Legal

Privacy Policy

EFFECTIVE OCTOBER 13, 2026

This policy explains what the travltime app and website collect, why, who it is shared with, how long it is kept, and how to delete it. travltime is operated by Strategiz LLC, a Florida, USA company ("we", "us"). Questions: support@travltime.ai.

1. Information we collect

Account information

You sign in with Apple or Google. We receive your name, your email address (Apple may give us a private relay address instead of your real one) and an account identifier from that provider. Our sign-in service, Cidadel, also keeps a random identifier for your device and records of sign-ins (time, IP address and device or browser details) to keep accounts secure.

Automatic Apple authorization cleanup is being prepared and is not enabled yet. When enabled, Cidadel will keep an encrypted Apple refresh token so it can ask Apple to revoke your authorization after account deletion. Your login account can be deleted while that request is still retrying. Accounts created before token retention may still need you to disconnect travltime in Apple Settings.

Your conversations and tours

We store what you send to your guide: the messages you type or dictate, the questions you ask during a tour, the place or trip you're planning, and the tours we create for you. If you choose to share them, this includes preferences such as how many adults and children are in your group and the children's ages, accessibility needs (for example wheelchair access, a stroller or avoiding stairs), dietary needs, budget, the occasion and any notes. These preferences can reveal sensitive information about health or beliefs. Share only what you're comfortable with. They are used only to plan suitable tours.

Location

With your permission, and only while you're using the app, travltime uses your device's location:

• Directions: when you navigate between stops, your current coordinates are sent to our routing server to calculate the route.
• Place search: when you search for a place, your current coordinates may be sent with the search so nearby results come first.
• Where you are: your phone turns your location into a general area (such as "neighborhood, city"), and the app sends that area with your planning messages so your guide knows where you are.
• Tour starts and finishes: usage measurement is on (see Usage events). Your phone checks whether you are near a tour's first stop when you start it, and whether it detected your arrival at the last stop when you finish. Only a yes or no is sent, never your coordinates.
• Verified completions: verified completions are being prepared and are not enabled yet. When they are, and you play a tour or trip that someone else made, each time the app detects your arrival at a stop it sends that single arrival point, rounded to about 10 meters, with the accuracy your phone reports for it. Our server checks that the point is near that stop and that the time since your last stop is plausible for the way you're traveling, then discards the point and keeps only which stop you reached. The app never sends a trace of your route, only these single arrival points, and only while the app is open.

We don't track your location in the background, and we don't save your precise location to your account or tour history. You can turn location off in iOS Settings at any time. The app still works, but you'll need to tell your guide where you are.

Voice

Talking to your guide is optional. When you use voice input, iOS sends your audio to Apple's speech recognition service to turn it into text. We receive only the resulting text, never the audio. The guide's spoken narration is produced on our own servers from the tour text.

Photos

Older builds let you pick a photo in chat as a local preview without uploading it. Current photo uploads, when enabled, require the separate explicit upload and permission steps described below; sending an ordinary text message does not upload a photo.

A separate photo-contribution feature is being prepared and is not currently available. When enabled, it will upload only photos you explicitly choose and confirm you own. Originals, including any embedded metadata, go to private Cloudflare R2 storage. Processing checks whether embedded location is near the selected tour stop and keeps only that yes/no result, then removes embedded metadata from the processed image and deletes the original image. We record your chosen reuse permission and the time you confirm it. Quarantined photos cannot be displayed or attached to tours. Before a processed photo can be approved for your private tour, we check it with Microsoft PhotoDNA or Thorn Safer, which compare it with known child sexual abuse material, and with Sightengine, an image moderation service that screens for sexually explicit and violent content. These services receive the processed photo only, never your account identifier or the original's location. A photo the moderation service flags for review is never approved and is deleted within a day. If a photo matches known child sexual abuse material, it is never shown, photo uploads stop for that account, and, as United States law requires, we report it to the National Center for Missing & Exploited Children (NCMEC) with the photo, the account identifier and the upload time, and keep the photo and the report record in restricted storage (see How long we keep it). Approved images are served only after an account-access check, and this private upload flow cannot publish them.

