Privacy Policy

Ollin is an AI travel planner and in-trip companion ("Ollin", "we", "us", "our"), operated by Sorce Code Labs, LLC. That company is based in the United States and is the controller of the personal information described in this policy. For anything privacy-related, including requests from the EU, UK, or Switzerland, reach us at hello@ollin.travel.

This policy explains what we collect, why, who we share it with, how long we keep it, and the choices and rights you have. We've added a plain-language note to most sections so you can skim.

Almost everything we hold is information you choose to put into Ollin:

• Account information — your email address, display name, and profile photo (avatar), provided directly or by your sign-in provider (for example Google or Apple) through our authentication provider, Supabase. If you use Sign in with Apple and choose to hide your email, Apple gives us a private relay address instead. When you create an account with an email address, we also record that you agreed to the Terms and Privacy Policy, which version, and when.
• Profile and preferences — your home city, home airport, base currency, and the travel preferences you save to personalize planning.
• Trips and itineraries — destinations, dates, places, itinerary and reservation items, notes, votes, task assignments, and booking details you add or import, including confirmation numbers, costs, and (for cruises) cabin and occupant names.
• Group members and invitations — when you invite someone to a trip by email, we store that email address (before they have an Ollin account) so we can deliver the invitation and connect them to the trip when they join. We also store friend connections you save.
• Expenses and settlements — shared costs you log, currencies and exchange rates, and how costs are split and settled among the group. If you save a Venmo, Cash App, PayPal, or Zelle handle, it is shown to the people you settle up with.
• Photos and videos — pictures and clips you upload to a trip, with any captions. Trip photos are stored in a private storage bucket and reached through signed links that expire (each link works for up to about a week), so they are meant to be viewable only by the trip's members, and by anyone with the share link if you make the trip publicly shareable (see Public pages and shared links). When you upload a JPEG or a video we read its capture time and, if it has one, its GPS location from the original file and save them with the photo in our database, so we can show it at the stop it matches; they are included in your data export. Before a JPEG, PNG, WebP, or GIF image is stored we remove embedded metadata from it in your browser or app (location, capture time, and camera details; we keep only what the image needs to display correctly, such as its rotation and colour profile). Our servers then check each trip photo, each video poster frame and each video again after it uploads and rewrite it if anything is left (for a video we blank its standard location boxes in place, without re-encoding it), and HEIC photos are converted to JPEG on our servers and checked the same way. This protection is partial. It cannot remove location data a camera records as a separate timed track inside a video. If the check cannot run, the photo is still saved. Photos and videos uploaded before this protection was added were checked and cleaned in a one-time pass on 14 October 2026; one file we could not read was left as it was. Image attachments you add to a trip get the same metadata removal; PDFs, passes and documents you import are stored as you uploaded them. Avoid uploading photos or videos whose metadata you don't want visible to the trip's members. Your profile photo is stored in a public bucket, so anyone who has its link can view it; we remove location metadata from JPEG, PNG, WebP, and GIF profile photos when they are uploaded.
• Checklists and packing lists — packing and to-do items you create for a trip.
• Messages — in-trip group chat and your concierge ("Ask Ollin") conversations, which we store so they persist across your devices.
• Feedback — what you send through the feedback form or Ask Ollin. We receive it with your account name and email address, and the page you were on, so we can reply.
• Passport vault (optional) — if you choose to use it, the travel identity numbers you save (passport number and expiry, Known Traveler / PreCheck number, and airline and hotel loyalty numbers). These are encrypted before storage — see Passport vault.
• Travel partner — if you link a travel partner, we record that connection so your trips, packing lists, and Passport vault stay in sync between you (see How your information is shared).
• Travel history — the cities and places on your trips, which we use to build your Atlas, passport stamps, and year in review.
• Photo frames (Pro) — if you add an Aura digital-frame upload address, we store it and email photos you choose to it.
• Emails you forward or let us scan — described in Connected inboxes and email forwarding.
• Signed-out visitors — if you use the signed-out trip preview, we process the text you type and your IP address (for abuse limits), even without an account.
• Activity and device data — when you were last active, your notification preferences, which notifications we sent, and your device's push token. Other usage, device, and log data is described in Cookies, analytics, and your choices, and in Security.

Aside from the Passport vault you choose to fill in, we do not ask for, and Ollin does not need, special-category data (such as health or religion). Please don't put sensitive personal information into trip notes or chat.

Ollin can turn booking confirmation emails into itinerary items in two ways: you can forward an email to your trip's private, per-trip import address, or — where available — connect your Outlook account so Ollin periodically scans your mailbox for travel booking emails and imports them automatically.

