell your personal information, and we do not "share" it in the CCPA sense (no advertising or tracking purposes). To exercise any of these rights, email us at the address below — we will verify your identity and respond within a reasonable time (and within 30 days where the law requires it). You can also delete most data yourself in the App (Section 7).
9. Security
All communication between the App and our servers happens over encrypted connections (HTTPS/TLS). Photos are uploaded to object storage using short-lived, single-use credentials. Database access is restricted to our server. No password or token is stored in plain text on your device beyond what the authentication system requires.
10. Children
The App is not directed at children under 13, and we do not knowingly collect personal information from them. If you believe a child has provided us personal information, contact us and we will delete it.
11. Changes to this policy
If we change how we handle your data, we will update this policy and the effective date above before the changes take effect. Material changes to a live App will also be noted in the App's release notes.
12. Contact
Questions, requests, or deletions: [email protected]