Public photo sharing is also being prepared and is not currently available. When it is, you can choose to share an approved photo you uploaded with the CC BY 4.0 reuse choice on the public page of the place it shows. Nothing is shared unless you ask. A shared photo becomes public: anyone can see it, and copy and reuse it under the Creative Commons Attribution 4.0 license, credited to your creator name with a link to a public page that shows that name and the photos you shared. Before a photo is first credited to a creator name, our AI moderation checks the name, as it does when you publish: the name alone goes to the AI providers in section 3, without your account identifier. We copy the processed photo, without its embedded metadata or location, to public storage served through Cloudflare, which checks it again against known child sexual abuse material. Other travelers can report a shared photo or block you, and a person reviews reports and can remove a photo. You can stop sharing a photo at any time: the public copy is deleted and your private photo stays. Deleting the photo, its tour or your account deletes the public copy too. Copies others made under the license while the photo was shared are outside our control.

Trips and optional sharing

Saved trips may include the travel dates and time zone you choose. Dates and private planning preferences are not included in a shared trip. When sharing is available and you choose to use it, anyone with your share link can read its published outline until the link expires or you revoke it. People you shared a link with may keep copies they saved before you revoked it. Publishing to Explore makes the chosen trip and creator byline publicly discoverable. Other travelers may retain copies they were allowed to make before you withdraw a publication.

Purchases and downloads

When paid features are available, Apple handles the payment. We receive Apple transaction identifiers, product and subscription status, purchase and expiry times, and a random token that associates a purchase with your travltime account. We use these records to verify access, restore purchases, handle refunds and apply build allowances. We do not receive your card number. When offline downloads are available, signed downloads are associated with your account and have an expiry date.

Creator features and tour progress

When these features are available, we store creators you follow, publications you save, reports and blocks you submit, and any ratings you are eligible to give. Your following list is private. If tour-progress reporting is enabled, the app sends the saved tour and revision, stop identifiers reached, and event sequence to our server. We record server receipt times, without uploading a raw location trace. Device-reported progress alone is not treated as a verified completion or used to award creator payments.

Verified completions, when enabled, use Apple's App Attest so our server can tell that arrivals come from the genuine travltime app on a real iPhone. Your iPhone creates a hardware key that never leaves the device; we store its identifier only as a SHA-256 hash, with its public key and a usage counter, linked to your account. For each tour or trip someone else made that you play, we record the stops you reached (never your coordinates; see Location), when, and the hashed device key. When you reach at least 70% of the stops of a published tour or trip (all of a trip's days count together), we record that verified completion once, with whether you had Pro or a Trip Pass active at that moment. Verified completions are what let you rate a publication, and they count toward a creator's completion totals and rewards. One iPhone counts once per publication, whichever account it is signed in to, and a creator's own account and devices never count toward their own work.

Booking links and reminders

When booking options are available, you can ask your guide for ticket options or a ticket reminder. Booking and reminder requests made in Guide are kept in the conversation like other Guide messages, including the tour and stop they are about, the booking options shown, the partner page you choose to open, and the date, time and time zone you give for a reminder. They are deleted with that conversation (see How long we keep it). When you choose a booking link, its provider opens in your browser and applies its own privacy policy. We may earn a commission through that link. Outside the conversation, our service log of a booking link being chosen names only the provider, without your trip, stop or account identifier. The reminder itself is a notification scheduled on your phone, which keeps its title, time and saved-tour reference. Scheduled reminders are removed from your phone when you sign out or delete your account.

Usage events

Usage measurement is on. travltime records a small, fixed set of its own usage events, linked to your account identifier. The app reports when you start a saved tour, reach its halfway point and finish it, naming the saved tour and its version, with the yes-or-no checks described under Location. Our servers record when you edit or adjust a tour (the kind of change, how long it took and whether it worked), when you prepare an offline download (whether it was a tour or a day), and when you start a tour someone else made (whether you play your copy or their edition, without naming the tour). A booking link being chosen is counted by provider only, without your account, trip or stop. These events never contain your coordinates, your messages or questions, or any other text you write. We use them to understand which features work, and to improve and run the app. We don't use them for advertising, we don't share them with other companies, and we don't use them to track you across other companies' apps or websites. We also record what producing each tour costs us, in AI tokens and seconds of narrated audio. These cost records carry no account identifier; a narrated-audio record for an offline download names the saved tour.

What we don't collect

We don't use advertising or analytics SDKs, we don't track you across other companies' apps or websites, and we don't collect your contacts or payment-card details. The usage events described above are the only usage analytics we keep, and they stay with us.