When you use these features, we store the raw email — including its full text — in our database while we process it. We use Claude, an AI model from Anthropic, to read the email and extract booking details such as flights, hotels, reservations, confirmation numbers, and costs. Attachments to an email you forward (such as a PDF confirmation) are read and sent to Claude along with the email; we do not store the attachment files. Documents or screenshots you upload to import a trip are kept in a private bucket while the import runs and removed once it has been processed. Booking emails often contain personal information about other people — fellow travelers' names, loyalty numbers, phone numbers — so only forward or connect content you have the right to share.

Raw forwarded or scanned email content is kept only as long as needed for parsing and troubleshooting: we remove the raw email body after 30 days and delete the processing record entirely at 90 days (the daily clean-up job can run up to a day late). The structured booking details we extract stay on your trip until you delete them.

If you connect Outlook, we ask Microsoft for read-only access to your mail (Microsoft's Mail.Read permission), which Microsoft grants for the whole mailbox. Each time we scan, our servers read the sender and subject of your most recent messages (up to 50 per scan) to pick out likely booking confirmations, and we open the full text only of messages that look like bookings for the trip. We do not keep the sender or subject of the other messages. Your OAuth access and refresh tokens are encrypted at rest with AES-256-GCM. You can disconnect an integration at any time in the app, which stops all scanning and removes the stored tokens, and you can also remove Ollin's access from your Microsoft account settings.

Ollin does not request access to your Gmail or any Google mailbox, and does not read Gmail through Google APIs; to import from Gmail, forward the confirmation to your trip's import address. We use Outlook data only to identify and import travel bookings into your trips, never for advertising. Our operator tools show only a forwarded email's sender, subject, and processing status. Ollin staff would open the content of an email only with your permission, where necessary for security or to fix a problem you report, or to comply with law.

The Passport vault is an optional place to keep the travel identity numbers you reach for at booking and check-in: your passport number and expiry, your Known Traveler / PreCheck number, and airline and hotel loyalty numbers. You only ever store what you choose to type in, and you can edit or delete any entry — or the whole vault — at any time.

We encrypt every number with AES-256-GCM before it's written to our database, so the stored value is ciphertext, never plaintext, and a database dump alone can't reveal it. Because our servers hold the encryption keys, this protects against a database leak, not against access by Ollin itself. In the app, the identity documents — your passport number, Known Traveler / PreCheck number, and redress number — stay masked (for example, •••• 7709) until you reveal them, and on iPhone that reveal is behind Face ID or Touch ID. Lower-risk details you need at a check-in desk — expiry dates, issuing country, and loyalty membership numbers — are shown in the app as you saved them. Access is limited by database row-level security to you and, if you link one, your active travel partner. We do not send your Passport vault to any AI model, advertiser, or booking partner. If browser analytics is active for you, a session recording can show what is on your screen, including a number you have revealed (see Cookies, analytics, and your choices).

When you add a flight to a trip, Ollin can look up its live status to power gate, delay, and departure reminders. To do this our servers send the flight number and date to FlightAware's AeroAPI and store the status details (times, gates, terminals, delay minutes) on the trip. We send only the flight and date — not your name or account — and you can remove a flight, or turn its notifications off, at any time.

For some destinations, Ollin generates a short, news-grounded "what to know right now" briefing (safety, events, and travel notes). Our servers fetch recent news headlines for the destination from GNews and pass them to Claude to summarize. We send only the destination name — never your identity — and a single briefing is cached and shared across everyone viewing that place, so this feature isn't tied to you personally.

Some parts of Ollin are meant to be seen by people who are not on your trip. Anyone with the link can see them without an account, and anyone can pass a link on, so treat these links as public:

• Public trip guide (ollin.travel/t/…) — if you make a trip publicly shareable, anyone with the link can view the itinerary, places, and photos you've made public. Public trip pages can be indexed by search engines. They don't show private fields like confirmation numbers, costs, or owner details.
• Family sheet (ollin.travel/f/…) — a logistics page for someone who isn't on the trip. It shows flights and the itinerary, and leaves out confirmation numbers, street addresses, expenses, chat, photos, and the roster.
• Discover — if you publish a trip to Discover, its places, day by day, become public. The byline shows your display name and photo unless you turn bylines off in Settings. You see the public version before you publish, and you can unpublish it.
• Public traveler profile (ollin.travel/@handle) — this exists only if you create it. It shows the handle and bio you choose and the trips you've published. You can switch it off.
• Settle-up links — a link you share to settle expenses shows the amounts owed, and the payment handle you saved, to whoever opens it.

