Traveldi

Privacy Policy

Last updated: 20 October 2026 · Version 2026-10-20

This is the same Privacy Policy you accept in the Traveldi app (sections 1 to 11). How we handle data on the website traveldi-app.com and the pre-launch waitlist is described in the annex at the end.

1. Data controller

The controller of your personal data is TRAVELDI sp. z o.o., registered office: ul. Galenowa 1/55, 25-705 Kielce, Polska, entered in the Polish National Court Register (KRS) under no. 0001256690, Tax ID (NIP): 9592095274, REGON: 545336229. You can contact us in all matters concerning personal data at: privacy@traveldi-app.com.

2. What data we process

• Account data: e-mail address and password (stored encrypted by the authentication provider) or, if you choose to sign in with Apple or Google, your account identifier at that provider together with the e-mail address and name it passes to us. With "Sign in with Apple" you may hide your e-mail address; we then receive only Apple's relay address.
• Profile data: name/nickname, photos, bio, date of birth, gender, hobbies, languages, travel style and purpose, experience level, country of origin, visited countries, dream destination.
• Location: read only when you tap the relevant button yourself; the App never collects it in the background or at launch.
  • (a) Checking in on the map ("Check in here"): requires your consent given in the App. The position is rounded on your device to about 1 km and is visible only to people you matched with. Every check-in is manual; it ends when you minimize or close the App, after 1 hour at most, and nothing renews it automatically. "Hide me" or withdrawing consent in Profile → Settings deletes it immediately.
  • (b) Unlocking a country in your Collection (GPS button): a position rounded to about 1 km is used to determine the country; we store the country and a position rounded to about 11 km, needed to detect spoofed GPS.
  • (c) Photo challenges: the position is used once to check that you are at the landmark and is not stored.
  Your precise location is never shared with other users.
• Content: chat messages, trips, travel plans, stories, memories.
• Verification selfie (OPTIONAL): if you choose to verify your profile, we ask for a selfie in a randomly chosen pose. It is used ONCE, to compare it by eye against your profile picture. Because this comparison concerns facial features, we treat the photo as biometric data (Art. 9 GDPR) and process it only on your explicit consent, given in the App before the photo is taken. The photo is stored in private storage, is never shown on your profile or to other users, and is deleted immediately after the decision; if we do not review it, it is deleted automatically after 30 days. We keep only the outcome (verified / not verified) and the time consent was given. Verification is entirely voluntary, the App works the same without it, and the badge is not proof of identity or age.
• Moderation data: reports, blocks, moderation decisions.
• Technical data: device identifier, push notification token, crash diagnostics.

3. Purposes and legal bases (GDPR)

• Providing the service: account creation, profile matching, chat, trips, collection: Art. 6(1)(b) GDPR (performance of a contract).
• Safety, content moderation, abuse prevention and handling reports: Art. 6(1)(f) GDPR (legitimate interest of the controller and users).
• Location and push notifications: Art. 6(1)(a) GDPR (consent, which you can withdraw at any time in your device or App settings; withdrawal does not affect the lawfulness of prior processing).
• Verification selfie: Art. 9(2)(a) GDPR (explicit consent to processing a special category of data). You may withdraw consent at any time; withdrawal removes the badge and does not affect the lawfulness of prior processing.
• Purchase records and tax obligations: Art. 6(1)(c) GDPR (legal obligation).

Providing data is voluntary but necessary to use the relevant App features.

4. Data recipients (processors)

• Supabase: database hosting, authentication, file storage.
• Apple: app distribution, "Sign in with Apple", In-App payments, push notifications.
• Expo: push notification and app update infrastructure.
• Sentry: crash diagnostics (technical data about app errors).
• RevenueCat: subscription and in-app purchase handling (your in-app account identifier and purchase history; no payment card data).
• Resend: sending e-mails to moderators about reports and verification requests.
• BigDataCloud and OpenStreetMap (Nominatim): determining the country from a rounded position when you unlock a country in your Collection.
• komoot (Photon): city name suggestions when planning a route (receives the search text you type, without your account identifier).
• Google: Google account sign-in (if you choose that method).
• flagcdn.com: fetching country flag graphics (the provider receives standard connection data, e.g. IP address).

We do not sell your data or share it with third parties for marketing.

5. Transfers outside the EEA

Some providers (e.g. Supabase, Apple, Sentry, RevenueCat, Google) may process data outside the European Economic Area. Transfers are based on European Commission adequacy decisions (e.g. the EU-US Data Privacy Framework) or standard contractual clauses (SCC).

