Privacy Policy

What we collect, why, how long we keep it, and your rights

Last updated 20 August 2026

The short version

Travelogue is a diary of your holidays. It is built to work with as little of your information leaving your phone as possible.

By default, everything you write stays on your device and we never see it. If you want your diary to survive a lost phone or move to a new one, you can choose to turn the backup on — and then a copy is held on our server so we can give it back to you.

That choice is yours, it is not pre-ticked, and you can change your mind and have the server copy deleted.

There is a second way something leaves your phone, and it is worth knowing before the detail: sharing an entry. Every entry is Private, Friends or Public, and the last two mean we hold a copy so the people you chose can read it — there is no other way for it to reach them. That is per entry, it is yours to decide each time, and setting an entry back to Private deletes our copy.

We do not sell your information. We do not use it for advertising. We do not build a profile of you.

The rest of this policy is the detail behind those sentences, including the things the law requires us to tell you.

The state of this build

In this build, Travelogue is local-only. Crash reporting is described below because it is planned and you should be able to read what it would mean before you are ever asked to choose — but it is not switched on, and **there is currently no Travelogue server holding your diary**.

THE CHOICE IS REAL EVEN THOUGH THE SERVER IS NOT. When you create an account the app asks whether to keep your diary on your phone or to back it up, with the trade-off on both options, and neither is pre-selected. That answer is recorded and you can change it in Settings at any time. It controls one thing: whether **the entries you keep to yourself** are copied to our server. Keeping your diary on your phone means exactly what it says, including that there is no backup — if you lose the phone, the diary goes with it, so export it now and then.

SHARING IS THE OTHER WAY DATA LEAVES YOUR PHONE, AND THAT CHOICE IS PER ENTRY. Every entry carries a setting: Private, Friends or Public. Friends and Public mean somebody else's phone has to be able to read it, and the only route is our server — so **an entry you share is held by us whichever way the backup switch is set**. That is not a loophole in the choice above; it is what sharing is, and the app says so on the screen where you set it. Set an entry back to Private and we delete our copy of it. Turning the backup off does not un-share what you shared: those entries stay up until you set them back to Private yourself.

**Nothing is uploaded either way in this build, because there is nowhere to upload it to yet** — when there is, the answers you have already given are the ones that will be honoured, and you will not be opted in by silence.

Three things below are partly true of this build, and here is exactly how far.

NEARBY PLACE SUGGESTIONS ARE REAL AND ARE OFF. If you switch them on in Settings, the app asks your phone for an approximate position and uses it to put the closest places at the top of the list while you are writing about a holiday. It is read only while you have that form open, it is not written down anywhere, and it never leaves your device — there is nowhere for it to go. Switching the setting off, or withdrawing the permission in your phone's own settings, stops it immediately. Journey tracking, which is the other location feature described below, is not built at all.

FLIGHT TRACKING SHOWS SAMPLE DATA. The screen exists for Premium subscribers, but no flight-data provider is contacted and nothing you type into it is sent anywhere. The description below is of the finished feature, and the app says on the card itself that what you are looking at is a stand-in.

Who we are, and how to contact us

Travelogue is run by Travelogue Ltd. We are the data controller for everything described in this policy, which means we are responsible for it and we are who you hold to account.

Travelogue Ltd is a company registered in England and Wales under company number 17404875. Our registered office is 128 City Road, London, EC1V 2NX, United Kingdom.

For anything to do with your information — a question, a request, or a complaint — email privacy@thetravelogueapp.com.

We are not required to appoint a Data Protection Officer and have not appointed one. Your email goes to the person who actually builds and runs the app.

The two ways Travelogue can hold your diary

These are genuinely different privacy positions, and you pick one. Neither is pre-selected, and both have a real downside that you should read before choosing.

LOCAL ONLY. The entries you keep to yourself are stored on your device and nowhere else. We hold nothing of them, so there is nothing for us to lose, hand over or be compelled to produce. The downside is real and permanent: if you lose the phone, break it, or delete the app, your diary is gone and we cannot get it back for you, because we never had it. Export your diary from Settings if you want a copy you control.

SYNCED. A copy of your whole diary is held on our server, private entries included. You can sign in on a new phone and find everything where you left it, and losing a device stops being a disaster. The downside is equally real: your holidays, and any photographs in them, sit on a computer you do not own, and you are trusting us to look after them.