We use your information to:

• Provide Ollin — create and sync trips across your devices, enable group planning and voting, split expenses, store photos and checklists, and power group and concierge chat.
• Power AI features — generate itineraries, answer concierge questions, build trip recaps, and parse booking emails (see AI processing).
• Send you email about your account and trips — invitations, receipts, and trip emails such as countdowns, day-of itineraries, all-aboard alerts, destination advisories, settle-up reminders, trip recaps, and passport or PreCheck expiry reminders — through Resend. Several of these are on by default for new accounts, and you can turn any of them off in Settings → Notifications or with the unsubscribe link in each email.
• Send you up to three getting-started tips emails in your first weeks, which you can turn off the same way.
• Send web and mobile push notifications you opt into, such as trip countdowns, day-of itineraries, time-sensitive reminders, booking nudges, and group activity.
• Process subscription payments and manage your plan — through Stripe on the web, and through Apple's App Store or Google Play in the mobile apps (managed with RevenueCat).
• Keep Ollin secure and reliable — prevent abuse, rate-limit and debug our systems, and monitor service health.
• Understand how the product is used, within the limits in Cookies, analytics, and your choices.
• Comply with law and enforce our Terms of Service.

Where the law requires a legal basis (for example, in the EU/EEA, UK, and Switzerland), we rely on these:

• Providing Ollin (your account, trips, groups, expenses, photos, chat, itineraries, bookings, subscriptions and billing, and support): performance of our contract with you.
• AI features, including parsing the emails you forward or connect: performance of our contract, and your consent when you connect a mailbox.
• Passport vault: your consent, which you give by choosing to save the numbers and can withdraw by deleting them.
• In-trip location: your consent, which you give by turning it on in Settings and can withdraw there.
• Browser analytics in the EEA, UK, and Switzerland: your consent. Elsewhere we rely on our legitimate interest, with the opt-out described below.
• Server-side product and reliability events tied to your account: the same consent as browser analytics where we can see your choice (opt-in in the EEA, UK, and Switzerland), and otherwise our legitimate interest in running, securing, and improving Ollin, balanced against your rights. Security and abuse prevention, rate limiting, and debugging: our legitimate interest. You may object (see Your rights and choices).
• Push notifications: your consent, through your device or browser permission. Trip emails: performance of our contract and our legitimate interest, with unsubscribe. Getting-started tips: our legitimate interest, with unsubscribe.
• Complying with law and enforcing our Terms: legal obligation and legitimate interest.

We do not sell your personal information for money and we do not use it for third-party advertising. See U.S. state privacy rights.

Ollin's planning features are powered by Claude, an AI model provided by Anthropic, accessed over Anthropic's API. We send Claude the content each feature needs: your trip details and saved preferences (such as home city and travel styles) when generating an itinerary; your messages, the trip's context, and the names of the trip's members (including the email address of anyone you've invited who hasn't joined) when you chat with Ask Ollin; your trip's highlights when creating a recap; forwarded or scanned emails, and documents, screenshots, or receipts you ask us to read (where that feature is on), when extracting bookings or expenses; and, in the signed-out trip preview, the text you type. Email and document parsing can include personal information about you and others. We do not send Claude your Passport vault, your device's location coordinates, or your saved payment handles.

When the concierge needs current information, it may run a web search through Anthropic; in that case model-generated search queries (with a destination hint) are sent to Anthropic's search provider, along with a destination-level location hint rather than your own location.

Under Anthropic's commercial API terms, the inputs we send and the outputs we receive are not used to train Anthropic's models. This is a contractual commitment from Anthropic, not something Ollin enforces in code.

Automated decisions. Claude generates suggestions, summaries, and (when you ask) edits to your itinerary. Bookings found in email go to a review queue that you accept or dismiss before they change your itinerary. We do not use AI or other automated processing to make decisions about you that have legal or similarly significant effects, such as deciding whether you can use Ollin or credit, employment, or housing decisions. Free-plan AI usage limits apply automatically, as described in the Terms.

Signed-out trip preview: the plan generated for a request is cached for up to 14 days and may be shown to someone who types the same request.

We use a small set of providers (sub-processors) to run Ollin. Each one processes information to provide its service to us:

• Supabase — database, authentication, and file storage.
• Vercel — application hosting, plus cookieless aggregate web analytics and page-speed measurement.
• Anthropic — Claude AI for itinerary generation, concierge chat, trip recaps, and email parsing; inputs and outputs are not used to train its models.
• Stripe — subscription payments and billing on the web. Your card details go directly to Stripe and never touch our servers.
• PostHog — product analytics, session recordings, and error tracking, hosted in the United States. Browser analytics does not load or receive anything until you opt in in the EEA/UK/Switzerland, and is on by default with an opt-out elsewhere. Server-side product and reliability events tied to your account ID follow your analytics choice and Global Privacy Control where your browser's request tells us (see the cookies section).
• Resend — email delivery, and receiving the booking emails you forward to your trip's import address (we send from hello@ollin.travel).
• Apple and Google — purchases made in the iOS and Android apps are billed by Apple's App Store or Google Play under their terms (we never see your card details); Apple and Google also deliver push notifications to the apps (Apple Push Notification service and Firebase Cloud Messaging), and provide Sign in with Apple and Google sign-in where you use them.
• RevenueCat — manages and verifies subscriptions bought in the iOS and Android apps. It receives your Ollin account ID and your purchase and entitlement status from the app stores, plus the standard technical data its software sends, and tells us which plan you have; it does not receive your card details or the contents of your trips.
• Google — Maps and Places features (these run in your browser; see Maps, geocoding, and weather), server-side place lookups (we send place names, not your identity), Google sign-in where you use it, and the Routes API for live leave-by driving durations if you turn on in-trip location (see In-trip location and leave-by times).
• Microsoft — Outlook mailbox import, only if you connect an Outlook account.
• FlightAware (AeroAPI) — live flight status for delay and gate alerts; we send a flight number and date, not your identity (see Flight status and delay alerts).
• GNews — recent news headlines used to ground destination briefings; we send a destination name, not your identity (see Destination briefings).
• OpenStreetMap — map tiles, and its Nominatim service for looking up place coordinates and, if you've turned on in-trip location, a neighborhood name for your coordinates (we do not send your identity).
• Open-Meteo — weather forecasts (we send coordinates and dates, not your identity).
• Frankfurter (European Central Bank reference rates) — currency exchange rates; we send a currency pair.
• Pexels, Unsplash, and Openverse — destination and cover imagery; we send only a destination search term, not your identity.
• Travelpayouts, GetYourGuide, and Stay22 — affiliate/booking partners for outbound booking links. Attribution rides the outbound link itself; we run no partner tracking script in your browser (see Booking links and affiliate partners).
• ChatForger — the chat assistant on Ollin’s public marketing pages (not inside the signed-in app, not on the contact, sign-in or trip-preview pages, and not in the iOS or Android apps). Ollin shows its own chat button on those pages for some visitors, and only when your analytics choice allows it: no button is shown if you have opted out, if your browser sends Global Privacy Control or Do Not Track, if you are signed in to Ollin, or, in the EEA/UK/Switzerland, before you opt in. ChatForger’s code is not loaded, and ChatForger receives nothing from your browser, until you click that button. Once you open the chat, ChatForger receives your request the way any website does (including your IP address and browser details), and the messages you type. A script on a page can read what is typed on that page, including the trip request box on the home page, so once the chat is open do not type anything you would not want ChatForger to have into that page. It keeps a chat session ID in your browser’s local storage for up to 24 hours so a conversation can continue. Lead capture (asking for your name or email) and emailing or downloading a transcript are options in ChatForger’s own dashboard; if they are switched on, whatever details you give there are sent to ChatForger. Do not put sensitive information, such as passport or payment details, in the chat.
• HeyCatch — product analytics on Ollin’s public marketing pages (not inside the signed-in app, not on the contact, sign-in, trip-preview or shared-link pages, and not in the iOS or Android apps). It follows the same analytics choice as PostHog: its code is not downloaded, and HeyCatch receives nothing from your browser, if you have opted out, if your browser sends Global Privacy Control or Do Not Track, if you are signed in to Ollin, or, in the EEA/UK/Switzerland, before you opt in. When it is active, HeyCatch receives the pages you view and route changes, your clicks (the element you clicked and its attributes; the text of what you clicked is removed before it is sent), and your request details the way any website does (including your IP address and browser details), and it stores an identifier in your browser. HeyCatch does not record sessions (no screen replay) on Ollin. From your browser we do not send it your email address, name, or Ollin account ID. Separately, Ollin’s servers send HeyCatch a small set of business-outcome events, so we can tell which campaigns lead to sign-ups and purchases: signing up, starting a trial, subscribing, renewing, cancelling, buying a Trip Pass, and getting a refund, including purchases made in the iOS and Android apps. Each event contains your Ollin account ID and only these details: the plan, billing interval, amount and currency, where the event came from (web, App Store or Google Play), and the campaign that first brought you to Ollin (its source, campaign, landing page and referring site). It never contains your email address or your name. We send these only for accounts where analytics was allowed when you first arrived at Ollin (the same choice described above); if you opted out, if your browser sent Global Privacy Control or Do Not Track, or if you are in the EEA, UK, or Switzerland and had not opted in, the event stays in our own records and is not sent to HeyCatch. Test purchases are never sent. When you are signed in and withdraw your analytics choice, we record that on your account, and from then on these events are no longer sent to HeyCatch or PostHog. If you withdrew before signing in, we apply that choice to your account when you sign in. The sign-up and purchase events themselves (plan, amount, currency and the campaign that brought you) are still recorded in our own database as business records, because we need them to keep accounts, refunds and revenue straight; they are not sent to analytics partners after you withdraw. Browser collection stops and that identifier is cleared.
• Upstash — rate limiting; short-lived caches (for example, a live driving time for about two minutes and signed-out preview plans for up to 14 days); and a job queue for imports and photo downloads.

We keep this list current and will update this section as our sub-processors change.

