Last updated: 23 October 2026 · Applies to the Travel Day app (iPhone and web) and the Travel Day server.
Travel Day is provided by Developtopia, United Kingdom (“we”, “us”). We decide how the data described below is used, so for privacy law we are the controller. Contact: developtopia@gmail.com.
Trips, bookings, itinerary notes, documents and their files, your passport details and photo, health notes, packing lists, expenses, stamps, language and display settings. If you turn on the lock, this data is encrypted with a key protected by your passcode and, if you choose, Face ID, Touch ID or your phone’s fingerprint or face unlock. Your biometric data is handled by your phone’s operating system: it never reaches Travel Day or our server.
If you forget your passcode and have no biometric unlock set up, the encrypted data cannot be recovered, by you or by us.
Translation of the app into other languages happens on your phone. The text of your trips is not sent anywhere to be translated.
An account is optional. It lets us send alerts while the app is closed, keep shared flight links and shared trips working and store an encrypted backup. This is everything our server holds about you:
| Data | Why | How long |
|---|---|---|
| Your email address, and your name if Apple or Google gives it to us | To sign you in and to recognise your account | Until you delete your account |
| A sign-in code (stored only as a one-way hash) | Email sign-in | 10 minutes, or until used |
| A session token on your phone | To keep you signed in | 30 days, then you sign in again |
| Push details: a web-push address, or your iPhone’s Apple push token; and the tokens Apple gives us for a flight’s Live Activity | To deliver alerts and update the Live Activity while the app is closed | Until you turn notifications off, the token stops working, or you delete your account |
| Reminders you schedule (title, text, time) | To deliver them while the app is closed | Deleted when delivered or cancelled |
| Flights we watch for you (flight number, date, airports) | To alert you to gate, delay, boarding, landing and baggage-belt changes | Until about six hours after departure, or until you stop watching |
| Shared flight links (flight number, airports, times, your first name) | So the people you share with can follow one flight | Until a day after the flight lands, or until you stop sharing |
| Shared trips: one encrypted file per trip you share, and the date the trip ends. We cannot read it: it is encrypted on your phone and the key is only in the link you send, which never reaches our server | So the people you send the link to can follow the trip (what and when, places and flights; never booking references, documents, costs, notes, seats or contact details) | Until 14 days after the trip ends, or until you stop sharing. Changes you make to the trip replace the previous copy |
| Security-wait reports you choose to send (airport, minutes, your account id) | To show other travellers the typical wait | Used for about 90 minutes; removed with your account |
| An encrypted backup (only if you create one) | So you can restore your trips on a new phone | Until you replace or delete it. We cannot read it |
Without an account, if you look up a flight by number, the flight number and date go to our server and on to our flight-data provider to get the status. We do not store these look-ups. Our server briefly keeps your network address in memory to limit abuse (rate limiting) and our hosting provider may keep standard access logs.
Flight look-ups and airline logos. To show a flight’s status, the app sends the flight number and date to our flight service, which asks our flight-data provider. Nothing that identifies you goes with it, and we do not keep a list of who looked up what. The same service supplies airline logos, which the app saves on your phone. Look-ups are repeated more often as a flight gets closer, and the service may keep each answer briefly (minutes to hours) so it can be shared between travellers asking about the same flight.
Boarding passes. A boarding pass you add (a photo, a PDF, or a Wallet .pkpass file) is saved only on your phone, encrypted if you use a passcode. The barcode is read on your phone using Apple’s on-device text and barcode recognition. The pass and its barcode are never sent to us.
Tips before a flight. If you choose “Tips before a flight”, the app schedules a reminder on your phone about two hours before each flight. It is created on the phone, and nothing about it is sent to us. You can turn it off under Profile at any time. The tips link to partner offers, which are described below.
Places and photos. Descriptions and photos for things to do come from Wikipedia and Wikimedia. The app asks them using the name of your destination or a place; no account or personal detail is sent. Places you save are kept only on your phone.
Offer counts. When you tap a partner offer, the app tells our server which offer it was (for example, a hotel partner), and we add one to a running total for that day. We do not receive your name, email, account, device identifier, trips or location with it, and we do not store your IP address with it (it is used only briefly to stop abuse). We use the totals to see which offers are useful. You can turn this off under Profile, Count taps on offers.
Ride links. On a flight you can tap Uber (or Lyft in the US and Canada). The app opens that company with your pick-up at your current location and the departure airport and terminal as the drop-off. Only the airport and terminal are in the link: we send them nothing about you, and your location is read by their app, not by us.
Luggage. If you add a bag with an AirTag or other tracker, its name and the sharing link you paste are saved only on your phone (encrypted if you use a passcode) and are never sent to us. When you tap to see where the bag is, your phone opens that link in Find My or your browser. We cannot see where your bag is.
Crash reports are off unless you turn them on. If you do, we receive a short error message, the app version and the type of device, and nothing about your trips or details.
