Privacy Policy

1. Information We Collect

1.1 Account and Profile Information

When you create an account, we collect:

• Your email address (used for authentication, account recovery, and important service messages)
• A password, which is stored only in hashed form by our authentication provider — we never see or store your plaintext password
• A display name and an optional username you choose (visible to your trip group members)
• An optional profile photo (avatar) you upload

If you choose to sign in with Apple or Google, we receive your email address and name from that provider to create or access your account. If you use Apple's "Hide My Email" feature, we receive only the private relay email address Apple generates for you.

When you invite someone to a trip by email — or someone invites you — we process the invited person's email address to send and manage that invitation, even if they do not yet have a GoWee account.

During onboarding you may answer a short, optional quiz (for example, who you usually travel with and where you are in your planning). We use these answers to tailor default AI suggestions and to decide which features and offers to show you. You can use the App without answering.

When you make a purchase, our payments partner (RevenueCat) provides us with records of your purchase and entitlement status — such as which product you bought, the store used, and purchase and expiry dates. We never receive your card or banking details (see Section 4.2).

1.2 User-Generated Content

When you use GoWee, you may create and store the following data:

• Trip details (names, destinations, dates, descriptions, budget preferences)
• Itinerary items (places, times, categories, notes)
• Expense records (amounts, currencies, categories, split details between group members)
• Packing lists (items, categories, packing status)
• Travel tips preferences and trip interests

1.3 Photos and Videos

You may upload photos and videos to shared trip galleries. These files are stored using our storage provider so they can be shared with members of that trip.

Embedded metadata. Photos and videos can contain embedded metadata (EXIF), which may include the date, camera information, and — if enabled on your device — the GPS location where the media was captured. When you upload the original file, this embedded metadata travels with it and may therefore be visible to other members of the same trip. The smaller gallery thumbnails we generate are re-encoded and do not carry this metadata. If you do not want to share embedded location data, remove it before uploading or disable location tagging in your device's camera settings.

Device location. Separately, with your permission, the App may access your device's current location to show your position on trip maps. This is used on your device to display the map; we do not store your device location or track it in the background.

1.4 Usage and Diagnostic Data

To understand how the App is used and to find and fix problems, we collect limited usage and diagnostic data through PostHog, a privacy-focused product analytics provider hosted in the European Union:

• In-app usage events (for example, screens viewed and features used, such as creating a trip or adding an expense), associated with a random identifier — never your email or name.
• Crash reports and technical error diagnostics, so we can find and fix bugs.

We use this data only to operate and improve the App. We do not use it for advertising, ad profiling, or cross-app tracking, and we do not sell it.

1.5 Information We Do Not Collect

2. How We Use Your Information

We use your information exclusively to provide, maintain, and improve the GoWee App. Specifically, we use your data to:

• Create and manage your account
• Enable trip planning, itinerary management, and group collaboration
• Facilitate expense tracking and splitting among trip members
• Store and display shared trip photos and media
• Generate AI-powered itinerary suggestions, packing lists, and travel tips
• Ensure the security and integrity of our service
• Diagnose and fix technical issues

3. AI-Powered Features

GoWee uses artificial intelligence to generate itinerary suggestions, packing lists, and travel tips. When you use these features:

• Your trip details (destination, dates, interests, group type, budget) are sent to our AI processing service to generate personalized suggestions.
• AI-generated suggestions are always editable by you and are not presented as factual or real-time information.
• Your data is used only to fulfill your specific request and is not retained by the AI service for training or other purposes.

3.1 Saving Places from Links (Discover)

When you paste a link to a social post or video (for example from TikTok, Instagram, or YouTube), we retrieve the linked media and send its images and audio transcript to our AI provider to identify the places it features, so we can add them to your map. We process only the content of the link you choose to share, and only to fulfill that request; it is not retained by the AI service for training.

4. Data Sharing and Disclosure

We do not sell, rent, or trade your personal information to any third party.

4.1 Sharing Within the App

When you join or create a trip, certain information is shared with other trip members as part of the App's core functionality:

• Your display name and avatar
• Trip itinerary items, expenses, and packing lists you create within that trip
• Photos and videos you upload to the trip gallery

You control which trips you join and what content you share within them.