You can switch between the two at any time in Settings. Turning sync off deletes what we hold of your unshared diary — properly deleted from our systems, not hidden from view — and leaves it on your device.

SHARING SITS OUTSIDE BOTH, AND IS DECIDED ENTRY BY ENTRY. This section is about the entries you keep to yourself. An entry you set to Friends or Public is held by us either way, because that is the only way it reaches the people you shared it with — see "Who we share it with" below. Set it back to Private and our copy is deleted; turning sync off does not by itself un-share it.

What we collect, and where it comes from

ACCOUNT DETAILS, from you when you sign up: your name, username, email address and date of birth. Optionally your home country, nationality, sex, a short bio and a profile picture or avatar.

Your date of birth is collected for one reason: to check you are old enough to use Travelogue and to apply safer defaults if you are under 18. See "Children and young people" below.

WHAT YOU WRITE, from you as you use the app: reviews of holidays, ratings, dates, the countries and places you attach to them, photographs and documents you add, postcards, bucket-list entries and goals. This is your diary. It is the reason the app exists.

WHO YOU ARE CONNECTED TO, from you and from other users: friend requests you send, and friend requests other people send you.

LOCATION, only if you ask for it, and only approximately: if you turn on nearby-place suggestions, the app asks your phone for a coarse position — about a kilometre, not a precise fix — and uses it to put the places closest to you at the top of the list while you are writing about a holiday. It is off unless you switch it on. It is read only while that form is open, it is never stored, and it is never sent to us or to anyone else. Switching the setting off stops it, and so does withdrawing the permission in your phone's own settings. Journey tracking, when it is built, would be a separate switch and a separate decision.

TECHNICAL INFORMATION, from your device, and only if you are synced or have opted into crash reporting: your app version, device model, operating system version, and the IP address your device connects from. Where you have opted in, this includes diagnostic details of a crash — what the app was doing when it failed.

PURCHASE INFORMATION, from Apple or Google if you buy Premium: confirmation that a valid subscription exists, and when it renews or lapses. We never receive your card number, and we never see your payment details.

We do not ask for, and do not want, special category data — information about your health, race or ethnicity, religion, politics, sex life or sexual orientation. Please bear in mind that a diary can reveal such things without meaning to, and that a review marked Public can be read by anyone.

Information about other people

This section is about people who never signed up to Travelogue, and it exists because a holiday diary is full of other people.

If you are reading this because your name, face or something you did has ended up in someone's Travelogue diary, this is the part that applies to you, and the rights below are yours too.

WHAT WE MAY END UP HOLDING ABOUT SOMEONE WHO IS NOT A USER their image, if they appear in a photograph; their name or a description of them, if a review mentions them; and the fact that they were in a particular place on a particular date, if that is what the entry says.

WHERE IT COMES FROM entirely from the user who wrote the entry. We do not buy information about anybody, we do not collect it from public sources, and we do not go looking for it.

WHY WE HOLD IT because we cannot give someone their diary back without the contents of their diary. Our lawful basis is our legitimate interest in providing a working journal, balanced against the interests of the people written about — which is why entries default to being seen by nobody but their author, why a private entry is never shown to anyone else, and why we do not run face recognition, tag people automatically, or index diary contents to make people findable.

WHAT YOU CAN DO ABOUT IT write to privacy@thetravelogueapp.com. You can ask what we hold, ask us to correct it, ask us to delete it, or object to us holding it at all. We will normally act on a deletion request about an identifiable person without argument. Because entries live inside somebody's personal diary, we will tell you what we have done but will not usually hand over the rest of that person's entry.

WHY WE HAVE NOT WRITTEN TO YOU the law asks us to tell people directly when we hold information about them. We cannot, because we have no way of knowing who is in a photograph or of contacting them — and finding out would mean analysing faces and hunting for contact details, which would be far more intrusive than the problem it solves. Publishing this section is how we tell you instead.

IF YOU ARE THE ONE WRITING please think before you post a photograph in which somebody else is identifiable, and do not post one if they have asked you not to. Our Community Guidelines say the same thing, and we mean it.