When you tap a booking link for hotels, flights, activities, or restaurants, you leave Ollin and continue on a partner site such as Booking.com, Stay22, Kayak, Viator, GetYourGuide, Hipcamp, or OpenTable — in some cases routed through our affiliate partner Travelpayouts or through a same-origin redirect on our own domain that forwards you to the partner and keeps a short record of the click (described below). Those sites operate under their own privacy policies and may set their own cookies. We may earn a commission on bookings made through these links, at no extra cost to you.

Affiliate attribution happens in the outbound link itself: it carries our partner ID so the partner can credit us. Ollin does not load any partner or advertising tracking script in your browser, and sets no partner cookie. When you tap through, the partner site receives your visit the way any website does (including your IP address), and the link carries trip details like destination, dates, and party size, and, for some partners, a random one-time reference for that single click so a commission can be matched to it. It never contains your name, email, or account ID, and it is not reused across clicks. Where more than one partner covers the same kind of booking, we may show first the one that pays us the higher commission; the price you pay is the same.

Click record. When a booking link goes through our own redirect, we keep a short operational record of that click so we can check that partners credited us correctly: which partner it was, which part of Ollin the link was on, the trip it was tapped from (if any), your Ollin account ID (if you are signed in), the partner's domain name, the time, and a random per-click code that also appears in the partner link so the partner's commission report can be matched to the click. We do not record your IP address, your device or browser details, the full link, or what you searched for. This record is part of running and auditing our affiliate arrangements, so it is separate from browser analytics and is kept even if you have turned analytics off. It is deleted after 400 days, and your account ID is removed from it if you delete your account. Links that go straight to a partner without our redirect are not recorded by us.

Ollin sets only the following by default:

• Supabase authentication cookies that keep you signed in.
• Short-lived security cookies during sign-in, including a 10-minute cookie that protects the mailbox connection handshake against forgery.
• Preference cookies and storage that remember choices you or your device make: display theme, distance unit, your time zone, whether the launch splash has been shown, your analytics choice (also copied into a first-party cookie so our servers can honor it), and a coarse, non-identifying region flag (derived from your approximate country) used only to set your default privacy posture.
• Service-worker caches and on-device storage that let the app work as a PWA and offline, including trips and photos waiting to upload.

How our browser analytics (PostHog) behaves by default depends on where you are. In the EEA, UK, and Switzerland — and whenever we cannot tell where you are — it does not run at all until you opt in: the analytics code is not loaded, and no page views, clicks, or session recordings are sent from your browser. Elsewhere (including the US), browser analytics is on by default and you can opt out at any time in Settings or via “Your privacy choices” in the footer. Your choice is saved in the browser or app you made it in, so repeat it on each device you use. Separately, Vercel's web analytics and speed measurement collect aggregate, cookieless usage and page-performance metrics that aren't tied to your identity.

When browser analytics is active for you (because you opted in, or because it is on by default where you are), we set a first-party PostHog cookie and a localStorage identifier and record page views, clicks and taps, and page-performance data. We may also record a “session recording” of your visit, which is a replay of what the screen showed and how you interacted with it, so we can find bugs and confusing screens. Recordings mask the values of all form fields and leave out the parts of the app that show travel documents, chat messages, expenses and balances, payment details, booking confirmation numbers, and account or billing pages; other screens, such as itinerary and map views, can still be captured and can show trip details that were on your screen. When you sign in, this activity is linked to your Ollin account ID (not your email address). Opting out in the app or the footer stops it, removes the identifier, and nothing further is collected from your browser.

Our servers also send a limited set of product and reliability events to PostHog, tied to your Ollin account ID. They cover things like signing up or in, creating or importing a trip, using Ask Ollin (counts and outcomes, not the text of your messages), checkout and subscription changes, saving a home airport, sending feedback, and server errors. These follow the same choices as browser analytics, using three signals your browser sends with each request: a Global Privacy Control or Do Not Track header, a small first-party cookie that copies your analytics choice so our servers can honor it, and the region cookie described above. If you opted out, if your browser sends GPC or Do Not Track, or if you are in the EEA, UK, or Switzerland (or we cannot tell where you are) and have not opted in, we do not send these events for that request. The exception is activity with no browser request behind it, such as payment-provider webhooks, scheduled jobs, and background workers: those run without any of your signals, so we cannot apply your choice to them and they are recorded on the basis of our legitimate interest in running and securing Ollin. We also evaluate feature flags for your account ID with PostHog so features can be switched on or off safely; that lookup is part of running the product, and your choice only stops the usage event it would otherwise record. You can object to any of this by emailing hello@ollin.travel.

We honor Global Privacy Control (GPC) and Do Not Track browser signals. When your browser sends one, we treat browser analytics as denied everywhere, regardless of region, and the signal overrides any choice stored on the device. These signals also stop the account-linked server-side events described above for requests that carry them, but they do not turn off background activity with no browser request, feature-flag lookups, or Vercel's cookieless aggregate analytics.