These services receive only what is listed, and only when you use the feature. Each has its own privacy policy.
| Service | What it receives | When |
|---|---|---|
| Apple (Sign in with Apple, push notifications, Live Activities) | Sign-in details; your phone’s push token and the notification text | If you sign in with Apple or turn on notifications on iPhone |
| Google (Sign in with Google, Gmail) | Sign-in details; mail access you grant (section 6) | Web app only, if you choose them |
| Microsoft (Outlook mail) | Mail access you grant (section 6) | Web app only, if you choose it |
| Our email delivery provider | Your email address and the sign-in code | When you sign in with an email code |
| Our flight-data provider | Flight number and date. Not your name or account | When status is looked up, for flights you track or watch, or for a link someone opens |
| Our weather provider | Destination city and trip dates | To show the forecast |
| Wikipedia / Wikimedia | Destination or place name | For photos and place descriptions |
| Our currency-rate providers | Currency codes | To convert money |
| Our map-data provider (OpenStreetMap data) | The airport code | Only if an airport map is not already saved on your phone |
| Our hosting providers | Everything in section 4, and technical data such as network address | They run our server and website for us |
| Hotel, lounge, tour, insurance, parking, transfer, car-hire and flight-compensation partners | Nothing from us. You leave the app when you tap a link | If you tap an affiliate link (below) |
The app also opens links to your phone’s Maps app and to official government websites. When you follow a link you are on that site, under its own policy.
Affiliate links. Some links to hotels, lounges, tours, insurance, airport parking, airport transfers, car hire and flight-compensation services are affiliate links: if you buy through them (or, for compensation, if a claim you make through them succeeds) we may earn a commission at no extra cost to you. Sponsored links are labelled. The links open the partner’s own page: we do not add your name, flight, booking or any other detail to them, so nothing about you or your trip is shared with a partner unless you type it in on their site. Compensation services are offered only after a long delay or a cancellation, and we say that you can also claim from the airline for free. We do not receive information about you from these partners. In the iPhone app we do not link out to buy eSIM data plans.
If you connect Gmail or Outlook (web app), the app reads your booking confirmations directly from Google or Microsoft to your phone and interprets them there. Your email content is not sent to our servers. The app asks only for read-only access and searches only for travel confirmations: flights, hotels, restaurants and tours. It keeps the bookings it finds as trips on your phone, never your inbox. You can disconnect at any time in your Google or Microsoft account settings. Email import is not offered in the iPhone app.
Travel Day’s use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements: it is used only to find your bookings, not for advertising, not sold, and not transferred to others except as needed to provide the feature, to comply with law, or as part of a merger, with your consent.
Trip suggestions are optional. The app asks before sending anything. If you tap Allow, it sends your destination, the dates, your style choice, and the types, dates and places of what is already in your trip (not names, documents or booking references) to our AI provider to draft ideas. If you choose “Built-in ideas only”, nothing is sent. You can change your mind at any time.
The camera and photo library are used only when you tap to photograph or choose a passport page, a document, or photos for a trip video. Passport reading, face analysis for your avatar, and the trip-video builder all run on your phone. The photos and what is read from them are not uploaded. Photo locations and dates are read on the phone to name places and pick moments.
Notifications are only for your own flights and reminders, and only if you allow them. We send no marketing notifications.
Widgets and Live Activities (iPhone) show your next flight on the Home Screen, Lock Screen and Dynamic Island. To do this the app saves a small summary in storage shared with the widget on your phone: your first name, the next flight’s number, route, times, gate, status and seat, today’s plan titles and times, the destination’s local time and temperature, and your packing progress with the names of the next few things left to pack (these are your own list items). The large widget lets you tick those off; the tick is applied to your list in the app. It never includes passport details, documents, booking references or email. You can switch this off in Profile, which clears it. Gate and seat are marked private, so iOS hides them while your Lock Screen is locked and private.
We do not sell your personal data and we do not share it for advertising. We share it only with the services in section 5 to run the features you use, with people you choose to share a flight or trip with, if the law or a valid legal request requires it, to protect people’s safety or our rights, or as part of a sale or merger of our business (you would be told first).
Our server and the services above may be in countries other than yours, including the United States and the United Kingdom. Where data goes outside the EEA, UK or Switzerland we rely on an adequacy decision or the standard contractual clauses, as the provider offers. Ask us for details.
The table in section 4 gives the period for each item. When you delete your account, we delete everything in that table, including shared flight links, shared trips, reminders, watched flights, push and Live Activity tokens, security-wait reports and your backup, immediately. Our hosting provider may keep routine backups of the server for a short time afterwards.
Travel Day is not directed at children under 13 (or under 16 where the law sets that age for consent), and we do not knowingly collect their data. If you think a child has made an account, contact us and we will delete it.
Data on your phone is encrypted when you turn the lock on. Backups are encrypted before upload and we do not hold the key. Connections to our server use HTTPS, sign-in codes are stored only as hashes, every account’s records can be read only by that account, and the server limits request rates. No system is perfectly secure, so use a strong passcode and keep your phone updated.
We do not sell personal information or share it for cross-context behavioural advertising, and we do not use or disclose sensitive personal information to infer characteristics about you. Residents of California and other US states may ask us to tell them what we hold, correct it or delete it, and we will not treat you differently for asking. Use the in-app tools in section 14 or email us.
If we change this policy in a way that matters, we will say so in the app before it takes effect. The date at the top shows the latest version.
Developtopia, United Kingdom
Email: developtopia@gmail.com