6. Retention periods

• Account and profile data: for as long as you hold an Account; after deletion the data is erased or anonymized without undue delay.
• Moderation reports and violation data: up to 12 months after the case is closed (defense against claims, preventing repeat violations).
• Verification selfie: deleted immediately after the decision, and in every case no later than 30 days after it is submitted. The outcome of the verification is kept for as long as you hold an Account.
• Crash diagnostics: up to 90 days.
• Purchase records: for the period required by tax law.

7. Your rights

You have the right to: access your data and obtain a copy, rectification, erasure ("right to be forgotten"), restriction of processing, data portability, objection to processing based on legitimate interest, and withdrawal of consent. You can delete your account and data yourself in the App: Profile → Settings → "Delete account". You also have the right to lodge a complaint with a supervisory authority (in Poland: Prezes Urzędu Ochrony Danych Osobowych (UODO)).

8. Automated processing and profiling

The App selects the profiles shown to you based on your stated preferences (e.g. country, shared interests). We do not make decisions about you based solely on automated processing that would produce legal effects or similarly significantly affect you.

9. Security

We use: encrypted connections (HTTPS/TLS), encrypted session storage on the device (Keychain), row-level access control in the database (Row Level Security), data minimization (including location rounding), and a rule that push tokens never reach other users.

10. Children's data

The App is not intended for persons under 18 and we do not knowingly collect their data. If you suspect a child is using the App, write to: info@traveldi-app.com.

11. Changes and contact

We announce material changes to this Policy in the App. Questions about personal data: info@traveldi-app.com.

Annex: website and waitlist

This annex applies only to the website traveldi-app.com and the pre-launch waitlist. The controller and contact details are the same as in section 1. Your rights under section 7 apply here as well; to exercise them, write to privacy@traveldi-app.com.

Data we collect on the website

Data	Required?	Purpose
E-mail address	Yes (for waitlist)	Notifying you about the launch and launch-related updates you signed up for; delivering waitlist perks
First name	Optional	Personalising launch communications
Country	Optional	Understanding where our future users come from
Dream destination	Optional	Understanding user interests; anonymous aggregate display on the site
Consent record (checkbox + timestamp)	Yes	Demonstrating that consent was given (GDPR accountability)
Server log data (IP address, browser type, request time)	Automatic	Hosting, security and abuse prevention: standard web-server logs of our hosting provider

The website stores your language preference in your browser's local storage (key traveldi.web.lang). This is a functional setting stored on your device at your request; it is not used for tracking. The website does not use analytics, advertising or tracking cookies, which is why no cookie banner is shown.

The site loads the Bricolage Grotesque and Inter typefaces from Google Fonts (Google Ireland Ltd.). When fonts load, your browser transmits standard connection data (including your IP address) to Google. Details: Google Privacy Policy.

Legal basis and retention

We process waitlist data on the basis of your consent (Art. 6(1)(a) GDPR), given by ticking the consent box. You may withdraw consent at any time; every e-mail we send contains an unsubscribe link, or you can write to privacy@traveldi-app.com. Withdrawal does not affect the lawfulness of processing before withdrawal.

Server logs are processed on the basis of our legitimate interest (Art. 6(1)(f) GDPR) in keeping the site secure.

Retention: waitlist data is kept until launch communications are complete, and no longer than 12 months after the App's launch, unless you delete it earlier by withdrawing consent or you convert your waitlist entry into an App account. Hosting-level server logs are retained for the standard period applied by our hosting provider.

How waitlist data is protected

• Data is transmitted over encrypted connections (HTTPS/TLS) and stored in a database protected by row-level security: the public website can only add entries; it cannot read, modify or delete them.
• The public counter and "recent sign-up" signals expose only aggregate numbers or destination/country fragments, never e-mail addresses or names.

Website providers

Provider	Role	Location of processing
Vercel	Website hosting and delivery (server logs, IP address)	EEA / USA
home.pl S.A. (Szczecin, Poland)	E-mail for the traveldi-app.com domain and DNS (server logs)	Poland / EEA
Supabase	Waitlist database	EEA and/or USA
Resend	Sending waitlist e-mails (e-mail address, name, delivery data)	Ireland (EEA); provider established in the USA
Google	Fonts on the website (IP address)	EEA / USA

Transfers outside the EEA rely on the same safeguards as described in section 5. We do not sell personal data.

← Back to Traveldi