Ollin does not use advertising networks, does not show targeted ads, and loads no third-party advertising or affiliate tracker in your browser.

Map display and place autocomplete are powered by Google Maps and Places where configured. These run in your browser, so when you view maps or type into place search, Google receives your IP address and what you type, under Google's privacy policy. If Google Maps isn't configured, we fall back to OpenStreetMap tiles, in which case OpenStreetMap's tile servers receive your request instead.

Looking up coordinates for place and destination names (geocoding) and fetching weather are done on our servers via OpenStreetMap's Nominatim, Google Places as a fallback, and Open-Meteo, so those providers see only place names, coordinates, and dates — not your identity or IP.

Working out which city a saved stop is in — for your Atlas, your passport stamps, and your year in review — happens entirely on our own servers, against a copy of the GeoNames place database that we ship with Ollin. No request leaves us, so nobody outside Ollin sees where your trips went. GeoNames data is used under the Creative Commons Attribution 4.0 licence; we're grateful for it.

If you turn it on, Ollin can use your device's precise location — latitude, longitude, and accuracy — to tell you when to leave for your next stop and to offer to shift the rest of the day when you won't make it in time. This is off by default for everyone, in every region, and a single switch in Settings governs every use of it. With the switch off, Ollin never asks your device for your location, anywhere in the app.

With it on, Ollin uses your location in three places and nowhere else. First, while a trip is underway, to keep your leave-by time honest — that's the ongoing use, and it stops when the trip does. Second, only when you tap “Show what's nearby” on an underway trip, to ground that one set of suggestions where you actually are. Third, only when you tap “Use my location” in a flight search, to fill in your nearest airport — that one is worked out on your device and the coordinates never leave your browser. The second and third happen once per tap and never in the background.

For the leave-by time, our servers send your current coordinates and your stop's coordinates to Google's Routes API to get a live driving duration, and hold that duration in a short-lived cache (about two minutes) so a burst of screen refreshes doesn't trigger repeated lookups. For nearby suggestions, your coordinates are turned into a neighborhood name on our servers (via OpenStreetMap's Nominatim, as described above) and only that name is used to find suggestions — the coordinates themselves are never sent to our AI provider. We don't keep a history of where you've been: there's no visit log or route trail, and nothing beyond that short cache — so there's no position history to delete, because none is created. No advertising or analytics provider — including PostHog, which powers our product analytics — receives your position. (GPS coordinates embedded in photos you upload are a separate matter; see Information we collect.)

Your location isn't shown to anyone else. In this release, other members of your trip never see your position, even on trips you otherwise share with them.

You can turn location use on or off at any time in Settings, and you can revoke Ollin's location permission at the operating-system level whenever you like.

Email: several trip-related email types are on by default for new accounts. Settings → Notifications shows exactly which types are on, and every notification email has a one-click unsubscribe link.

Push: if you opt in, Ollin can send web push notifications (for example, trip countdowns, day-of itineraries, booking nudges, and group activity). To deliver them, we store your browser's push subscription (an endpoint and encryption keys) and your notification preferences, including any quiet hours you set. We send notifications through your browser's push service. In the iOS and Android apps, we instead store your device's push token (issued by Apple's push service or Google's Firebase Cloud Messaging) and your notification preferences, and deliver notifications through those services; tokens are removed when you sign out of a device or delete your account. You can turn notifications off in the app or revoke the permission in your device or browser settings at any time.

On supported devices, you can share a photo into Ollin from another app using your device's share menu, which uploads it to the trip you choose. Photos go to a private storage bucket and are served through expiring signed links. As described under Information we collect, we read and save a JPEG's or video's capture time and GPS location when it has them, and then remove embedded metadata from the stored copy of JPEG, PNG, WebP, and GIF images and from videos (not from photos uploaded earlier). Photos on a trip you make public become viewable by anyone with the share link.

Trips are shared with the people in them: group members can see the trip's itinerary, bookings, expenses, photos, checklists, and chat, according to their role (owner, editor, or viewer). If you create a shareable public trip link, anyone with that link can view what you've chosen to make public — but not private fields like confirmation numbers, costs, or owner details, which are deliberately excluded from public trip pages. See Public pages and shared links for the other links Ollin can create.

If you link a travel partner, the two of you share your trips and packing lists automatically, and each of you can see the other's Passport vault entries; this is the point of the feature. You can remove a travel partner at any time in Settings, which stops the sharing going forward.

Beyond the service providers listed above, we disclose information only if required by law or legal process, to protect the rights and safety of our users or the public, or — with notice to you where allowed — as part of a merger, acquisition, or sale of the business. We do not sell your personal information for money.