Why we use your information, and our legal basis for it

The law requires us to name a lawful basis for each thing we do. These are ours.

TO GIVE YOU THE APP AND YOUR ACCOUNT — showing you your own diary, map, passport and statistics. Basis: performance of our contract with you.

TO SYNC YOUR DIARY, IF YOU TURN SYNC ON — holding a copy so you can get it back on another device. Basis: performance of our contract with you. If sync is off, this processing does not happen at all.

TO SHOW YOUR ENTRIES TO THE PEOPLE YOU CHOSE — publishing a review to friends or publicly, because that is what you asked for when you set its privacy. Basis: performance of our contract with you.

TO CHECK YOU ARE OLD ENOUGH, AND TO PROTECT YOUNGER USERS — verifying your date of birth meets our minimum age and applying safer defaults under 18. Basis: compliance with a legal obligation, and our legitimate interest in running a service that is safe for the people using it.

TO KEEP THE SERVICE WORKING AND SECURE — preventing abuse, limiting how much any one account can send us, and investigating problems. Basis: our legitimate interests in keeping the app available, affordable to run, and not usable as a tool against other people.

TO FIX CRASHES, IF YOU OPT IN — receiving a diagnostic report when the app fails. Basis: your consent. You can withdraw it at any time in Settings, and the app works identically either way.

TO SUGGEST PLACES NEAR YOU, IF YOU OPT IN — reading an approximate device position while you are writing an entry, and ordering the suggested places by how near they are. Basis: your consent, withdrawable at any time in Settings. Nothing is stored and nothing is transmitted, so withdrawing consent leaves nothing behind to delete.

TO LOOK UP A FLIGHT, IF YOU ASK US TO — sending a flight number and date to a flight-data provider through our own server. Basis: performance of our contract with you, for the Premium feature you asked for.

TO SELL AND SUPPORT PREMIUM — confirming a subscription is valid, and keeping the records of it that tax law requires. Basis: performance of our contract with you, and compliance with a legal obligation.

TO ANSWER YOU WHEN YOU GET IN TOUCH. Basis: our legitimate interest in supporting the people who use the app.

Where we rely on legitimate interests, you have the right to object — see "Your rights" below. Where we rely on consent, you can withdraw it at any time without losing anything else, and withdrawing does not undo processing that was lawful before you withdrew.

WHAT WE DO NOT DO WITH IT. We do not send marketing emails, and we do not have a mailing list to be on. The only emails we send are about your own account — a password reset, a receipt, or a reply when you write to us. We do not sell or rent your information, we do not share it with data brokers, and we do not use it to target advertising, here or anywhere else.

Notifications inside the app are a different thing and you control them in Settings, kind by kind. They are switched off at the operating-system level until you ask for them.

Who we share it with

We do not sell your information to anyone, and we do not share it for anyone's advertising.

OTHER PEOPLE USING TRAVELOGUE, but only as far as you decided. Every entry carries a setting: Private (nobody but you), Friends (only people whose connection you accepted), or Public (anyone using Travelogue). You set it when you write, and you can change it afterwards. Choosing Friends or Public means we hold a copy of that entry so it can reach them — that is true whether or not you have turned the backup on, because there is no other way for somebody else's phone to read it. Set the entry back to Private and we delete our copy.

HOSTING AND STORAGE PROVIDERS, for anything we hold: entries you have shared, and your whole diary if you turn the backup on. They store the data on our behalf, under a contract that forbids them using it for anything else.

APPLE AND GOOGLE, when you buy Premium, because the purchase happens in their store and they tell us whether it succeeded.

A CRASH REPORTING PROVIDER, only if you opted into crash reporting.

A FLIGHT DATA PROVIDER, only when you look up a flight, and only the flight number and date. The request goes through our own server so the provider does not receive your device's address, and we do not tell them who is asking.

SERVICES THE APP CALLS DIRECTLY, WITHOUT AN ACCOUNT exchange rates from Frankfurter and weather forecasts from Open-Meteo, both fetched when you open a country; a place-name lookup from Open-Meteo while you are typing a place into an entry; and satellite map imagery from NASA's Global Imagery Browse Services when you zoom into the map with satellite turned on. None of them is told who you are. The first two receive only which country you tapped. The place lookup receives the letters typed into the place field and nothing else — no title, no dates, no photographs, no rating, and never the entry itself. It is sent only while that field is being typed into, and never if you pick one of the places already built into the app, which is most of them. The map imagery receives a zoom level and a grid reference — a rectangle of the earth, with nothing to say whether it means anything to you. As with any request from your device, all of them will see the IP address it came from. All are free services requiring no key and no account.

