Privacy Policy

Nothing here is inferred or bought. All of it is either needed to sign you in, or something you typed.

Your account

• Your email address: it is how you sign in and how a trip is shared with you by name.
• A password, only if you set one. It is stored hashed by our authentication provider and is never visible to us or to you again.
• A first name, if you give one, so your name rather than your address appears to people you plan with.

What you put in a trip

• The itinerary: countries, cities, arrival and departure dates, and your own notes on each.
• Stays and transport: names, booking links, prices, dates, and whatever you wrote in the notes.
• Money: income and expense entries (date, category, amount, currency and your note on each). This is financial information about you, and it is the most private thing in the app. It is never shown to followers.
• Check-ins: the place, a rating, your comment, and when it happened.
• Photos you attach to a check-in.

Sharing

• Who you invited to a trip and whether they can edit or only view.
• The follow links you created. The link itself is stored hashed, and we keep the first six characters so you can tell your links apart in the list, and nothing more.

Notifications

• If you turn on push, the address your browser gives us for your device plus the keys needed to encrypt a message to it. It identifies a browser on a device, not you.

This list is as much the point as the one above it.

• Not your location. The app never asks your device where it is. A check-in is placed by the city you picked, not by GPS.
• Not the location in your photos.Photos are re-encoded on your phone before upload, which discards the camera's embedded data (GPS coordinates, camera model, timestamp), so what leaves your device is the picture and nothing else.
• No analytics and no tracking. There is no analytics service, no advertising identifier, no third-party tracker and no cookie banner, because there is nothing to consent to. The only cookies are the ones that keep you signed in.
• No payment details. The app takes no money, so it holds no card.
• Nothing is sold or shared for advertising. Ever.

Your account and your trip content are processed to provide the service you asked for, which is performing our agreement with you. Push notifications and email digests are processed on consent, which is why nothing is sent until someone switches it on, and why a single tap switches it back off.

The service runs on a small number of providers. Each does one job.

• Supabase: the database, the sign-in system and photo storage. Your data lives here, in Ireland.
• Vercel: hosting. The server code runs in Dublin, Ireland.
• Resend: sends the emails: sign-in links, trip invitations and follower digests. It handles the address the mail is going to.
• Your browser's push service: if you turn push on, the notification travels through the service your browser uses (Google, Mozilla or Apple, depending on the browser). The content is encrypted to your device.

Photos are stored at web addresses that are impossible to guess, but they are not behind a sign-in check. Anyone who has the exact address of a photo can open it. In practice that address only ever reaches people you shared the trip with, but it means a photo URL, once passed on, keeps working. Treat a photo you upload the way you would treat one you texted to somebody.

A follow link opens for anyone who has it: no account, no sign-in. Follow along and we store nothing about you at all.

Ask for email digests and we store your email address and whether you confirmed it, so we can send them and stop when you say stop. Turn on push and we store your browser's push address in the same way. Every digest carries an unsubscribe link that works in one click and needs no account. Unsubscribing deletes the record; it does not merely mute it.

Followers never see money, private notes, bookings or exact positions. They see the route, the dates, check-ins and the comments shared with them.

Your content stays until you delete it. Delete a trip and its contents and photos go with it. Revoke a follow link and that address stops working immediately for everyone holding it.

Deleting your account, from Account → Delete account, removes the trips you own along with their photos, removes your place on trips you had joined, and removes your sign-in. There is no undo, no grace period and no backup copy we can restore from. We say so plainly because the button means it.

KeepYourHabits Ltd is a company registered in the United Kingdom, so the UK GDPR and the Data Protection Act 2018 apply to what it does with your data. The service is also offered to people in the EEA, so the EU GDPR applies as well. The rights below are the same under both.

You can ask for a copy of your data, ask for it to be corrected or erased, object to how it is processed, ask us to restrict it, or ask for it in a portable form. Most of that you can do yourself and instantly: the app exports your trip and your money ledger as files, and deleting your account is a real erasure rather than a request that goes into a queue.

For anything else, write to privacy@keepyourhabits.com and we will answer within one month.

If you are not satisfied, you can complain to the UK's Information Commissioner's Office (ico.org.uk). If you are in the EEA, you can complain to your own country's data protection authority instead.

Our representative in the EU, for the purposes of Article 27 of the EU GDPR, is [eu representative: not set yet]. People in the EEA may contact them about anything on this page as an alternative to contacting us directly.

The company is in the United Kingdom and the service runs on providers in Ireland, so your data moves between the UK and the EEA in the ordinary course of the service working. Both directions are covered by adequacy decisions (the EU recognises the UK, and the UK recognises the EEA), so no extra safeguard is needed for that leg.

Where a provider is based outside those, it is used under the standard contractual clauses its own terms provide.

This is not a service for children, and it is not directed at them. We do not knowingly collect anything from a child under 16. If you believe a child has an account, write to us and it will be removed.

If this policy changes in a way that affects what we collect or who sees it, the date at the top changes and anyone with an account is told before it takes effect. Small corrections are made quietly, and the date still moves.

See also the Terms of Service.