We keep your information for as long as your account is active, and then as described here:

• Account, profile, trip, and photo data — kept until you delete the content or your account.
• Passport vault entries — kept (encrypted) until you delete the entry or your account.
• Raw forwarded or scanned email content — body removed after 30 days, processing record (sender, subject, extracted fields) deleted at 90 days; the daily clean-up job can run up to a day late.
• In-trip live location — your coordinates are cached for about two minutes to compute a live leave-by time, then discarded; we don't keep a position history (see In-trip location and leave-by times).
• Gift links (“Build a trip for a friend”) — a record of who sent it, when it was opened, and a fingerprint of the prompt (not the prompt text): deleted after 180 days.
• Photo download archives and account data export files — deleted 24 hours after they are created, and removed straight away if you delete your account.
• Signed-out trip preview — the plan generated for a request is cached for up to 14 days.
• Billing records — retained by Stripe, Apple, or Google (whichever processed your payment) as required for tax and accounting purposes.
• Analytics events, session recordings, and error reports — kept by PostHog under its retention schedule for our project until deleted. When you delete your account we ask PostHog to delete the ones linked to your account ID (see Your rights and choices).
• Server logs — kept by our hosting provider under its retention schedule.
• Backups — deleted data may remain in encrypted backups until they are overwritten on the provider's normal cycle.
• A minimal record of a privacy or deletion request (such as the email you wrote from and the date) may be kept to show we handled it.

All traffic to Ollin is encrypted in transit (TLS). We use database row-level security so that, in the normal operation of the app, trip data is available only to the members of each trip. A small number of Ollin staff have operator access to our systems for support, security, and reliability. Mailbox OAuth tokens and Passport vault numbers are encrypted at rest with AES-256-GCM; because the app holds the keys, this protects against a database leak, not against access by Ollin itself. Trip photos live in a private bucket reached through signed links that expire. Card details are handled entirely by Stripe, Apple, or Google and never reach our servers. We rate-limit sensitive endpoints, which involves briefly processing IP addresses, to prevent abuse.

No system is perfectly secure, and we cannot guarantee the security of your information. If a breach affects your personal information, we will notify you and the relevant authorities as the law requires and in the timeframes it sets.

Ollin is operated from the United States, and your information is processed in the United States and in other countries where we and our providers operate. If you use Ollin from the EU/EEA, UK, or Switzerland, your information is transferred to the United States. For those transfers we rely on the safeguards the law recognizes, such as the Standard Contractual Clauses (and the UK Addendum) or, for providers that are certified, the EU-U.S. Data Privacy Framework and its UK and Swiss extensions.

Depending on where you live, you have some or all of these rights over your personal information: to access it and get a copy; to correct it; to delete it; to receive it in a portable format; to restrict or object to processing, including processing based on our legitimate interests; and to withdraw consent at any time (for example, the analytics opt-in, push notifications, in-trip location, or a connected mailbox). Withdrawing consent doesn't affect what we did before. If you're in the EU/EEA, UK, or Switzerland, you can also lodge a complaint with your data protection supervisory authority. Choices you make in Settings or the footer apply to the browser or app you make them in, so repeat them on each device. If you were invited to a trip by email and never made an account, you can email hello@ollin.travel to see or delete the email address we hold for the invitation.

Getting a copy of your data: you can download a copy of your account data yourself from Settings (Data & storage, Download your data), as a ZIP containing a JSON file that covers your profile, Passport vault, trips, expenses, checklists, notes, messages and a list of your uploaded photos. You can also download a trip's photos as a ZIP and export a trip to your calendar. You can still email hello@ollin.travel for a copy and we will respond to your request within 30 days.

California residents have additional rights; see U.S. state privacy rights. We will never discriminate against you for exercising your rights.

Deleting your account: you can delete your account from Settings in the app. Deletion happens straight away and cannot be undone. It deletes:

• your profile and sign-in;
• the trips you own and everything on them, including photos, items, expenses, and chat that other members added (so tell your group first);
• your Passport vault;
• your mailbox connections and their tokens;
• your notification settings and device tokens;
• your Ask Ollin and trip chat messages, votes, and checklists;
• expenses you paid on other people's trips;
• your friend and travel-partner links;
• your Stripe plan subscription and any Stripe storage add-on subscription, which are cancelled; and
• the files stored for your account: the photos and videos on trips you own, your profile photo, documents you uploaded for import, and any account data export or photo download file waiting to be collected. They are removed from storage right after your account record is deleted.

We also send deletion requests to three services that hold a copy of your data:

• PostHog (analytics): your person profile and the events and session recordings linked to your account ID. PostHog carries out the deletion on its side, and activity that was never linked to your account ID is not something we can find to delete.
• Stripe: the customer record linked to your subscription. Stripe keeps its own invoice, payment, and tax records as tax and accounting law requires.
• RevenueCat: your subscriber record. We ask RevenueCat to delete it; Apple and Google keep their own purchase records.

These requests are made after your account is deleted, and each is best-effort. If one fails (for example because the service is down), we record the failure, with the service name and your account or customer identifier but not your content, so it can be finished. A daily job retries failed requests, up to 10 times, and we are alerted if one keeps failing. Email us if you want us to check that a request was completed.

Not deleted by the in-app button:

• Items and photos you added to trips owned by other people stay on those trips, no longer linked to your account; activity-log entries from you stay, with your name removed.
• Stripe keeps its own invoice, payment, and tax records as tax and accounting law requires. A subscription bought through Apple's App Store or Google Play is not cancelled by deleting your account, so cancel it in your Apple or Google subscription settings; Apple and Google keep their own purchase records.
• Email delivery records at Resend remain with that provider until deleted under its schedule.
• Residual copies in backups for a limited period.
• If the storage clean-up step fails, the failure is logged but not retried automatically; the leftover files are not tied to any account, and you can email us to have them removed.

For anything else, email hello@ollin.travel. We respond to privacy requests within 30 days, and if a request is complex and we need longer we will tell you why. We may need to verify your identity before acting on a request.

This section is for California residents, who have specific rights under California privacy law. Residents of other states with similar laws may exercise the same rights as the law of their state provides.

In the past 12 months we have collected these categories of personal information, and disclosed them to the service providers listed above as needed to run Ollin:

• Identifiers — email address, name, account ID, IP address, device and cookie identifiers, and push tokens.
• Customer records and commercial information — profile, plan and subscription status, billing and purchase status (card details stay with Stripe, Apple, or Google), payment handles, and trip and booking details you enter.
• Government identifiers (sensitive) — passport number and country, Known Traveler and redress numbers, only if you save them in the Passport vault. Stored encrypted, and disclosed only to your linked travel partner.
• Precise geolocation (sensitive) — your device's location if you turn on in-trip location, and GPS coordinates we read from photos and videos you upload, when a photo has them. For in-trip location, coordinates go to Google (live driving times) and OpenStreetMap (neighborhood names), and not to analytics providers.
• Contents of email (sensitive) — booking emails you forward, and booking emails found in an Outlook mailbox you connect. Disclosed to Anthropic to extract booking details.
• Account log-in (sensitive) — your email and password or sign-in provider credentials, held by our authentication provider.
• Internet and network activity — pages and screens viewed, clicks and taps, performance data, session recordings, error reports, and usage events. Disclosed to PostHog, HeyCatch (page views and clicks on public marketing pages, plus the sign-up and purchase events described above), and Vercel.
• Audio, visual, and similar information — photos, videos, and your profile photo.
• Content you create — trip notes, chat, Ask Ollin conversations, expenses, checklists, and feedback. Disclosed to Anthropic where an AI feature processes it, and to the other members of your trips.
• Inferences — places visited (your Atlas and stamps) and saved preferences. We don't build advertising profiles.

We do not intentionally collect health data or biometric templates. Face ID and Touch ID run on your device, and we don't receive your biometric data.

Sources: you; your sign-in provider; other people who add you to a trip; your device and browser; Microsoft, if you connect Outlook; and app stores and payment processors. Purposes: those listed under How we use your information.

Sensitive personal information. We use sensitive personal information only to provide the features you ask for, to keep Ollin secure, and as the law allows, and not to infer characteristics about you. Because of that, we don't offer a separate “limit the use of my sensitive personal information” link.

Sale and sharing. We do not sell personal information for money, and we do not share it for cross-context behavioral advertising: we run no advertising or affiliate tracker in your browser and give no partner an identifier for you. Affiliate partners credit us through the partner ID in the outbound link you choose to tap. We treat Global Privacy Control as a valid opt-out request for browser analytics, and we don't knowingly sell or share the personal information of people under 16.

Your California rights are to know and access the personal information we hold, delete it, correct it, receive a portable copy, opt out of sale and sharing, and not to be discriminated against for exercising these rights. We don't offer financial incentives for personal information.

To use them, email hello@ollin.travel or use the controls in Settings. We respond within 30 days, and if we need longer we will tell you why. To protect your account we verify requests by asking you to reply from, or sign in with, the email on your account, and we won't ask for more than we need. You can use an authorized agent; we may ask for your written permission for them and may verify with you directly.

Ollin is not directed at children, and you must be at least 16 to use it. We don't knowingly collect personal information from anyone under 16, and we don't knowingly sell or share the personal information of anyone under 16. If you believe a child under 16 has given us personal information, email hello@ollin.travel and we'll delete it.

We'll update this policy as Ollin evolves. When we do, we'll change the date at the top, and for significant changes we'll notify you in the app or by email before they take effect.

Questions, requests, or concerns about privacy? Email hello@ollin.travel and we'll be happy to help.

You can also reach us by mail at Sorce Code Labs, LLC, 5411 S. Vine Street, Unit #3, Murray, UT 84107, United States.