LAW ENFORCEMENT OR A REGULATOR, if we are legally required to hand something over — and only what we are actually required to hand over.

A BUYER, if Travelogue is ever sold or merged. We would tell you before your information moved, and the policy would have to be honoured.

Where your information is held

If you turn sync on, we intend to hold your data in the United Kingdom or the European Economic Area, so that for most of our users it does not leave the area whose laws protect it.

Some of the services we rely on operate internationally, so information may be transferred outside the UK and EEA. Where that happens, we will only do it under one of the protections the law provides: an adequacy decision by the UK government or the European Commission recognising the destination as offering equivalent protection, or the UK International Data Transfer Agreement (or the addendum to the European Commission's Standard Contractual Clauses) where there is no adequacy decision.

You can ask us for a copy of the safeguards that apply to any particular transfer by emailing privacy@thetravelogueapp.com.

If you keep your diary on your phone and share nothing, none of this arises: nothing you have written reaches us, so there is no transfer to protect. It begins to apply from the first entry you share with a friend or post publicly.

How long we keep it

YOUR DIARY, IF YOU HAVE THE BACKUP ON for as long as your account exists. Delete an entry and it goes immediately. Delete your account, or turn the backup off, and we remove everything from our live systems straight away and from our backups within 30 days.

THE ENTRIES YOU KEEP TO YOURSELF, IF THE BACKUP IS OFF entirely up to you, because we never receive them. They stay on your device until you delete them or remove the app.

AN ENTRY YOU HAVE SHARED for as long as it is shared. Set it back to Private, or delete it, and our copy goes immediately and leaves our backups within 30 days. Turning the backup off does not by itself un-share an entry — that would take something back from the people you gave it to without asking you — so if you want everything gone, set the entries back to Private or delete your account.

YOUR LOCATION not at all. A position read for nearby suggestions exists only in the app's memory while you have an entry open, and is gone when you close it. There is no location history in Travelogue, on your device or anywhere else.

CRASH REPORTS 90 days, then deleted. Long enough to spot a pattern across a release; not long enough to become a history of your use.

SERVER AND FLIGHT-PROXY LOGS 30 days, kept to spot abuse and diagnose faults.

SUPPORT EMAILS 2 years from the last message, so we have the context if you write again.

PREMIUM PURCHASE RECORDS 6 years, because UK tax law requires it.

RECORDS WE MAY NEED TO DEFEND A LEGAL CLAIM up to 6 years, which is the ordinary limitation period in England and Wales. We keep the minimum that serves that purpose and nothing else.

Where we cannot delete something immediately — because it sits in a backup — we isolate it so nothing further is done with it, and it goes when the backup rotates.

Your rights

These rights are yours under UK and EU data protection law, and they apply whether or not you have a Travelogue account.

ACCESS — ask what we hold about you and get a copy.

RECTIFICATION — have anything inaccurate corrected. Most of it you can simply edit in the app.

ERASURE — have your information deleted. In the app: delete an entry, set a shared entry back to Private, turn the backup off, or delete your account.

RESTRICTION — ask us to hold your information but stop doing anything else with it, while a dispute is sorted out.

OBJECTION — object to processing we base on legitimate interests. We must then stop unless we can show compelling grounds that override your interests.

PORTABILITY — receive your information in a structured, commonly used, machine-readable format, or have it sent to another service. Export in Settings does this now, without asking us and without an account.

WITHDRAWING CONSENT — where we relied on your consent, withdraw it at any time in Settings. It takes effect immediately and does not make earlier processing unlawful.

To exercise any of these, email privacy@thetravelogueapp.com. We will respond within one month. If a request is unusually complex we may take up to two further months, and we will tell you inside the first month if so. We may need to check who you are before acting, so that nobody else can use these rights against you. There is no charge unless a request is clearly unfounded or excessive.

Do you have to give us anything?

Not to use the app. Travelogue works as a local diary with no account at all.

IF YOU WANT AN ACCOUNT, we need a username, an email address and your date of birth. That is a condition of the contract between us: without a username there is nothing to sign in to, without an email there is no way to recover your account, and without a date of birth we cannot tell whether you are old enough. If you will not give them, we cannot create the account, but you can keep using Travelogue locally.

EVERYTHING ELSE IS OPTIONAL — your real name, home country, nationality, sex, bio, profile picture, location access and crash reporting. Declining any of them costs you only the feature that needs it, and never the app.

Automated decisions and profiling

We do not make decisions about you by automated means that produce legal effects or similarly significantly affect you, and we do not profile you.

Travelogue does rank and count things — a leaderboard of popular countries, statistics about your own travel, the order of your friends list. These are arithmetic over what you and your friends have written, they decide nothing about you, and they are not used to judge you, price anything differently, or restrict what you can do.

Children and young people

You must be at least 13 to use Travelogue. We ask for your date of birth when you sign up, and we will not create an account below that age.

We know a typed birthday is not proof of age. It is the standard first step, and we will strengthen it if the way Travelogue is used ever calls for more.

IF YOU ARE UNDER 18, your account *starts* with safer settings: new entries are private rather than public, location features start off, your diary starts set to stay on your device, and your profile is not publicly listed. Every one of those is a starting point, not a rule about you. You can change any of them whenever you like, including straight away — the sign-up screen shows you the same choices as everybody else, with the safer one already picked and both sides of the trade-off written out.

Those first two settings together are why nothing you write is published unless you publish it: new entries start Private, and an entry only reaches anybody else when you set it to Friends or Public yourself. The app tells you what that does, on the screen where you do it.

We think that is the right way round. Refusing a sixteen-year-old the ability to back their diary up would not protect them from anything: they would simply lose it along with the phone. What we owe you is that privacy is where you begin and that the trade-off is explained in plain words, not that a decision about your own diary gets made for you.

We design on the basis that under-18s may well be using Travelogue, which is what the Children's Code requires of a service like this. In practice that means privacy is the default rather than something to go and find, we do not use nudges to push anyone into sharing more widely, and there is no advertising or profiling anywhere in the app.

If you believe a child under 13 has an account, email privacy@thetravelogueapp.com and we will delete it and everything in it.

How we look after it

Everything travelling between the app and our server goes over an encrypted connection, and anything we store is encrypted at rest. Access to systems holding user data is limited to the people who need it to run the service.

Photographs are resized on your device before they are ever uploaded. Travelogue is a diary, not a photo backup — your originals stay in your own photo library, where they were.

Who can see an entry is enforced on our server, not only in the app on your phone. That distinction matters: a check that runs only on the reader's device can be bypassed by anyone prepared to talk to the server directly, and would mean a private entry was private only by good manners.

If there is ever a breach that puts you at risk, we will tell the Information Commissioner's Office within 72 hours and tell you without undue delay.

No system is perfectly secure, and we will not claim otherwise. Keeping your diary on your phone and keeping your entries Private remains the strongest privacy position available in Travelogue, and it is always there. It is two decisions rather than one, and we would rather say so than let the first imply the second.

Changes to this policy

We will update this policy when what we do changes. The date at the top tells you when it last did.

If a change materially affects you — anything new leaving your device, a new recipient, or a new purpose — we will tell you in the app before it takes effect, not afterwards. Where the change needs your consent, we will ask, and carrying on using the app will not be treated as an answer.

Complaints

If you are unhappy with how we have handled your information, email privacy@thetravelogueapp.com and we will look into it properly.

You can also complain to the Information Commissioner's Office, the UK's data protection regulator, at ico.org.uk/make-a-complaint or on 0303 123 1113. You do not have to come to us first, though it is usually quicker.

If you are in the EEA, you can complain to the supervisory authority in your own country instead.

If this doesn't match what the app does, tell us

This policy was written to describe accurately what Travelogue actually does, rather than borrowed from wording that describes somebody else's product. It has been reviewed by a solicitor.

That is not the same as it being right forever. If you spot something here that does not match what the app does, that is a bug in one or the other and we want to know: privacy@thetravelogueapp.com.