Privacy Policy

Itano is provided by [FTR Digital — registered company name] (registration [company registration number]), [registered address](“we”, “us”). We are the controller of the personal data described here. You can reach us about anything in this policy at [privacy email, e.g. [email protected]].

Your account. Your email address and a password (stored only as a one-way hash), or, if you sign in with Apple or Google, the name, email address and account identifier they share with us. If you use Apple's “Hide My Email”, we only receive the relay address Apple gives us.

Your profile. Your name, username, profile photo, and, if you choose to give them, your birthday, home country and region, and your travel preferences (the kinds of trips, food, budget and trip length you like, and whether you need step-free access).

Your trips. Everything you and your fellow travellers add to a trip: its name, dates, cities, days, stops, notes, cover image, the people on it and their roles, and invitations, including the email addresses you send invitations to.

Documents and photos. Files you upload to a trip, such as tickets, booking confirmations, insurance documents and photos. Tickets and bookings usually contain names, booking references, seat numbers and travel times. For transport tickets, we extract the journey details (for example the flight number, stations, times and seat) so the app can show your journeys and remind you of them.

Expenses. Expenses you record on a trip: what they were, the amount and currency, who paid, and how they are split.

What you share publicly. Trips you choose to publish to Discover, tips you write about places, place ratings, and marking someone's tip as helpful or reporting it.

Notifications. If you allow notifications, a push token that identifies your device to Apple or Google's notification service, which platform it's on, and when it was last used; your notification settings; and the notifications in your inbox and whether you've read them.

Technical data. When you use the app or website, our servers record your IP address, device and browser type, session information and the time of your requests, to keep you signed in, keep the service secure, and fix problems. The app keeps a copy of your trips on your device so it works offline.

We do not collect your device's precise location, your contacts, or advertising identifiers, and we don't use third-party analytics or advertising trackers.

Data protection law requires us to have a legal basis for each use. Ours are:

• To provide Itano (performance of our contract with you): creating and securing your account, storing and syncing your trips, sharing them with the people you invite, reading your tickets, splitting expenses, showing maps, places and weather, generating trip plans and recommendations you ask for, and sending the notifications and reminders you've turned on.
• To send service emails (performance of contract): confirming your email address, resetting your password, and trip invitations someone sends you.
• To keep Itano safe and working (our legitimate interests): preventing abuse and fraud, moderating public tips, debugging, and improving how the app reads tickets and plans trips.
• To comply with the law (legal obligation): responding to lawful requests and keeping records the law requires.
• With your consent: push notifications, which you can turn off in the app or in your phone's settings at any time.

We do not sell your personal data, and we don't use it for advertising.

Your fellow travellers. Everyone on a trip can see that trip, its documents and its expenses, and the names and photos of the people on it. Invitations show your name to the person invited.

Everyone. Trips you publish to Discover can be seen by anyone using Itano: their plan, cities and dates, with your name and profile photo. Publishing a trip doesn't publish its notes, documents, expenses, or the other people on it. Tips you write about places are public too, with your name and photo.

Service providers. We use the providers below to run Itano. They process data on our behalf under contracts that limit them to doing so, or, where marked, as independent services under their own terms.

• Hosting, database and file storage (Railway and our cloud storage provider): everything above is stored with them.
• Email delivery (Resend or Brevo): your email address and the content of service emails.
• Anthropic (Claude): transport documents you upload, to read the journey details from them.
• Google: Gemini receives your trip details and travel preferences when you ask for a plan or recommendations, and the text of tips to check them before they're published; Google Maps and Places receive place searches and the places on your trips; Firebase Cloud Messaging delivers notifications to Android phones; and Google Sign-In, if you use it.
• Apple: the Apple Push Notification service delivers notifications to iPhones; and Sign in with Apple, if you use it.
• Expo: forwards notifications to Apple and Google, using your device's push token and the notification's text.
• Mapbox: shows maps in the app, and may collect technical data about map use under its own privacy policy.
• FlightAware: receives a flight number and date to look up its live status. Open-Meteo: receives the coordinates of a trip's cities to fetch weather forecasts. Neither receives your name or account details.

Others, when required. We may disclose data if the law requires it, to protect the rights and safety of our users or others, or as part of a merger or sale of our business, in which case this policy will continue to apply to your data.

Some of our providers are based in, or process data in, countries outside the European Economic Area, including the United States. Where they do, we rely on the European Commission's adequacy decisions (including the EU–US Data Privacy Framework, where the provider is certified) or on the Commission's Standard Contractual Clauses, together with any additional safeguards needed. You can ask us for a copy of the safeguards that apply.

• Your account, profile, trips, documents and expenses: for as long as you have an account. When you delete your account, we delete your profile, photo, tips, sign-ins, devices and inbox straight away, along with every trip no one else is on and its files. Trips you share with others stay with them, and any you created pass to one of them. Expenses you paid on those trips stay in their balances under “Deleted traveller”, so their totals still add up, with nothing that identifies you.
• Inbox notifications: 90 days. Push tokens: until you sign out, or after 180 days without use.
• Public tips: until you delete them or your account. Place ratings and “helpful” votes stay in the places' totals after you delete your account, no longer linked to you.
• Server logs: up to [30] days. Backups: up to [30] days, after which deleted data is gone from them too.
• Anything the law requires us to keep longer, for as long as it requires.

You can see and change most of your data in the app at any time. You can also ask us to:

• give you a copy of your personal data (access and portability);
• correct data that's wrong (rectification);
• delete your account and personal data (erasure);
• stop or limit how we use it, or object to uses based on our legitimate interests (restriction and objection);
• withdraw your consent, for example to notifications, without affecting what we did before.

You can delete your account at any time in the app, under Profile, Account & security, Delete account. To exercise any of these rights, or if you can't get into the app, email [privacy email, e.g. [email protected]]from the address on your account. We'll reply within one month. If you're unhappy with how we handle your data, you can complain to [your data protection authority, e.g. the Office for Personal Data Protection of the Slovak Republic], or to the authority where you live or work.

If you signed in with Apple or Google, you can also disconnect Itano from your Apple ID or Google Account in their settings.

Data travels between your device and our servers encrypted. Passwords are stored only as hashes, documents are stored privately and opened through short-lived links, and access to our systems is limited to the people who need it. No service can promise perfect security, so please use a strong, unique password, and tell us at [contact email, e.g. [email protected]] if you think your account has been compromised.

Itanois not meant for children under 16, and we don't knowingly collect their data. If you believe a child has given us personal data, contact us and we'll delete it.

We'll update this policy when what we do changes. If the changes are significant, we'll tell you in the app or by email before they take effect. The date at the top shows when it last changed.

[FTR Digital — registered company name], [registered address].
Privacy questions: [privacy email, e.g. [email protected]]. Everything else: [contact email, e.g. [email protected]].