This Privacy Policy explains how Coplango B.V. (“Coplango”, “we”, “us”) collects and processes personal data when you use the Turavel app on iOS or Android. It is written to comply with the EU General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) and the Dutch Uitvoeringswet Algemene verordening gegevensbescherming (UAVG). For the Coplango website privacy policy, see coplango.com/privacy.
1. Data controller
The data controller responsible for your personal data is Coplango B.V., Posthoornstraat 11, 3011 WD Rotterdam, The Netherlands, registered with the Dutch Chamber of Commerce (KVK) under number 42010520. You can reach us regarding any privacy matter by email at hello@coplango.com.
2. What data we collect
Turavel collects only the personal data needed to plan, save, and synchronize your trips. The data we process depends on which features you use.
Account information. When you create an account we store an email address (if you sign up with email and password), an Apple-issued user identifier and optional private-relay email (if you choose Sign in with Apple), or a Google-issued user identifier together with the name and email address from your Google profile (if you choose Sign in with Google). Apple provides your real name only on the first sign-in, which we store with your profile.
Using Turavel without an account. If you choose to explore without signing up, we create an anonymous guest account so the plan you make can be kept on our servers. To stop abuse of the free plan, the app sends a device identifier (a random identifier kept on your device on iOS; the Android ID on Android), and our backend stores only a one-way hash of it, together with a one-way hash of your IP address. If you later create an account or sign in, your guest plans move to that account. Guest accounts with no activity for 30 days are deleted automatically, together with their trips; the hashes are deleted after 180 days.
Profile information you provide. Name, handle, profile emoji, optional bio, home city, preferred travel styles, budget tier, and dietary or food preferences you choose to enter.
Trip data you create. Destinations, dates, traveling companions you add, itineraries, activities, packing checklists, budget categories and amounts, free-form notes, and destinations you bookmark from the Explore tab.
Trip documents (stored on your device only). You can attach travel documents (tickets, reservations, and similar files) to a trip as PDFs or photos, either imported from your device or captured with the camera. These documents and their names are stored exclusively in the app’s private storage on your device; they are never uploaded to our servers or shared with any third party, and we cannot access them. The camera permission is used solely to capture these document photos. Because they live in the app’s private storage, they are included in your device’s own encrypted backup (iCloud on iOS, Google backup on Android) and are removed when you delete the document, the trip, or the app.
Notification data. Your in-app notification preferences and quiet-hours settings, the list of in-app notifications we have shown you (and their read/unread state), and, only if you opt in to push notifications, a device push token (Apple-issued on iOS, Firebase Cloud Messaging on Android).
Subscription state. Whether you have an active Turavel Pro subscription, the product purchased, and the renewal or cancellation state. Payment itself is processed by the Apple App Store or Google Play; the resulting subscription state is managed by our subscription processor (RevenueCat) and keyed by an anonymous identifier we generate.
Location data (optional). If you use departure-day alerts and grant the location permission, the app reads your device’s current location to estimate travel times to your next itinerary stop. That location is sent over HTTPS to our backend, which forwards it to a maps provider for a route lookup; it is processed transiently for that request and is not stored on our servers or shown to other users. Location access is optional. Every other feature works without it.
Usage analytics. Which screens you open and key actions in the app (for example starting, generating, or saving a plan, opening a notification, or viewing the Pro screen), together with the app version, platform, your device’s region setting, and an identifier for your installation of the app. Before you sign in these events are not linked to an account; once you are signed in they are linked to your account so we can see where people get stuck and improve the app. They are collected only while Usage analytics is on in You → Privacy & security; turning it off stops collection and discards any events not yet sent. To limit abuse, for events sent before you sign in our backend keeps a one-way hash of the sending IP address for up to two days. Events linked to your account are deleted when you delete your account.
What we do not collect. Your contacts or payment-card details. Payment is handled entirely by the Apple App Store or Google Play; we never see your card. Photos you take and files you import as trip documents never leave your device (see “Trip documents” above). We do not upload or receive them. If you use the “Add to calendar” feature, events are written to your device’s calendar locally. We never read or upload your calendar. Your location is never collected in the background or stored on our servers (see “Location data” above).
3. Why we process your data
We process your data to provide the core service (plan, save, edit, and display your trips), personalize AI suggestions based on the preferences you have set, deliver notifications you have opted into, maintain your subscription state and unlock Pro features, and investigate crashes or bugs (only if analytics is enabled). We never use your data for advertising and never sell or rent it to third parties.
4. Legal basis
Our legal basis for processing your account, profile, trip, notification, and subscription data is Article 6(1)(b) GDPR (performance of a contract: providing the Turavel service to you). Diagnostic analytics, where enabled, are processed on the basis of Article 6(1)(a) GDPR (consent), which you can withdraw at any time from You → Privacy & security.
5. How AI trip planning works
When you ask Turavel to plan a trip, the prompt and parameters you provide (destination, dates, travel style, etc.) are sent to our backend, which forwards them to a third-party AI provider so it can generate an itinerary. The AI provider receives only what is needed to produce the response. Your account email and personal identifiers are not included in the AI prompt. Generated itineraries are stored in your account and can be edited or deleted at any time.
6. How long we keep your data
We keep your data for as long as your account exists. When you delete your account (You → Privacy & security → Delete account; see turavel.app/delete-account for details) your account, profile, trips, saved destinations, notification history, and notification preferences are removed from our active databases immediately and from backups within 30 days. Anonymous aggregated analytics data (if you had it enabled) may be retained longer because it cannot be linked back to you.
7. Your rights under the GDPR
You have the right to access, rectify, erase, restrict the processing of, or port your personal data, and the right to object to processing based on legitimate interest. Most of these rights are available directly inside the app: you can view and edit your profile, trips, and preferences in the app itself, and permanently delete your account from You → Privacy & security. To make any other request, email us at hello@coplango.com. We will respond within 30 days. You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
8. Third-party processors
We use a small number of sub-processors under data processing agreements: Supabase (managed Postgres backend and authentication, UK region: AWS eu-west-2, London) stores your account, profile, trips, saved destinations, notification preferences, and inbox; RevenueCat (subscription state management) stores your Turavel Pro subscription status keyed by an anonymous identifier; Apple handles Sign in with Apple, App Store payments, and Apple Push Notification service delivery on iOS; Google handles Sign in with Google, Google Play payments and Firebase Cloud Messaging push delivery on Android, and route lookups for departure-time estimates (Google Maps Platform); a weather provider (Open-Meteo) receives the coordinates of your trip destinations (never your device location) to show forecasts; and an AI provider, invoked via Supabase Edge Functions, generates trip itineraries from the prompts you submit. None of these processors receive data beyond what is strictly necessary for their role, and your account identifiers are never sent to the AI provider.
9. International data transfers
Our backend data (Supabase) is stored in data centers in London, United Kingdom. The European Commission has recognised the UK as providing an adequate level of data protection (an adequacy decision under Article 45 GDPR), so this transfer needs no further safeguards. RevenueCat and the AI provider may process data in the United States under appropriate safeguards (Standard Contractual Clauses or an equivalent transfer mechanism). Apple processes Sign in with Apple, payment, and APNs data per its own policy at apple.com/legal/privacy; Google processes Sign in with Google, Google Play billing, push delivery, and route lookups per its policy at policies.google.com/privacy.
10. Security
We use Supabase Row Level Security so that only you can read your own data. All data is transmitted over HTTPS. We follow industry-standard practices for storing credentials and tokens, but no system is 100% secure. If you believe your account has been compromised, email us right away.
11. Children
Turavel is not directed at children under 13 (or the equivalent minimum age in your jurisdiction), and we do not knowingly collect data from them. If you believe a child has provided data to us, please email hello@coplango.com and we will delete it.
12. Changes to this policy
If we make material changes, we will update the “Last updated” date at the top and, where appropriate, notify you inside the app. Continued use of Turavel after the change means you accept the new policy.
13. Contact
Questions or concerns? Email hello@coplango.com, or write to Coplango B.V., Posthoornstraat 11, 3011 WD Rotterdam, The Netherlands.