2. How we use your information

• To run the guide: understand your requests, plan and adjust tours, write and narrate stories about each stop, answer your questions, and give directions.
• To keep your tour history and conversations available to you across sessions.
• To secure your account, prevent abuse, and fix problems.
• To learn how tours are started, finished and edited and what they cost us to produce, from the usage events described above.

We do not sell your personal information, share it for cross-context behavioral advertising, or use it to build advertising profiles.

3. AI providers

To plan tours and answer questions, our servers send AI model providers, currently OpenAI and Anthropic, the information needed for that request:

• your recent messages to the guide;
• the trip location and your general area;
• the preferences you shared;
• your current tour.

We don't send your name, email address or account identifier with these requests. The app asks for your explicit permission before sending anything to these providers. You can withdraw it at any time in You → AI data sharing. Without it, the guide can't plan tours or answer questions until you agree again.

4. Other service providers

We share information only with the providers below, only for the purposes described, and we require them to protect it consistently with this policy.

• Apple: Sign in with Apple, speech recognition (see Voice), maps, turning your location into a place name on your device, and App Store purchases and purchase verification when paid features are available.
• Google: Google Sign-In, if you choose it.
• Hetzner: hosts our servers and database in the United States (Ashburn, Virginia).
• Photon (komoot): place search. It receives the search text and, when location is on, your coordinates. The request comes from our servers, not your device, and carries no account information.
• OpenStreetMap services, Wikipedia, Wikivoyage and Wikimedia Commons: facts and photos about places. They receive place names and the coordinates of places, not your location. Your device loads place photos directly from Wikimedia Commons, which sees your IP address.
• Placeholder images in older test builds: iPhone test builds older than 1.0.0 (9), meaning 1.0.0 (8) and every earlier test build (including the 0.1 versions), may load placeholder images from a third-party image service: a backdrop on the welcome screen, which sends that service your IP address, and a placeholder for a stop that has no photo, which sends your IP address and the stop's name or place identifier. Builds 1.0.0 (9) and later draw an on-device placeholder instead and send nothing to that service.
• Cloudflare: domain name service, forwarding of email sent to support@travltime.ai, and private storage for photo contributions when that feature becomes available, including the restricted storage described under Photos. A direct upload sends Cloudflare the selected photo and your IP address. When public photo sharing is available, photos you choose to share are stored and served by Cloudflare, whose CSAM Scanning Tool checks them, and your device loads shared photos from Cloudflare, which sees your IP address.
• Microsoft (PhotoDNA) or Thorn (Safer), and Sightengine: when photo contributions become available, safety checks of each processed photo you upload, as described under Photos. They receive the processed image only, with no account information.

We may also disclose information if required by law, or to protect the safety of our users or the public. When photo contributions are available, a photo that matches known child sexual abuse material is reported to NCMEC as described under Photos.

5. How long we keep it

• Conversations are deleted automatically 30 days after their last activity. Temporary copies held while a conversation is being processed expire automatically.
• Sessions (the link between the app and your account) expire 90 days after they're created.
• Tour history is kept until you delete a tour or your account.
• Offline download copies, when available, include the saved narration text, route, stop details and licensed-photo references so interrupted downloads can resume. Server copies expire within 30 days after preparation or renewal, with at most three copies per tour or day and 40 per account. Deleting the source tour, day or account removes its copies sooner. Content-free revocation markers may remain for up to 30 days to tell your phone a deleted download is no longer available; account deletion removes those markers too. Cached generated audio is shared by text hash, has no account identifier, and expires within 30 days or sooner when the cache fills.
• Private photo contributions, when available, stay quarantined until safety review approves them. Pending uploads are scheduled for deletion within 24 hours of preparation. Approved photos and their consent and review records remain until you delete the photo, its tour or your account; temporary originals are removed after processing. Cleanup retries during storage outages, so physical deletion may take longer. A short-lived empty upload lock can remain until upload permission expires; it contains no image. When photo contributions are available, a photo that matches known child sexual abuse material is kept in restricted storage for one year after detection, as United States law requires of a reported image, and its report record (the photo and scan identifiers, the account identifier and the times) is kept under the same legal hold. Deleting the photo, its tour or your travltime account does not erase that photo or record.
• Publicly shared photos, when available, stay public until you stop sharing them, delete the photo, its tour or your account, or a moderator removes them. The public copy is then deleted, normally within minutes, and cached copies expire within minutes after that. A removal keeps a content-free moderation record: the photo identifier, the reviewer's reason and the time.
• Your account is kept until you delete it.
• Trips, creator follows, saved publications and ratings are kept until you remove the applicable item or delete your account. Completion summaries, including verified completions, are deleted with the tour they belong to or with your account; those for an edition you played without making a copy are deleted with your account. Your App Attest device key records are deleted with your account. Temporary progress sessions expire after 24 hours. Share links expire after 90 days and can be revoked sooner.
• Local purchase-status and build-allowance records are removed when you delete your account. To prevent delayed purchase notifications or unfinished requests from restoring deleted data, and to prevent the same purchase being reassigned to another account, we retain keyed hashes of the deleted account identifier and purchase ownership identifiers, computed with a secret key that is stored separately from our database, together with the time the account was deleted, without a scheduled expiry. These restricted records contain no name, email address, trip content or raw purchase identifier; they are used only for deletion enforcement and purchase security. Content-free publication identifiers and moderation status may also remain so removed content cannot be restored through another traveler’s copy. Apple keeps its own purchase records under its policies.
• Apple authorization cleanup records, when enabled, retain the encrypted refresh token until Apple confirms invalidation, including during provider outages or retries needing operator attention. Successful revocation erases the token and its account binding. A permanent keyed deletion marker and minimal grant, version, client, product, status and timing records remain to prevent deleted authorizations being restored; these records contain no raw account identifier, email address or Apple account subject.
• Sign-in security records (time, IP address, device details) are kept for up to 180 days. A minimal record that an account was created may be kept after deletion to prevent fraud and abuse.
• Usage events are deleted automatically 180 days after they happen, and sooner when you delete your account. We keep daily totals computed from them (counts, shares and typical times), which contain no account, tour or place identifier.
• Copyright records: notices and counter-notices (the sender's name, contact details and statement) are kept as legal records, shared with the other party as the Copyright Policy says, and a creator's deleted account keeps only the case dates.
• Server logs record your account identifier and which features were used, so we can keep the service running. They don't contain your messages, and we don't log your coordinates with your account. Logs are rotated automatically and old entries are overwritten.
• On your phone, the app keeps your current tour, recent conversation and cached narration until you sign out, delete your account or remove the app. When offline packs and reminders are available, you can also remove them individually. Offline access expires at the time shown in the app.

6. Your choices and rights

• Delete your account: in the app, go to You → Delete account. This deletes your account, conversations, tour history, private trips and creator profile from our servers, apart from the limited security records described above. Your publications are withdrawn, photos you shared publicly are deleted, and share links stop working. Copies other travelers were permitted to make may remain with a “former creator” byline. You can also email support@travltime.ai from the address on your account. Deleting your travltime account does not cancel an Apple subscription; manage it in iOS Settings → [your name] → Subscriptions.
• Delete individual items: remove any conversation or tour in the app.
• Withdraw AI permission: You → AI data sharing.
• Location, microphone and speech recognition: change them any time in iOS Settings → travltime.
• Sign in with Apple: you can also stop using your Apple Account with travltime in iOS Settings → [your name] → Sign-In & Security → Sign in with Apple.
• Access, correction and deletion requests: depending on where you live (for example California), you may have the right to know what personal information we hold about you, to correct it, or to have it deleted. Email us and we'll respond within the time the law requires. We won't discriminate against you for exercising these rights.

7. Children

travltime is not directed at children under 13, and we don't knowingly collect personal information from them. A parent or other adult planning a family trip may tell the guide how old their children are. That information is part of the adult's own conversation. If you believe a child under 13 has created an account, contact us and we will delete it.

8. Security

Data travels between the app and our servers over encrypted connections, sign-in tokens are kept in your device's secure storage, and access to our systems is restricted. No system is perfectly secure, but we work to protect your information.

9. The website

travltime.ai sets no cookies and runs no analytics. Your browser loads fonts from Google Fonts, which receives your IP address. Our website photography is hosted with the site.

10. Changes

If we change this policy, we'll update the date above. If a change materially affects how we use your information, we'll tell you in the app before it takes effect.

11. Contact

Strategiz LLC, Florida, USA · support@travltime.ai