4.2 Service Providers

We use the following third-party service providers who process data on our behalf to operate the App:

• Supabase - authentication, database hosting, and file storage
• Google Cloud Platform - application server hosting, EU region
• Google Maps Platform - map display and place search functionality
• OpenAI - AI-powered suggestion generation and place extraction from shared links
• Cobalt - retrieving media from links you paste in Discover
• RevenueCat - in-app purchase and entitlement management (payments themselves are processed by Apple or Google)
• Apple & Google - "Sign in with Apple" and "Sign in with Google" authentication, when you choose to use them, and app-store purchase processing
• Resend - delivery of transactional and account emails (for example, verification and password-reset messages)
• PostHog - privacy-focused product analytics and crash reporting (EU-hosted)

These providers process your data only as necessary to operate the App and are subject to their own privacy policies and data protection obligations.

4.3 Legal Requirements

We may disclose your information if required to do so by law, regulation, or legal process, or if we believe in good faith that disclosure is necessary to protect our rights, your safety, or the safety of others.

5. Data Storage and Security

5.1 Storage Location

Our application servers are hosted in the European Union. Database and file storage are provided by Supabase. Data may be processed in regions where our service providers operate.

5.2 Security Measures

We implement industry-standard security measures to protect your information, including:

• Encrypted data transmission using HTTPS/TLS
• Secure authentication managed by our authentication provider, including short-lived access tokens
• Input validation and sanitization on all server endpoints
• Access controls ensuring you can only access trips you are a member of

While we take reasonable measures to protect your data, no method of electronic storage or transmission is completely secure. We cannot guarantee absolute security.

5.3 Breach Notification

In the event of a data breach that affects your personal information, we will notify you and any applicable regulatory authority as required by law, without undue delay.

6. Data Retention

We retain your data for as long as your account is active and as needed to provide you with the App's services.

• If you delete your account, we will delete your personal data within 30 days.
• Some data may be retained longer if required by law or for legitimate business purposes (such as resolving disputes or enforcing agreements).
• Photos, expenses, and other content shared in trip galleries may remain accessible to other trip members after your account is deleted, as this data forms part of the shared trip record. Your personal identifiers will be removed or anonymized.

7. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Access - Request a copy of the personal data we hold about you.
• Correction - Request correction of inaccurate or incomplete personal data.
• Deletion - Request deletion of your account and associated personal data.
• Data Portability - Request your data in a structured, commonly used, machine-readable format.
• Restriction - Request restriction of processing of your personal data in certain circumstances.
• Objection - Object to processing of your personal data for certain purposes.
• Withdraw Consent - Where processing is based on consent, withdraw your consent at any time.

To exercise any of these rights, please contact us at the email address provided below. We will respond to your request within 30 days.

For users in the European Economic Area (EEA), we rely on the following legal bases under the GDPR:

• Performance of a contract — to create your account and provide the App's core features (trips, itineraries, expenses, media, invitations).
• Consent — for optional device permissions such as access to your location, camera, and photo library. You can withdraw consent at any time in your device settings.
• Legitimate interests — to keep the App secure, prevent abuse, and understand and improve how it is used (analytics and diagnostics), balanced against your rights.
• Legal obligation — where we must retain or disclose data to comply with the law.

You also have the right to lodge a complaint with a data protection supervisory authority. As we are established in Poland, the competent authority is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, UODO), ul. Stawki 2, 00-193 Warsaw, Poland — uodo.gov.pl. You may also contact the authority in your own EEA country.

8. International Data Transfers

Our application servers and product analytics are hosted within the European Union. Some of our service providers — for example OpenAI (AI features), Google (Maps and sign-in), Apple (sign-in and purchases), and RevenueCat (purchase management) — are based in or may process data in the United States. Where data is transferred outside the EEA, we rely on the safeguards those providers offer, which may include the EU Standard Contractual Clauses, the EU–US Data Privacy Framework, or other mechanisms recognized under applicable data protection law.

9. Children's Privacy

GoWee is not intended for children under the age of 16. We do not knowingly collect personal information from children under 16. If we become aware that we have inadvertently collected data from a child under 16, we will take immediate steps to delete that information. If you believe a child under 16 has provided us with personal data, please contact us immediately.

10. Third-Party Links

The App may contain links to third-party websites or services (such as map links or place information). We are not responsible for the privacy practices of these third parties. We encourage you to review the privacy policies of any third-party services you access through the App.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. We will notify you of any material changes by:

• Posting the updated policy on our website
• Updating the "Last updated" date at the top of this policy

Your continued use of GoWee after the updated Privacy Policy takes effect constitutes your acceptance of the changes.

12. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us: