Privacy Policy

1. Who we are

Travela ("we", "us") is a travel planning and social app at gettravela.com. This policy explains what personal data we process when you use Travela, why we process it, who helps us, how long we keep it and the choices you have. You can reach us at the address at the end of this policy.

2. What we collect

We collect what the app needs to work:

• Account: your name, email address, date of birth (to confirm you are at least 13) and sign-in details. Passwords are handled by our sign-in provider; we never see or store them.
• Profile: username, photo, cover image, bio, home city and country, interests and, if you turn on matching, your matching photos and bio.
• Trips: the trips you create or join, their dates, your availability, travel preferences, budget answers, plans, expenses and notes.
• Posts and messages: posts, stories, comments and likes, and the messages you send in trip groups and direct messages.
• Location (optional): only if you turn on “Show me to nearby travellers”. While you use the plan map we store an approximate position, rounded to about 1 km, never your exact location. It is deleted after 4 hours, or at once when you turn the setting off.
• Payments: if you buy a subscription, our payment provider handles your card details. We only receive the subscription status and a customer reference.
• Waitlist and contact: if you join our waitlist or write to us: your name, email address, optional age range, your message and whether you agreed to receive product emails.
• Technical data: IP address, browser and device type, and logs of requests to our servers, used to keep the service secure and working.
• Browser storage: we keep your sign-in session, language and theme in your browser's local storage. We do not use advertising cookies or cross-site trackers.

3. How we use it

We use your data to:

• run your account, trips, plans, messages and social features
• build trip plans and cost estimates from your group's dates and preferences
• suggest travellers to connect with, if you turn matching on
• send you notifications about your trips, friends and messages
• keep Travela secure, prevent abuse and handle reports
• understand how the app is used, in aggregate, to fix problems and improve it

4. AI features

When you ask Travela for a trip plan, place suggestions or a cost estimate, we send the destination, dates, group size, your group's travel preferences, the trip description and the names of the stops already planned to our AI providers. Anthropic's Claude API generates trip plans, place suggestions, price estimates and texts. Flight prices for date suggestions come from Travelpayouts (Aviasales), asked with city names, airport codes and dates only. We do not send your name, email address, messages or photos. The result is stored in your trip.

5. Analytics and cookies

We use PostHog, with servers in the EU, to understand how Travela is used and to find errors:

• What is sent: your internal user number (never your name, email address or username), the actions you take, such as signing up, signing in, creating a trip or sending a message (never what the message says), the pages you view, your browser and device type, and errors. Our own servers keep a log of these actions for 180 days.
• Cookies: on your first visit a banner asks for your choice. If you accept, PostHog keeps an identifier in a cookie and your browser's local storage to recognise your device across visits. If you decline, or until you answer, your visits are counted anonymously without cookies, using a hash that changes every day. The actions you take while signed in are still sent from our servers to PostHog under your user number, without cookies.
• Your choice: you can change it at any time with “Cookie settings” at the bottom of the home page or the button below.
• Retention: PostHog keeps this data for one year.

6. Why we are allowed to

We process your data to provide the service you signed up for (contract), to keep it secure and improve it (legitimate interests), with your consent for optional features such as nearby travellers, matching and product emails, and where the law requires it. You can withdraw consent at any time in Settings.

7. Who sees and processes it

We do not sell your personal data. Other Travela users see what you share with them: your profile and posts according to your privacy setting, and your activity in a trip with that trip's members. Only if you turn on “Show me to travellers going there on these dates” for a trip, people going to the same city on overlapping dates who turned it on for their own trip see your first name, photo, age, shared interests, matching bio and the days you overlap, never the trip itself, its members or its plan. These providers process data for us:

• Hetzner (Germany): servers and database
• Cloudflare: domain, encrypted connections, attack protection, photo storage and cookie-free visitor statistics
• Google Firebase Authentication: sign-in, passwords and email verification
• MailBaby: sending account emails (verification, setting a password), trip invitations someone sends to your email address, and the notification emails you turn on in Settings
• Anthropic (Claude API): AI trip plans, place suggestions, price estimates and texts
• Stripe: payments, if you subscribe
• Duffel: flight and accommodation prices, when shown
• Travelpayouts (Aviasales): flight prices for date suggestions and the date check, asked with city names, airport codes and dates only
• OpenFreeMap and OpenStreetMap: map tiles, which your browser requests directly
• Wikimedia: photos and descriptions of places, loaded from Wikimedia Commons
• PostHog (EU): product analytics and error tracking, see “Analytics and cookies”

8. Where it is stored

Our servers and database are in Germany, and some providers, such as those for sign-in, email and AI, process data in other countries outside Türkiye and the European Economic Area. They are bound by their data processing terms to protect it.

9. How long we keep it

We keep your data while your account exists. When you delete your account in Settings, we delete your sign-in account, remove your personal details (name, email address, username, photo, bio, date of birth, home city and contact details) and stop any location sharing. What you shared stays in anonymised form: your posts and their photos, comments, messages and your part of shared trips remain, shown as “Deleted traveler”. To remove a post or photo, delete it before deleting your account, or ask us. Database backups are kept in private, encrypted storage so we can recover from failures.

10. Security

We use encrypted connections (HTTPS), access controls, and encrypted storage for uploaded files. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

11. Your rights

Depending on where you live, for example under the GDPR or Türkiye's Personal Data Protection Law (KVKK), you can:

• ask what data we hold about you and get a copy
• correct inaccurate or incomplete data, most of it directly in your profile and settings
• delete your account in Settings, which anonymises what you shared, or ask us to erase specific content
• object to or restrict some processing
• receive your data in a portable format
• withdraw consent for optional features at any time
• complain to a data protection authority, in Türkiye the Personal Data Protection Authority (KVKK)

12. Children

You must be at least 13 to use Travela. If you believe a child under 13 has given us personal data, contact us and we will delete it.

13. Changes to this policy

When our practices change we update this page and the date at the top. If a change significantly affects how we use your data, we will point it out in the app.

14. Contact

For questions about this policy or to exercise your rights, write to us at:

[email protected]